Malicious script identification method and device, computer equipment and readable storage medium

Abstract

The invention provides a malicious script identification method and device, computer equipment and a readable storage medium, and the method comprises the steps: responding to a running instruction for a target script, and simulating a running process of the target script in a virtual machine; monitoring script action associated information of the target script in the running process; determining an initial recognition result of the target script based on the script action association information; determining the confidence coefficient of the target script based on the script action association information and the initial recognition result; and if the confidence coefficient is lower than a preset confidence coefficient threshold value, determining that the target script is a malicious script, and intercepting the operation instruction. According to the technical scheme, the hysteresis of script security identification is avoided, and the accuracy of script identification is improved.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a malicious script identification method and apparatus, a computer device, and a readable storage medium. Background Art

[0002] In the current network environment, malicious scripts emerge in an endless stream. Malicious scripts are virus source codes themselves, or can be obtained through simple conversion. Compared with straightforward virus source codes, malicious scripts are more confusing, so they are more widely spread. At the same time, malicious scripts have no specific format, which makes it easy for malicious scripts to deform themselves to obtain variants, causing great harm to computer security.

[0003] In this regard, in the related art, antivirus software can identify malicious scripts through feature value matching, but since malicious scripts can quickly obtain a large number of variants through self-transformation, encryption, etc., the feature value matching method always lags behind the emergence time of new malicious scripts. In addition, the current antivirus software often identifies malicious scripts during the operation of malicious scripts, making it difficult to effectively detect malicious scripts in advance, which has become a major hidden danger to computer security.

[0004] Therefore, how to accurately and efficiently identify malicious scripts has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a malicious script identification method and apparatus, a computer device, and a readable storage medium, aiming to solve the technical problem in the related art that the identification and processing of malicious scripts are seriously delayed due to the use of feature value matching to identify malicious scripts.

[0006] In a first aspect, an embodiment of the present application provides a method for identifying malicious scripts, including: In response to the running instruction for the target script, simulating the running process of the target script in the virtual machine; Monitoring script action association information of the target script during the running process, wherein the script action association information is used to reflect the safety performance level of the target script when executing the script action; Based on the script action association information, determining an initial recognition result of the target script; Determining the confidence of the target script based on the script action association information and the initial recognition result; If the confidence level is lower than a predetermined confidence level threshold, the target script is determined to be a malicious script, and the execution instruction is intercepted.

[0007] In one embodiment of the present application, optionally, the monitoring of the script action association information of the target script during the running process includes: Monitor the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process.

[0008] In one embodiment of the present application, optionally, determining the initial recognition result of the target script based on the script action association information includes: Determine first behavior structure information of the target script based on the behavior type of each script action of the target script during the running process and the execution order of the script behavior; Determining whether a preset virus script behavior structure set has a preset behavior structure that matches the first behavior structure information; If the judgment result is that the preset virus script behavior structure set has a preset behavior structure that matches the first behavior structure information, determining that the initial recognition result of the target script is that the target script hits the virus type corresponding to the preset behavior structure; If the judgment result is that the preset virus script behavior structure set does not have a preset behavior structure matching the first behavior structure information, the initial recognition result of the target script is determined as the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0009] In one embodiment of the present application, optionally, determining the initial recognition result of the target script based on the script action association information includes: Determining the security level of each script action based on the behavior type and behavior content of each script action of the target script during the running process; Determine the script action whose safety level is lower than the preset level as a dangerous action; Determine second behavior structure information of all the dangerous actions of the target script based on the behavior type of each dangerous action of the target script during the running process and the execution order of the dangerous actions in the script behavior execution order; Determining whether a preset virus script behavior structure set has a preset behavior structure matching the second behavior structure information; If the judgment result is that the preset virus script behavior structure set has a preset behavior structure matching the second behavior structure information, determining that the initial recognition result of the target script is that the target script hits the virus type corresponding to the preset behavior structure; If the judgment result is that the preset virus script behavior structure set does not have a preset behavior structure matching the second behavior structure information, the initial recognition result of the target script is determined as the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0010] In one embodiment of the present application, optionally, determining the confidence of the target script based on the script action association information and the initial recognition result includes: Determine the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process; Based on the safety factor, the initial recognition result and a preset script confidence calculation model, the confidence of the target script is determined, wherein the script confidence calculation model is used to reflect the correlation between the safety performance level of the target script comprehensively reflected by the safety factor and the initial recognition result and the confidence of the target script.

