Webpage virus detection method and device, equipment and storage medium

Abstract

The invention discloses a webpage virus detection method, device and equipment and a storage medium, and the method comprises the steps: when it is monitored that a preset type file is loaded by any process, hanging up any process and setting a hook in the preset type file, the hook being used for obtaining a script command to be executed in the preset type file; running of any process is recovered, and when any process executes the command line containing the hook, virus detection is conducted on the script command to be executed. The hook is arranged at the position, used for executing the script command line, in the preset type file, and when the process is loaded to the command line where the hook is arranged, the script command to be executed is obtained and subjected to virus detection; the hook is arranged in the preset type file for compiling the to-be-executed script command to obtain the to-be-executed script command and perform virus detection on the to-be-executed script command, so that the process of performing virus detection on the to-be-processed script is simplified, and the virus searching and killing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of web page virus detection, and in particular to a web page virus detection method, device, equipment and storage medium. Background Art

[0002] Browsing the web has become an indispensable part of people's lives. People use web browsing to work, entertain, learn, etc. With the development of information technology, the functions provided by web pages are becoming more and more abundant and convenient, and most of the dynamic functions are realized through JScript.

[0003] However, hackers who have mastered this technology on the Internet also take advantage of its convenience to write and spread various JScript script viruses to invade the operating systems of web browsing users and achieve their illegal purposes. However, in this situation, security software is unable to quickly detect the actual functions of the script through static features, and analysts have to manually restore and process it according to its logic, resulting in low efficiency.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a web page virus detection method, device, equipment and storage medium, aiming to solve the technical problem of low efficiency caused by the security software being unable to detect the actual effect of the script and requiring manual processing.

[0006] To achieve the above object, the present invention provides a web page virus detection method, which comprises the following steps:

[0007] When it is detected that a preset type file is loaded by any process, the any process is suspended and a hook is set in the preset type file, wherein the hook is used to obtain the script command to be executed in the preset type file;

[0008] The operation of any one of the processes is resumed, and when any one of the processes executes a command line containing the hook, virus detection is performed on the script command to be executed.

[0009] Optionally, when it is detected that a file of a preset type is loaded by any process, the step of suspending any process and setting a hook in the file of the preset type includes:

[0010] When it is detected that a file of a preset type is loaded by any process, suspending the any process;

[0011] Transmitting the identification number and the loading address of any process to the detection software so that the detection software obtains the handle of the preset type file;

[0012] A hook is set in the preset type file according to the detection software based on the handle.

[0013] Optionally, the step of resuming the operation of any one of the processes and performing virus detection on the script command to be executed when any one of the processes executes a command line containing the hook comprises:

[0014] Resume the operation of any of the processes, and when any of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any of the processes and performs virus detection on the script command to be executed.

[0015] Optionally, after the step of transmitting the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any process and performs virus detection on the script command to be executed, the method further includes:

[0016] When a virus is detected in the script command to be executed, a preset pop-up window is displayed to prompt the user whether to continue to execute the script command to be executed;

[0017] Alternatively, when it is detected that no virus exists in the script command to be executed, any one of the processes continues to execute the script command to be executed.

[0018] Optionally, the step of performing virus detection on the script command to be executed further includes:

[0019] Taking the script command to be executed as a sample set to be tested, and determining a frequency set of keywords in the sample set to be tested;

[0020] Performing fuzzy processing on the sample set to be tested, and determining fuzzy feature values ​​of the sample set to be tested after the fuzzy processing;

[0021] Determining an identification vector according to the frequency set and the fuzzy eigenvalue;

[0022] A decision tree is constructed according to the sample set to be tested, and whether a virus exists in the identification vector is detected according to the decision tree.

[0023] Optionally, the step of determining a frequency set of keywords in the sample set to be tested includes:

[0024] Dividing the sample set to be tested into a first file set and a second file set, and selecting keyword information from the first file set and the second file set according to a preset frequency;

[0025] A frequency set of keywords is determined according to the keyword information.

[0026] Optionally, the step of performing fuzzy processing on the sample set to be tested and determining the fuzzy feature value of the sample set to be tested after the fuzzy processing includes:

[0027] Determine the first document set fuzzy formula and the second document set fuzzy formula according to the fuzzy classification function;

[0028] Determine fuzzy feature values ​​of the first document set fuzzy formula and the second document set fuzzy formula.

[0029] Optionally, the step of constructing a decision tree according to the sample set to be tested includes:

[0030] Performing feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set;

[0031] determining a first feature effectiveness rate of the first feature set and a second feature effectiveness rate of the second feature set;

[0032] Dividing the first feature set according to the first feature efficiency to obtain a first feature subset, and dividing the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set;

[0033] Return to the step of determining the first feature effectiveness rate of the first feature set and the second feature effectiveness rate of the second feature set until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, and a decision tree is obtained.

[0034] Optionally, the step of detecting whether a virus exists in the identification vector according to the decision tree includes:

[0035] Comparing the identification vector with the node value of the decision tree;

[0036] Selecting to place the identification vector at a left node or a right node of the decision tree according to the comparison result, until the identification vector iterates to a leaf node of the decision tree;

[0037] Whether there is a virus in the identification vector is detected according to the category of the leaf node.

[0038] Optionally, the fuzzy feature value includes: a first approximate value between the sample set to be tested and the virus script file after fuzzification processing, a second approximate value between the sample set to be tested and the normal script file after fuzzification processing, and a ratio of the first approximate value to the second approximate value.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also provides a webpage virus detection device, which includes: a setting module and a detection module;

[0040] The setting module is used for suspending any process and setting a hook in the preset type file when detecting that the preset type file is loaded by any process, wherein the hook is used to obtain the script command to be executed in the preset type file;

[0041] The detection module is used to resume the operation of any process and perform virus detection on the script command to be executed when any process executes the command line containing the hook.

[0042] Optionally, the setting module is also used to suspend any process when it is detected that a preset type file is loaded by any process; transmit the identification number and loading address of any process to the detection software so that the detection software obtains the handle of the preset type file; and set a hook in the preset type file according to the detection software based on the handle.

[0043] Optionally, the detection module is also used to resume the operation of any one of the processes, and when any one of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any one of the processes and performs virus detection on the script command to be executed.

[0044] Optionally, the detection module is also used to display a preset pop-up window to prompt the user whether to continue executing the script command to be executed when a virus is detected in the script command to be executed; or, when no virus is detected in the script command to be executed, any process continues to execute the script command to be executed.

[0045] Optionally, the detection module is further used to use the script command to be executed as a sample set to be tested, and determine a frequency set of keywords in the sample set to be tested; perform fuzzification processing on the sample set to be tested, and determine a fuzzy feature value of the sample set to be tested after the fuzzification processing; determine an identification vector based on the frequency set and the fuzzy feature value; construct a decision tree based on the sample set to be tested, and detect whether there is a virus in the identification vector based on the decision tree.

[0046] Optionally, the detection module is further used to divide the sample set to be tested into a first file set and a second file set, and select keyword information from the first file set and the second file set according to a preset frequency; and determine a frequency set of keywords according to the keyword information.

[0047] Optionally, the detection module is further configured to determine the fuzzy formula of the first file set and the fuzzy formula of the second file set according to a fuzzy classification function; and determine fuzzy feature values ​​of the fuzzy formula of the first file set and the fuzzy formula of the second file set.

[0048] Optionally, the detection module is further used to perform feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set; determine a first feature efficiency of the first feature set and a second feature efficiency of the second feature set; divide the first feature set according to the first feature efficiency to obtain a first feature subset, and divide the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set; return to the step of determining the first feature efficiency of the first feature set and the second feature efficiency of the second feature set until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, and a decision tree is obtained.

[0049] In addition, to achieve the above-mentioned purpose, the present invention also proposes a web page virus detection device, which includes a memory, a processor, and a web page virus detection program stored in the memory and run on the processor, and the web page virus detection program is configured to implement the web page virus detection method described above.

[0050] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which a webpage virus detection program is stored, and when the webpage virus detection program is executed by a processor, the webpage virus detection method as described above is implemented.

[0051] The present invention discloses a webpage virus detection method, device, equipment and storage medium, the method comprising: when monitoring that a preset type file is loaded by any process, suspending any process and setting a hook in the preset type file, the hook is used to obtain the script command to be executed in the preset type file; resuming the operation of any process, and when any process executes the command line containing the hook, performing virus detection on the script command to be executed. The present invention sets a hook at the execution script command line in the preset type file, obtains the script command to be executed and performs virus detection on the script command to be executed when the process is loaded to the command line where the hook is set, sets a hook in the preset type file for compiling the script command to be executed to obtain the script command to be executed and perform virus detection on it, simplifies the process of virus detection on the script to be processed, and thus improves the efficiency of virus detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1It is a structural diagram of a webpage virus detection device in a hardware operating environment involved in an embodiment of the present invention;

[0053] Figure 2 This is a schematic diagram of the flow of the first embodiment of the webpage virus detection method of the present invention;

[0054] Figure 3 A schematic diagram of the flow chart of the second embodiment of the webpage virus detection method of the present invention;

[0055] Figure 4 A schematic diagram of a flow chart of a third embodiment of a webpage virus detection method according to the present invention;

[0056] Figure 5 It is a structural block diagram of the first embodiment of the webpage virus detection device of the present invention.

[0057] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0058] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0059] Reference Figure 1 , Figure 1 The schematic diagram is a structural diagram of a webpage virus detection device in a hardware operating environment according to an embodiment of the present invention.

[0060] like Figure 1 As shown, the webpage virus detection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and the user interface 1003 may also include a standard wired interface and a wireless interface. The wired interface of the user interface 1003 may be a USB interface in the present invention. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable memory (Non-volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0061] Those skilled in the art will understand that Figure 1The structure shown in the figure does not constitute a limitation on the webpage virus detection device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0062] like Figure 1 As shown, the memory 1005 identified as a computer storage medium may include an operating system, a network communication module, a user interface module, and a web page virus detection program.

[0063] exist Figure 1 In the web page virus detection device shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the user device; the web page virus detection device calls the web page virus detection program stored in the memory 1005 through the processor 1001, and executes the web page virus detection method provided by the embodiment of the present invention.

[0064] Based on the above hardware structure, an embodiment of the webpage virus detection method of the present invention is proposed.

[0065] Reference Figure 2 , Figure 2 1 is a flow chart of a first embodiment of a webpage virus detection method according to the present invention, and provides a first embodiment of a webpage virus detection method according to the present invention.

[0066] Step S10: when it is detected that a preset type file is loaded by any process, the any process is suspended and a hook is set in the preset type file, wherein the hook is used to obtain the script command to be executed in the preset type file.