[0011] In one embodiment of the present application, optionally, determining the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process includes: For each script action of the target script during the running process, determining the danger level of the script action based on the behavior type and the behavior content of the script action; Based on the behavior type, behavior content, risk level and order of the script behavior execution sequence, a safety factor calculation matrix is ​​constructed, wherein: The element in the i-th row and j-th column of the safety factor calculation matrix is ​​the behavior type, the behavior content, the risk level, and the product of the weighted value of the i-th item and the weighted value of the j-th item in the sorting. The weights of the behavior type, the behavior content, the risk level and the ranking are determined by the contribution of the behavior type, the behavior content, the risk level and the ranking to the historical safety factor in the historical script recognition result; Based on the safety factor calculation matrix, the safety factor of the target script is determined.

[0012] In one embodiment of the present application, optionally, it further includes: Obtaining historical script recognition results of multiple historical scripts, and determining a proportion of correct recognition results in the historical script recognition results; Determine the first occurrence frequency of each behavior type and each behavior content in the historical script recognition result in the historical script recognition result and the second occurrence frequency in the correct recognition result; For each of the behavior types and each of the information in the behavior content, determine the product of the ratio of the first occurrence frequency to the second occurrence frequency of the information and the proportion of the correct recognition results as the weight of the information; For each script action of the target script during the running process, Determine the square root of the product of the weight of the behavior type of the script action and the weight of the behavior content as the weight of the danger level of the script action; The weight of the ranking of the script actions is set to the inverse of the ranking sequence number.

[0013] In a second aspect, an embodiment of the present application provides a malicious script identification device, including: A simulation operation unit, configured to simulate the operation process of the target script in a virtual machine in response to an operation instruction for the target script; A simulation operation monitoring unit, used for monitoring script action association information of the target script during the operation process, wherein the script action association information is used for reflecting the safety performance level of the target script when executing the script action; An initial recognition unit, used to determine an initial recognition result of the target script based on the script action association information; A confidence calculation unit, used to determine the confidence of the target script based on the script action association information and the initial recognition result; The identification processing unit is used to determine that the target script is a malicious script and intercept the running instruction if the confidence level is lower than a predetermined confidence level threshold.

[0014] In one embodiment of the present application, optionally, the simulation operation monitoring unit is used to: monitor the behavior type and behavior content of each script action of the target script during the operation process and the script behavior execution order during the operation process.

[0015] In one embodiment of the present application, optionally, the initial identification unit includes: A first behavior structure information determining unit, configured to determine first behavior structure information of the target script based on a behavior type of each script action of the target script during the running process and an execution order of the script behaviors; A first judgment unit is used to judge whether a preset virus script behavior structure set contains a preset behavior structure that matches the first behavior structure information, wherein, if the judgment result is that the preset virus script behavior structure set contains a preset behavior structure that matches the first behavior structure information, the initial recognition result of the target script is determined to be that the target script hits the virus type corresponding to the preset behavior structure; if the judgment result is that the preset virus script behavior structure set does not contain a preset behavior structure that matches the first behavior structure information, the initial recognition result of the target script is determined to be that the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0016] In one embodiment of the present application, optionally, the initial identification unit includes: A security level determination unit, configured to determine the security level of each script action based on the behavior type and behavior content of each script action of the target script during the running process; A dangerous action screening unit, used for determining the script actions with a safety level lower than a preset level as dangerous actions; A second behavior structure information determining unit, for determining second behavior structure information of all the dangerous actions of the target script based on the behavior type of each dangerous action of the target script during the running process and the dangerous action execution order in the script behavior execution order; A second judgment unit is used to judge whether a preset virus script behavior structure set contains a preset behavior structure that matches the second behavior structure information, wherein, if the judgment result is that the preset virus script behavior structure set contains a preset behavior structure that matches the second behavior structure information, the initial recognition result of the target script is determined to be that the target script hits the virus type corresponding to the preset behavior structure; if the judgment result is that the preset virus script behavior structure set does not contain a preset behavior structure that matches the second behavior structure information, the initial recognition result of the target script is determined to be that the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0017] In one embodiment of the present application, optionally, the confidence calculation unit includes: A safety factor determination unit, configured to determine the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process; The first execution unit is used to determine the confidence of the target script based on the safety factor, the initial recognition result and a preset script confidence calculation model, wherein the script confidence calculation model is used to reflect the correlation between the safety performance level of the target script comprehensively reflected by the safety factor and the initial recognition result and the confidence of the target script.