[0067] It should be noted that the execution subject of this embodiment can be a computer software service device with data processing, network communication and program running functions, such as web page virus detection, or other electronic devices that can achieve the same or similar functions, and this embodiment does not limit this.

[0068] It should be understood that while JScript brings convenience to Web designers, hackers who master this technology on the Internet also use its convenience to write and spread various JScript script viruses to invade the operating systems of web browsing users and achieve their illegal purposes. At the same time, many JScript script authors use various transformation technologies such as obfuscation and encryption to make the script incomprehensible in order to hide sensitive information, resist the detection of security software or for other purposes. There are many ready-made tools on the Internet such as YUI Compressor, Google Closure Compiler, JScrambler, etc. Faced with this situation, security software cannot quickly detect the actual function of the script through static features, and analysts have to manually restore and process it according to its logic, which is inefficient.

[0069] In order to overcome the above-mentioned defects, this embodiment sets a hook in a preset type file for compiling JScript scripts, obtains the script that actually needs to be executed when the process is loaded to the command line where the hook is set, and performs virus detection on the script that actually needs to be executed. There is no need for various technical confrontations at the text level, which simplifies the process of virus detection for the script to be processed, thereby improving the efficiency of virus detection.

[0070] It should be noted that the preset type file may be a jscript.dll file used to compile, interpret and then execute JScript script commands. By hooking jscript.dll, all interpreted and executed JScript script commands are recorded.

[0071] It is understandable that the file loading event can be monitored through the Windows system 0 ring, and after any process is detected to load jscript.dll, the process loading jscript.dll is suspended.

[0072] It should be noted that the hook can be used to intercept events such as messages, mouse operations and keystrokes. In this embodiment, the hook is set to obtain the JScript script command that actually needs to be executed.

[0073] In the specific implementation, the Windows system 0 ring is used to monitor whether the jscript.dll file is loaded by any process. When the jscript.dll file is loaded by any process, the process loading the jscript.dll file is suspended and a hook is set at the command line for compiling the JScript script in the jscript.dll file to obtain the JScript script command that actually needs to be executed.

[0074] Step S20: resuming the operation of any one of the processes, and performing virus detection on the script command to be executed when any one of the processes executes the command line containing the hook.

[0075] It should be noted that when the process that loads the jscript.dll file executes the command line that sets the hook, the script that actually needs to be executed will be recorded according to the hook and virus detection will be performed.

[0076] It should be noted that, in order to hide sensitive information in the JScript script, some encryption or obfuscation technologies will be used to prevent the actual need to load the JScript script from being identified in order to combat web virus detection. Therefore, in the method of hooking jscript.dll, all interpreted and executed JScript script commands are recorded. These executed JScript script commands are JScript script commands that solve the actual needs of executing various technologies that are used to hinder virus detection. That is, the script commands to be executed are JScript script commands that solve the actual needs of executing various technologies that are used to hinder virus detection.

[0077] In the specific implementation, after the hook is set, the process of loading the jscript.dll file is restored. When the command line where the hook is set in the process is executed, the JScript script command actually required to be executed by this line of command is obtained according to the hook and the JScript script command actually required to be executed is detected for viruses.

[0078] Furthermore, in order to reduce the cost of detecting web page viruses, step S20 of this embodiment may further include:

[0079] Resume the operation of any of the processes, and when any of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any of the processes and performs virus detection on the script command to be executed.

[0080] It should be noted that the script command to be executed may be transmitted to the detection software for virus detection, or a method for performing virus detection may be set in the browser, which is not limited in this embodiment.

[0081] It can be understood that when the process loading the jscript.dll file executes the command line containing the hook, the process loading the jscript.dll file will transmit its own information and the script commands to be executed to the detection software, and the Ajin side software saves and detects the script commands to be executed according to the identification number of the process loading the jscript.dll file.

[0082] It is understandable that the information of the process that loads the jscript.dll file may include the process ID (identification number), the process name, the duration of the process, and the memory usage of the process.

[0083] When the present embodiment detects that a preset type file is loaded by any process, any process is suspended and a hook is set in the preset type file, and the hook is used to obtain the script command to be executed in the preset type file; the operation of any process is resumed, and when any process executes the command line containing the hook, the script command to be executed is detected for viruses. The present embodiment sets a hook at the command line for executing the script in the preset type file, obtains the script command to be executed and performs virus detection on the script command to be executed when the process is loaded to the command line where the hook is set, sets a hook in the preset type file that compiles the script command to be executed to obtain the script command to be executed and performs virus detection on it, which simplifies the process of virus detection of the script to be processed, thereby improving the efficiency of virus detection.

[0084] Reference Figure 3 , Figure 3 This is a flow chart of a second embodiment of the webpage virus detection method of the present invention. Figure 2 The first embodiment shown provides a second embodiment of the web page virus detection method of the present invention.

[0085] In the second embodiment, the step S10 includes:

[0086] Step S101: when it is detected that a file of a preset type is loaded by any process, suspend the any process.

[0087] In a specific implementation, when the Windows system ring 0 monitors that the jscript.dll file is loaded by any process, the process that loads the jscript.dll file is suspended.

[0088] Step S102: transmitting the identification number and loading address of any process to the detection software so that the detection software obtains the handle of the preset type file.

[0089] It is understandable that the identification number of any process may be the ID of the process that loads the jscript.dll file, and this embodiment does not limit this.

[0090] It should be noted that a handle can be an identifier used to identify an object, a pointer or an integer used to establish a connection with the object being accessed. The handle of the jscript.dll file is obtained according to the identification number and the load address, and is used to detect whether the software can access the jscript.dll file according to the handle and access the jscript.dll file.

[0091] Step S103: Setting a hook in the preset type file based on the handle according to the detection software.

[0092] In a specific implementation, the detection software accesses the jscript.dll file according to the handle of the jscript.dll file, finds the command line for compiling the JScript script command in the jscript.dll file, sets a hook at the command line for compiling the JScript script, and resumes the process of loading the jscript.dll file.

[0093] Furthermore, in order to improve the efficiency of detecting and killing web page viruses, step S103 of this embodiment may further include:

[0094] When a virus is detected in the script command to be executed, a preset pop-up window is displayed to prompt the user whether to continue to execute the script command to be executed;

[0095] Alternatively, when it is detected that no virus exists in the script command to be executed, any one of the processes continues to execute the script command to be executed.

[0096] It is understandable that when the detection software detects that there is a virus in the script command to be executed, the detection software informs the user through a pop-up window, and the user decides whether to continue executing the JScript script command.

[0097] It is understandable that when the detection software detects that there is no virus in the script command to be executed, it transmits a message of continuing execution to the process, and the process continues the execution process after receiving the message of continuing execution.

[0098] When the present embodiment detects that a preset type file is loaded by any process, the any process is suspended; the identification number and loading address of the any process are transmitted to the detection software so that the detection software obtains the handle of the preset type file; and a hook is set in the preset type file according to the detection software based on the handle. The present embodiment transmits the identification number and loading address of any process to the detection software so that the detection software obtains the handle of the preset type file and accesses the preset type file according to the handle, sets a hook in the preset type file, thereby obtaining the script command to be executed through the hook for detection, reducing various cumbersome processes for detecting script viruses, thereby saving costs and improving efficiency.

[0099] Reference Figure 4 , Figure 4 This is a flow chart of a third embodiment of the webpage virus detection method of the present invention. Figure 2 The first embodiment shown provides a third embodiment of the webpage virus detection method of the present invention.

[0100] In the third embodiment, the step S20 further includes:

[0101] Step S201: taking the script command to be executed as a sample set to be tested, and determining a frequency set of keywords in the sample set to be tested.

[0102] It can be understood that the average frequency information of the keywords in the sample set to be tested is determined and the average frequency information is used as the frequency set.

[0103] It should be noted that the sample set to be tested can be divided into a normal file set and a virus file set, and the keyword frequency information of the normal file set and the keyword frequency information of the virus file set are determined respectively to form a keyword frequency set of the normal file set and a keyword frequency set of the virus file set respectively.

[0104] Furthermore, in order to improve the accuracy of virus detection, step S201 of this embodiment may further include:

[0105] Dividing the sample set to be tested into a first file set and a second file set, and selecting keyword information from the first file set and the second file set according to a preset frequency;

[0106] A frequency set of keywords is determined according to the keyword information.

[0107] It should be understood that the first file set may be a normal file set, the second file set may be a virus file set, the keyword information in the normal files is determined from the first file set, and the frequency set of the normal files is determined based on the keyword information in the normal files. Similarly, the keyword information in the virus files is determined from the second file set, and the frequency set of the virus files is determined based on the keyword information in the virus files.

[0108] Step S202: performing fuzzy processing on the sample set to be tested, and determining fuzzy feature values ​​of the sample set to be tested after the fuzzy processing.

[0109] It should be noted that the sample set to be tested can be fuzzified according to the membership function to generate a fuzzy formula of the sample set to be tested, and the fuzzy characteristic value of the sample set to be tested can be calculated according to the fuzzy formula of the sample set to be tested.

[0110] Furthermore, in order to improve the accuracy of virus detection, step S202 of this embodiment may also include:

[0111] Determine the first document set fuzzy formula and the second document set fuzzy formula according to the fuzzy classification function;

[0112] Determine fuzzy feature values ​​of the first document set fuzzy formula and the second document set fuzzy formula.

[0113] It should be understood that the fuzzy classification function may be a membership function, the first file set fuzzy formula may be a normal file set fuzzy formula, and the second file set fuzzy formula may be a virus file set fuzzy formula.

[0114] It should be noted that the first file set fuzzy formula and the first file set fuzzy formula can be:

[0115] F = {λ F (K(F1),λ F (K(F2)),...,λ F (K(F n ))};

[0116] N={λ N (K(N1),λ N (K(N2)),...,λ N (K(N n ))};

[0117] In the formula, λ F () and λ N () all represent membership functions, K(F n ) represents the frequency set of the first file set, F is the fuzzy formula of the first file set, N is the fuzzy formula of the second file set, K(N n ) represents the frequency set of the second file set.

[0118] It should be noted that the fuzzy feature value is the degree of closeness calculated for the first file set and the second file set. The fuzzy feature value can be the first approximation between the sample set to be tested and the virus script file after fuzzification processing, the second approximation between the sample set to be tested and the normal script file after fuzzification processing, and the ratio of the first approximation to the second approximation.

[0119] Step S203: determining an identification vector according to the frequency set and the fuzzy eigenvalue.

[0120] It should be noted that the identification vector can be determined based on the frequency set and the fuzzy eigenvalues ​​of n+3 samples in the sample set to be tested.