[0018] In one embodiment of the present application, optionally, the safety factor determination unit includes: a risk level determination unit, configured to determine, for each script action of the target script during the running process, the risk level of the script action based on the behavior type and the behavior content of the script action; a matrix construction unit, for constructing a safety factor calculation matrix based on the behavior type, the behavior content, the risk level and the order of the script behavior execution sequence, wherein the element in the i-th row and j-th column of the safety factor calculation matrix is ​​the product of the weighted value of the i-th item and the weighted value of the j-th item in the behavior type, the behavior content, the risk level and the order, and the respective weights of the behavior type, the behavior content, the risk level and the order are determined by the contribution of the behavior type, the behavior content, the risk level and the order in the historical script recognition result to the historical safety factor; The second execution unit is used to determine the safety factor of the target script based on the safety factor calculation matrix.

[0019] In one embodiment of the present application, optionally, the device further includes: A historical data acquisition unit, used to acquire historical script recognition results of multiple historical scripts, and determine the proportion of correct recognition results in the historical script recognition results; A historical frequency determination unit, used to determine the first occurrence frequency of each of the behavior types and each of the behavior contents in the historical script recognition results in the historical script recognition results and the second occurrence frequency in the correct recognition results; A first weight setting unit is used to determine, for each of the behavior types and each of the information in the behavior content, a product of a ratio of a first occurrence frequency to a second occurrence frequency of the information and a proportion of the correct recognition results as a weight of the information; A second weight setting unit is used to determine, for each script action of the target script during the running process, a square root of the product of the weight of the behavior type of the script action and the weight of the behavior content of the script action as the weight of the danger level of the script action; The third weight setting unit is used to set the weight of the ranking of each script action of the target script during the running process to the inverse of the ranking sequence number.

[0020] In a third aspect, an embodiment of the present application provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method described in the first aspect above.

[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method described in the first aspect above.

[0022] The above technical solution aims at the technical problem that the identification and processing of malicious scripts are seriously delayed due to the use of feature value matching in the related art, and proposes to pre-run the target script in the virtual machine before the target script is run, and obtain the script action association information and initial identification results in the running process by monitoring the pre-running process. These feature information represents the script running security level, and finally, the confidence of the target script is calculated by the script action association information and initial identification results. These feature information represents the script running security level is used as the final basis for judging whether the target script is a malicious script. In the above technical solution, the step of script security identification is placed before the actual running of the script in the computer system, that is, before the script is run, it is identified as a malicious script through the virtual running mode. Therefore, compared with the feature value matching method in the related art, the timing of script security identification can be greatly advanced, which not only avoids the lag of script security identification, but also improves the accuracy of script identification, and can timely intercept the running instructions of the malicious script before the malicious script causes any damage to the computer system, thereby improving the overall security performance of the computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A flowchart of a malicious script identification method according to an embodiment of the present application is shown; Figure 2 A flowchart of a malicious script identification method according to another embodiment of the present application is shown; Figure 3A flowchart of a malicious script identification method according to another embodiment of the present application is shown; Figure 4 A block diagram of a computer device according to an embodiment of the present application is shown; Figure 5 A block diagram of a computer device according to another embodiment of the present application is shown. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Figure 1 A flowchart of a malicious script identification method according to an embodiment of the present application is shown; like Figure 1 As shown, a malicious script identification method according to an embodiment of the present application includes: Step 102: In response to the running instruction for the target script, the running process of the target script is simulated in the virtual machine.