[0121] Step S204: construct a decision tree according to the sample set to be tested, and detect whether there is a virus in the identification vector according to the decision tree.

[0122] It should be noted that the attributes of the sample set to be tested are divided equally, and the maximum information gain rate of the division point is calculated. The attribute corresponding to the maximum information gain rate is selected and the set corresponding to the attribute is divided again. The above process is repeated according to the re-divided data set until the iteration reaches the set leaf node, and then the iteration is stopped to generate the decision tree.

[0123] It can be understood that according to the root node of the decision tree, the identification vector is detected from the root node downwards, and the left subtree and the right subtree of the decision tree are recursively judged until the leaf node is recursively judged whether the identification vector contains a virus.

[0124] Furthermore, in order to improve the rate of detecting and killing web page viruses, step S204 of this embodiment may further include:

[0125] Performing feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set;

[0126] determining a first feature effectiveness rate of the first feature set and a second feature effectiveness rate of the second feature set;

[0127] Dividing the first feature set according to the first feature efficiency to obtain a first feature subset, and dividing the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set;

[0128] Return to the step of determining the first feature effectiveness rate of the first feature set and the second feature effectiveness rate of the second feature set until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, and a decision tree is obtained.

[0129] It can be understood that the first feature efficiency and the second feature efficiency may be the information gain rate of the first feature set and the information gain rate of the second feature set.

[0130] It can be understood that the maximum information gain rate is selected from the information gain rate of the first feature set and the information gain rate of the second feature set respectively, and the feature set corresponding to the maximum information gain rate is divided into a first feature subset and a second feature subset, and then the information gain rate of the first feature subset and the second feature subset is determined and the above steps are repeated.

[0131] It should be noted that the leaf node can be set to the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than the preset ratio, and the leaf node can also be set when there is no set for division.

[0132] Furthermore, in order to improve the rate of detecting and killing web page viruses, step S204 of this embodiment may further include:

[0133] Comparing the identification vector with the node value of the decision tree;

[0134] Selecting to place the identification vector at a left node or a right node of the decision tree according to the comparison result, until the identification vector iterates to a leaf node of the decision tree;

[0135] Whether there is a virus in the identification vector is detected according to the category of the leaf node.

[0136] It can be understood that the identification vector contains frequency information and fuzzy eigenvalues, which are compared with the left subtree and the right subtree of the decision tree in turn.

[0137] It can be understood that if the value of the identification vector is greater than the node value, the identification vector is placed in the right subtree, and if the identification vector is less than the node value, the identification vector is placed in the left subtree.

[0138] It should be understood that the identification vector is continuously compared with the node values ​​of the following decision tree to determine whether to place it at the left node or the right node.

[0139] It should be noted that if the type of the leaf node is a virus type, it means that there is a virus in the script being tested. Conversely, if the type of the leaf node is a normal type, it means that there is no virus in the script being tested.

[0140] This embodiment uses the script command to be executed as the sample set to be tested, and determines the frequency set of keywords in the sample set to be tested; performs fuzzification processing on the sample set to be tested, and determines the fuzzy feature value of the sample set to be tested after fuzzification processing; determines the identification vector according to the frequency set and the fuzzy feature value; constructs a decision tree according to the sample set to be tested, and detects whether there is a virus in the identification vector according to the decision tree. This embodiment determines the frequency set and fuzzy feature value of the sample set to be tested, determines the identification vector according to the frequency set and the fuzzy feature value, constructs a decision tree and detects the identification vector according to the decision tree, and improves the accuracy of virus detection for the script command to be executed by combining the fuzzy algorithm and the decision tree.

[0141] In addition, an embodiment of the present invention further provides a storage medium, on which a webpage virus detection program is stored. When the webpage virus detection program is executed by a processor, the webpage virus detection method described above is implemented.

[0142] In addition, refer to Figure 5 , the embodiment of the present invention also provides a webpage virus detection device, the webpage virus detection device comprises: a setting module 10 and a detection module 20;

[0143] The setting module 10 is used for suspending any process and setting a hook in the preset type file when detecting that the preset type file is loaded by any process, wherein the hook is used to obtain the script command to be executed in the preset type file;

[0144] The detection module 20 is used to resume the operation of any process and perform virus detection on the script command to be executed when any process executes the command line containing the hook.

[0145] When the present embodiment detects that a preset type file is loaded by any process, any process is suspended and a hook is set in the preset type file, and the hook is used to obtain the script command to be executed in the preset type file; the operation of any process is resumed, and when any process executes the command line containing the hook, the script command to be executed is detected for viruses. The present embodiment sets a hook at the command line for executing the script in the preset type file, obtains the script command to be executed and performs virus detection on the script command to be executed when the process is loaded to the command line where the hook is set, sets a hook in the preset type file that compiles the script command to be executed to obtain the script command to be executed and performs virus detection on it, which simplifies the process of virus detection of the script to be processed, thereby improving the efficiency of virus detection.

[0146] Based on the first embodiment of the webpage virus detection device of the present invention, a second embodiment of the webpage virus detection device of the present invention is proposed.

[0147] In this embodiment, the setting module 10 is used to suspend any process when it is detected that a file of a preset type is loaded by any process.

[0148] Furthermore, the setting module 10 is also used to transmit the identification number and loading address of any process to the detection software so that the detection software obtains the handle of the preset type file.

[0149] Furthermore, the setting module 10 is further used to set a hook in the preset type file based on the handle according to the detection software.

[0150] Furthermore, the detection module 20 is also used to resume the operation of any of the processes, and when any of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any of the processes and performs virus detection on the script command to be executed.

[0151] Furthermore, the detection module 20 is also used to display a preset pop-up window to prompt the user whether to continue executing the script command to be executed when a virus is detected in the script command to be executed.

[0152] Furthermore, the detection module 20 is also used for, when it is detected that no virus exists in the script command to be executed, the any process continues to execute the script command to be executed.

[0153] Furthermore, the detection module 20 is further configured to use the script command to be executed as a sample set to be tested, and determine a frequency set of keywords in the sample set to be tested.

[0154] Furthermore, the detection module 20 is further configured to perform fuzzy processing on the sample set to be tested, and determine fuzzy feature values ​​of the sample set to be tested after the fuzzy processing.

[0155] Furthermore, the detection module 20 is further configured to determine an identification vector according to the frequency set and the fuzzy eigenvalue.

[0156] Furthermore, the detection module 20 is further configured to construct a decision tree according to the sample set to be tested, and detect whether a virus exists in the identification vector according to the decision tree.

[0157] Furthermore, the detection module 20 is further configured to divide the sample set to be tested into a first file set and a second file set, and select keyword information from the first file set and the second file set according to a preset frequency.

[0158] Furthermore, the detection module 20 is further configured to determine a frequency set of keywords according to the keyword information.

[0159] Furthermore, the detection module 20 is further configured to determine the fuzzy formula of the first file set and the fuzzy formula of the second file set according to a fuzzy classification function.

[0160] Furthermore, the detection module 20 is further configured to determine fuzzy feature values ​​of the fuzzy formula of the first file set and the fuzzy formula of the second file set.

[0161] Furthermore, the detection module 20 is further configured to perform feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set.

[0162] Furthermore, the detection module 20 is further configured to determine a first feature effectiveness rate of the first feature set and a second feature effectiveness rate of the second feature set.

[0163] Furthermore, the detection module 20 is also used to divide the first feature set according to the first feature efficiency to obtain a first feature subset, and divide the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set.

[0164] Furthermore, the detection module 20 is also used to return to the step of determining the first feature effectiveness of the first feature set and the second feature effectiveness of the second feature set, until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, thereby obtaining a decision tree.

[0165] Furthermore, the detection module 20 is further configured to compare the identification vector with the node value of the decision tree.

[0166] Furthermore, the detection module 20 is further used to select, according to the comparison result, to place the identification vector at a left node or a right node of the decision tree until the identification vector iterates to a leaf node of the decision tree.

[0167] Furthermore, the detection module 20 is further configured to detect whether there is a virus in the identification vector according to the category of the leaf node.

[0168] Furthermore, the setting module 10 is also used to suspend any process when it is detected that a preset type file is loaded by any process; transmit the identification number and loading address of any process to the detection software so that the detection software obtains the handle of the preset type file; and set a hook in the preset type file according to the detection software based on the handle.

[0169] Furthermore, the detection module 20 is also used to resume the operation of any of the processes, and when any of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any of the processes and performs virus detection on the script command to be executed.

[0170] Furthermore, the detection module 20 is also used to display a preset pop-up window to prompt the user whether to continue executing the script command to be executed when a virus is detected in the script command to be executed; or, when no virus is detected in the script command to be executed, any process continues to execute the script command to be executed.

[0171] Furthermore, the detection module 20 is also used to use the script command to be executed as a sample set to be tested, and determine the frequency set of keywords in the sample set to be tested; perform fuzzification processing on the sample set to be tested, and determine the fuzzy feature value of the sample set to be tested after the fuzzification processing; determine an identification vector based on the frequency set and the fuzzy feature value; construct a decision tree based on the sample set to be tested, and detect whether there is a virus in the identification vector based on the decision tree.

[0172] Furthermore, the detection module 20 is further configured to divide the sample set to be tested into a first file set and a second file set, and select keyword information from the first file set and the second file set according to a preset frequency; and determine a keyword frequency set according to the keyword information.

[0173] Furthermore, the detection module 20 is further configured to determine the fuzzy formula of the first file set and the fuzzy formula of the second file set according to a fuzzy classification function; and determine fuzzy feature values ​​of the fuzzy formula of the first file set and the fuzzy formula of the second file set.

[0174] Furthermore, the detection module 20 is also used to perform feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set; determine a first feature efficiency of the first feature set and a second feature efficiency of the second feature set; divide the first feature set according to the first feature efficiency to obtain a first feature subset, and divide the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set; return to the step of determining the first feature efficiency of the first feature set and the second feature efficiency of the second feature set until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, and a decision tree is obtained.

[0175] Other embodiments or specific implementations of the webpage virus detection device of the present invention may refer to the above-mentioned method embodiments, which will not be described in detail here.

[0176] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0177] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0178] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0179] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0180] The present invention discloses A1, a web page virus detection method, the web page virus detection method comprising the following steps:

[0181] When it is detected that a preset type file is loaded by any process, the any process is suspended and a hook is set in the preset type file, wherein the hook is used to obtain the script command to be executed in the preset type file;

[0182] The operation of any one of the processes is resumed, and when any one of the processes executes a command line containing the hook, virus detection is performed on the script command to be executed.