[0027] The target script is a script to be executed in the computer system, and the execution instruction for the target script is an instruction requiring the execution of the target script.

[0028] Simulating the running process of the target script in the virtual machine refers to executing the running instruction in the virtual machine to run the target script. In other words, after receiving the running instruction for the target script, the target script is not run directly, but is executed first in the virtual machine.

[0029] A virtual machine is a simulated computer system that is independent of the original computer system. Operations performed in the virtual machine will not affect the original computer system, and the virtual machine has the advantage of low hardware overhead. On this basis, when the original computer system receives an instruction to run a target script, it does not directly run the target script, but instead performs a preview of the target script in a virtual machine that is isolated from the original computer system, so as to identify whether the target script is a malicious script through this preview process.

[0030] Moreover, this rehearsal is performed outside the original computer system and before the original computer system executes the target script. Compared with identifying and intercepting the target script during the execution of the target script by the original computer system, it is possible to predict whether the target script is malicious.

[0031] Step 104, monitoring the script action association information of the target script during the running process.

[0032] Among them, the script action association information is used to reflect the security performance level of the target script when executing the script action. In other words, the script action association information is the concrete performance result of the target script during the running process. This concrete performance result itself is a representation of whether the target script is a malicious script, and can be used as a basis for identifying whether the target script is a malicious script.

[0033] In a possible design, the script action association information of the target script during the running process includes but is not limited to the behavior type and behavior content of each script action and the script behavior execution order during the running process.

[0034] The behavior types of script actions include but are not limited to: executing program actions, writing startup items and other registry operation actions, any email processing actions including sending email actions and adding email attachments, Internet access actions, downloading program actions, and any file operation actions such as self-copying actions, deleting files, modifying files, and creating files.

[0035] The behavior content of a script action refers to the specific object of the script action. For example, the behavior type of script action a is file copy, and the behavior content is to copy the files in the path C:\path\to\downloaded.

[0036] The script behavior execution order during the running process refers to the order of the behavior types of the script actions. For example, when the Email-Worm.VBS.Small script is executed in the virtual machine, it executes five actions in sequence: creating a COM object, copying files, setting auto-start items, downloading files, and self-deleting. The order of these five actions is the script behavior execution order.

[0037] Step 106, determining an initial recognition result of the target script based on the script action association information.

[0038] Since the script action association information is used to reflect the security performance level of the target script when executing the script action, it can be used as a basis for identifying whether the target script is a malicious script. Therefore, the target script can be preliminarily identified through the script action association information, and this preliminary identification result can be used as one of the influencing factors of the final identification result.

[0039] In a possible design, the behavior structure information of the target script can be preliminarily identified. If the preset virus script behavior structure set has a preset behavior structure that matches the first behavior structure information, the initial identification result of the target script can be determined as the target script hitting the virus type corresponding to the preset behavior structure. Otherwise, the initial identification result of the target script is determined as the target script not hitting any virus type covered by the preset virus script behavior structure set.

[0040] Step 108, determining the confidence of the target script based on the script action association information and the initial recognition result.

[0041] The script action association information of the target script reflects the security performance level of the target script when executing the script action, and the initial recognition result of the target script reflects whether the target script is likely to be a virus script and what the virus type is if it is likely to be a virus script. It can be understood that the script action association information and the initial recognition result both reflect the performance level of the target script in the security dimension to a certain extent, and are the characterization content of whether the target script is a malicious script.