[0183] A2. The webpage virus detection method as described in A1, wherein when it is detected that a file of a preset type is loaded by any process, the step of suspending any process and setting a hook in the file of the preset type comprises:

[0184] When it is detected that a file of a preset type is loaded by any process, suspending the any process;

[0185] Transmitting the identification number and the loading address of any process to the detection software so that the detection software obtains the handle of the preset type file;

[0186] A hook is set in the preset type file according to the detection software based on the handle.

[0187] A3. The webpage virus detection method as described in A2, wherein the step of resuming the operation of any one of the processes and performing virus detection on the script command to be executed when any one of the processes executes a command line containing the hook comprises:

[0188] Resume the operation of any of the processes, and when any of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any of the processes and performs virus detection on the script command to be executed.

[0189] A4. The webpage virus detection method as described in A3, after the step of transmitting the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any process and performs virus detection on the script command to be executed, further comprising:

[0190] When a virus is detected in the script command to be executed, a preset pop-up window is displayed to prompt the user whether to continue to execute the script command to be executed;

[0191] Alternatively, when it is detected that no virus exists in the script command to be executed, any one of the processes continues to execute the script command to be executed.

[0192] A5. The webpage virus detection method as described in A1, wherein the step of performing virus detection on the script command to be executed further comprises:

[0193] Taking the script command to be executed as a sample set to be tested, and determining a frequency set of keywords in the sample set to be tested;

[0194] Performing fuzzy processing on the sample set to be tested, and determining fuzzy feature values ​​of the sample set to be tested after the fuzzy processing;

[0195] Determining an identification vector according to the frequency set and the fuzzy eigenvalue;

[0196] A decision tree is constructed according to the sample set to be tested, and whether a virus exists in the identification vector is detected according to the decision tree.

[0197] A6. The webpage virus detection method according to claim A5, wherein the step of determining the frequency set of keywords in the sample set to be tested comprises:

[0198] Dividing the sample set to be tested into a first file set and a second file set, and selecting keyword information from the first file set and the second file set according to a preset frequency;

[0199] A frequency set of keywords is determined according to the keyword information.

[0200] A7. In the webpage virus detection method as described in A6, the step of performing fuzzification processing on the sample set to be tested and determining the fuzzy feature value of the sample set to be tested after the fuzzification processing comprises:

[0201] Determine the first document set fuzzy formula and the second document set fuzzy formula according to the fuzzy classification function;

[0202] Determine fuzzy feature values ​​of the first document set fuzzy formula and the second document set fuzzy formula.

[0203] A8. The webpage virus detection method as described in A7, wherein the step of constructing a decision tree according to the sample set to be tested comprises:

[0204] Performing feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set;

[0205] determining a first feature effectiveness rate of the first feature set and a second feature effectiveness rate of the second feature set;

[0206] Dividing the first feature set according to the first feature efficiency to obtain a first feature subset, and dividing the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set;

[0207] Return to the step of determining the first feature effectiveness rate of the first feature set and the second feature effectiveness rate of the second feature set until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, and a decision tree is obtained.

[0208] A9. The webpage virus detection method according to claim A5, wherein the step of detecting whether a virus exists in the identification vector according to the decision tree comprises:

[0209] Comparing the identification vector with the node value of the decision tree;

[0210] Selecting to place the identification vector at a left node or a right node of the decision tree according to the comparison result, until the identification vector iterates to a leaf node of the decision tree;

[0211] Whether there is a virus in the identification vector is detected according to the category of the leaf node.

[0212] A10. In the webpage virus detection method as described in A5, the fuzzy feature value includes: a first approximate value between the sample set to be tested and the virus script file after fuzzification processing, a second approximate value between the sample set to be tested and the normal script file after fuzzification processing, and a ratio of the first approximate value to the second approximate value.

[0213] The present invention also discloses B11, a webpage virus detection device, the webpage virus detection device comprising: a setting module and a detection module;

[0214] The setting module is used for suspending any process and setting a hook in the preset type file when detecting that the preset type file is loaded by any process, wherein the hook is used to obtain the script command to be executed in the preset type file;

[0215] The detection module is used to resume the operation of any process and perform virus detection on the script command to be executed when any process executes the command line containing the hook.

[0216] B12. In the webpage virus detection device as described in B11, the setting module is further used to suspend any process when it is detected that a preset type file is loaded by any process; transmit the identification number and loading address of any process to the detection software so that the detection software obtains the handle of the preset type file; and set a hook in the preset type file according to the detection software based on the handle.

[0217] B13. In the webpage virus detection device as described in B12, the detection module is further used to resume the operation of any one of the processes, and when any one of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any one of the processes and performs virus detection on the script command to be executed.

[0218] B14. In the web page virus detection device as described in B13, the detection module is further used to display a preset pop-up window to prompt the user whether to continue executing the script command to be executed when a virus is detected in the script command to be executed; or, when no virus is detected in the script command to be executed, any process continues to execute the script command to be executed.

[0219] B15. In the webpage virus detection device as described in B11, the detection module is further used to use the script command to be executed as a sample set to be tested, and determine the frequency set of keywords in the sample set to be tested; perform fuzzification processing on the sample set to be tested, and determine the fuzzy feature value of the sample set to be tested after the fuzzification processing; determine an identification vector according to the frequency set and the fuzzy feature value; construct a decision tree according to the sample set to be tested, and detect whether there is a virus in the identification vector according to the decision tree.