[0042] On this basis, the confidence level determined based on the script action association information and the initial recognition result reflects the possibility that the target script is not a malicious script. The higher the confidence level, the higher the possibility that the target script is not a malicious script. The lower the confidence level, the greater the probability that the target script is a malicious script.

[0043] Step 110: If the confidence level is lower than a predetermined confidence level threshold, the target script is determined to be a malicious script, and the execution instruction is intercepted.

[0044] On the basis of the above technical solution, a predetermined confidence threshold may be set as a basis for judging the confidence of the target script.

[0045] In a possible design, the predetermined confidence threshold is a confidence value indicating that the target script is not a malicious script.

[0046] Optionally, the predetermined confidence threshold is a minimum confidence value when the target script is not a malicious script.

[0047] The above technical scheme aims to solve the technical problem in the related art that the identification and processing of malicious scripts are seriously delayed due to the use of feature value matching to identify malicious scripts. It proposes to pre-run the target script in a virtual machine before the target script is run, and obtain the script action association information and initial recognition results during the running process by monitoring the pre-running process. These feature information represent the safety level of the script running. Finally, the confidence of the target script is calculated based on the script action association information and initial recognition results, which are feature information representing the safety level of the script running, as the final basis for determining whether the target script is a malicious script.

[0048] In the above technical solution, the step of script security identification is placed before the actual running of the script in the computer system, that is, before the script is run, it is identified as a malicious script through a virtual running mode. Therefore, compared with the feature value matching method in the related technology, the timing of script security identification can be greatly advanced, which not only avoids the lag of script security identification, but also improves the accuracy of script identification. It can timely intercept the running instructions of the malicious script before the malicious script causes any damage to the computer system, thereby improving the overall security performance of the computer system.

[0049] Figure 2 A flowchart of a malicious script identification method according to another embodiment of the present application is shown.

[0050] like Figure 2 As shown, a malicious script identification method according to another embodiment of the present application includes: Step 202: In response to the running instruction for the target script, the running process of the target script is simulated in the virtual machine.

[0051] Step 204, monitoring the script action association information of the target script during the running process, wherein the script action association information is used to reflect the safety performance level of the target script when executing the script action.

[0052] The technical effects of the above steps are Figure 1 The embodiments described in the drawings are the same as those described in the drawings and will not be described in detail here.

[0053] Step 206 , determining first behavior structure information of the target script based on the behavior type of each script action of the target script during the running process and the script behavior execution order.

[0054] In other words, the behavior structure of the overall action of the target script executing the script actions in sequence during the running process is used as the initial basis for determining whether the target script is a malicious script.

[0055] Step 208, determining whether a preset virus script behavior structure set contains a preset behavior structure that matches the first behavior structure information, wherein, if the determination result is that the preset virus script behavior structure set contains a preset behavior structure that matches the first behavior structure information, determining that the initial recognition result of the target script is that the target script hits the virus type corresponding to the preset behavior structure; if the determination result is that the preset virus script behavior structure set does not contain a preset behavior structure that matches the first behavior structure information, determining that the initial recognition result of the target script is that the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0056] The preset virus script behavior structure set stores the behavior structures of script actions executed successively when various known virus scripts are running. If the first behavior structure information of the target script hits a preset behavior structure in the preset virus script behavior structure set, it means that the target script may be a malicious script under the virus type corresponding to the preset behavior structure.

[0057] Of course, since the security script may have the same behavioral structure as the malicious script in actual operation, this initial recognition result can only indicate whether the current target script is likely to be a malicious script, but cannot be used as the final basis for judging whether the target script is a malicious script.

[0058] On the contrary, if the first behavior structure information of the target script does not match any preset behavior structure in the preset virus script behavior structure set, it means that the target script is not a malicious script under any virus type corresponding to the preset behavior structure.