[0220] B16. In the webpage virus detection device as described in B15, the detection module is further used to divide the sample set to be tested into a first file set and a second file set, and select keyword information from the first file set and the second file set according to a preset frequency; and determine a frequency set of keywords according to the keyword information.

[0221] B17. In the webpage virus detection device as described in B16, the detection module is further used to determine the fuzzy formula of the first file set and the fuzzy formula of the second file set according to the fuzzy classification function; and determine the fuzzy feature values ​​of the fuzzy formula of the first file set and the fuzzy formula of the second file set.

[0222] B18. In the webpage virus detection device as described in B17, the detection module is further used to perform feature division on the first file set and the second file set respectively to obtain a first feature set and a second feature set; determine a first feature efficiency of the first feature set and a second feature efficiency of the second feature set; divide the first feature set according to the first feature efficiency to obtain a first feature subset, and divide the second feature set according to the second feature efficiency to obtain a second feature subset, the first feature subset points to the first feature set, and the second feature subset points to the second feature set; return to the step of determining the first feature efficiency of the first feature set and the second feature efficiency of the second feature set until the ratio of the first feature subset to the first feature set and / or the ratio of the second feature subset to the second feature set is less than a preset ratio, and a decision tree is obtained.

[0223] The present invention also discloses C19, a web page virus detection device, which includes: a memory, a processor, and a web page virus detection program stored in the memory and executable on the processor, wherein the web page virus detection program is configured to implement the web page virus detection method as described above.

[0224] The present invention also discloses D20, a storage medium, on which a webpage virus detection program is stored, and when the webpage virus detection program is executed by a processor, the webpage virus detection method as described above is implemented.

Claims

1. A webpage virus detection method, characterized in that: The webpage virus detection method comprises the following steps: When it is detected that a preset type file is loaded by any process, the any process is suspended and a hook is set in the preset type file, wherein the hook is used to obtain the script command to be executed in the preset type file; The operation of any one of the processes is resumed, and when any one of the processes executes a command line containing the hook, virus detection is performed on the script command to be executed.

2. The webpage virus detection method according to claim 1, characterized in that: The step of suspending any process and setting a hook in the preset type file when monitoring that the preset type file is loaded by any process includes: When it is detected that a file of a preset type is loaded by any process, suspending the any process; Transmitting the identification number and the loading address of any process to the detection software so that the detection software obtains the handle of the preset type file; A hook is set in the preset type file according to the detection software based on the handle.

3. The webpage virus detection method according to claim 2, characterized in that: The step of resuming the operation of any one of the processes and performing virus detection on the script command to be executed when any one of the processes executes a command line containing the hook comprises: Resume the operation of any of the processes, and when any of the processes executes a command line containing the hook, transmit the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any of the processes and performs virus detection on the script command to be executed.

4. The webpage virus detection method according to claim 3, characterized in that: After the step of transmitting the script command to be executed to the detection software so that the detection software saves the script command to be executed according to the identification number of any process and performs virus detection on the script command to be executed, the method further includes: When a virus is detected in the script command to be executed, a preset pop-up window is displayed to prompt the user whether to continue to execute the script command to be executed; Alternatively, when it is detected that no virus exists in the script command to be executed, any one of the processes continues to execute the script command to be executed.

5. The webpage virus detection method according to claim 1, characterized in that: The step of performing virus detection on the script command to be executed also includes: The script command to be executed is used as a sample set to be tested, and a frequency set of keywords in the sample set to be tested is determined; Performing fuzzy processing on the sample set to be tested, and determining fuzzy feature values ​​of the sample set to be tested after the fuzzy processing; Determining an identification vector according to the frequency set and the fuzzy eigenvalue; A decision tree is constructed according to the sample set to be tested, and whether a virus exists in the identification vector is detected according to the decision tree.

6. The webpage virus detection method according to claim 5, characterized in that: The step of determining the frequency set of keywords in the sample set to be tested includes: Dividing the sample set to be tested into a first file set and a second file set, and selecting keyword information from the first file set and the second file set according to a preset frequency; A frequency set of keywords is determined according to the keyword information.

7. The webpage virus detection method according to claim 6, characterized in that: The step of performing fuzzy processing on the sample set to be tested and determining the fuzzy feature value of the sample set to be tested after the fuzzy processing comprises: Determine the first document set fuzzy formula and the second document set fuzzy formula according to the fuzzy classification function; Determine fuzzy feature values ​​of the first document set fuzzy formula and the second document set fuzzy formula.

8. A webpage virus detection device, characterized in that: The webpage virus detection device comprises: a setting module and a detection module; The setting module is used for suspending any process and setting a hook in the preset type file when detecting that the preset type file is loaded by any process, wherein the hook is used to obtain the script command to be executed in the preset type file; The detection module is used to resume the operation of any process and perform virus detection on the script command to be executed when any process executes the command line containing the hook.

9. A webpage virus detection device, characterized in that: The web page virus detection device comprises: a memory, a processor, and a web page virus detection program stored in the memory and executable on the processor. When the web page virus detection program is executed by the processor, the steps of the web page virus detection method according to any one of claims 1 to 7 are implemented.

10. A storage medium, characterized in that: The storage medium stores a webpage virus detection program, and when the webpage virus detection program is executed by the processor, the steps of the webpage virus detection method according to any one of claims 1 to 7 are implemented.

Images