[0059] However, since malicious scripts can transform themselves to obtain variants, the preset virus script behavior structure set cannot collect the behavior structures of all possible malicious scripts. Therefore, this initial recognition result can only indicate that the current target script is not a malicious script collected by the preset virus script behavior structure set, and cannot be used as the final basis for judging that the target script is not a malicious script.

[0060] Step 210, determining the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process.

[0061] Based on the above initial recognition results, the safety factor of the target script can be introduced as a new standard to further explore the security characteristics of the target script.

[0062] Among them, the behavior type, behavior content, and script behavior execution order of each script action during the operation process can reflect the security performance level of the target script when executing the script action in different dimensions, and the security performance level of each dimension can be combined to obtain the security factor of the target script. In other words, the security factor of the target script reflects the comprehensive security performance level of the target script in multiple dimensions such as the behavior type, behavior content, and script behavior execution order of different script actions. This comprehensive security performance level serves as one of the bases for identifying whether the target script is a malicious script.

[0063] Step 212, determining the confidence of the target script based on the safety factor, the initial recognition result and a preset script confidence calculation model.

[0064] The script confidence calculation model is used to reflect the correlation between the safety performance level of the target script comprehensively reflected by the safety factor and the initial recognition result and the confidence of the target script. Therefore, based on the safety factor, the initial recognition result and this correlation, the confidence of the target script can be inferred.

[0065] Optionally, the script confidence calculation model is any type of model such as a Bayesian network model, a support vector machine model, a neural network model, a decision tree model, a naive Bayes model, etc.

[0066] Among them, if the script confidence calculation model is a neural network model, historical sample data can be obtained, wherein the historical sample data includes the safety factors, initial recognition results and final historical script recognition results of multiple historical scripts, and the safety factors and initial recognition results of the historical scripts are used as the input information of the initial script confidence calculation model, and the final historical script recognition results of the historical scripts are used as the output information of the initial script confidence calculation model. The initial script confidence calculation model is iteratively trained to update the model parameters of the script confidence calculation model.

[0067] When the iterative training reaches the specified number of times, or when the similarity between the predicted result of the iterative training and the actual historical script recognition result of the historical script reaches the specified similarity threshold, the update of the model parameters of the script confidence calculation model is terminated to obtain a valid script confidence calculation model.

[0068] Step 214: If the confidence level is lower than a predetermined confidence level threshold, the target script is determined to be a malicious script, and the execution instruction is intercepted.

[0069] In the above technical scheme, the initial recognition result can be determined by whether the behavior structure of the target script hits the preset behavior structure of the preset virus script behavior structure set, and the safety factor of the target script is determined based on the behavior type, behavior content and script behavior execution order of each script action of the target script in the running process, so as to characterize the comprehensive security performance level of the target script, and finally the initial recognition result and the comprehensive security performance level are combined as the input information of the script confidence calculation model, and the confidence of the target script is obtained through the script confidence calculation model as the final basis for judging whether the target script is a malicious script. Therefore, compared with the judgment method of feature value matching, the security feature performance of the target script in the pre-running process of the virtual machine can be deeply mined, so as to more accurately and deeply judge whether the target script is malicious based on these deeply mined security feature performances. At the same time, the timing of script security identification can be greatly advanced, which not only avoids the lag of script security identification, but also improves the accuracy of script identification, and can timely intercept the running instructions of malicious scripts before the malicious scripts cause any damage to the computer system, thereby improving the overall security performance of the computer system.

[0070] Figure 3 A flowchart of a malicious script identification method according to another embodiment of the present application is shown.

[0071] like Figure 3 As shown, a malicious script identification method according to another embodiment of the present application includes: Step 302: In response to the running instruction for the target script, the running process of the target script is simulated in the virtual machine.

[0072] Step 304: monitor the script action association information of the target script during the running process.

[0073] The script action association information is used to reflect the safety performance level of the target script when executing the script action.

[0074] The technical effects of the above steps are Figure 1 The embodiments described in the drawings are the same as those described in the drawings and will not be described in detail here.

[0075] Step 306: Determine the security level of each script action based on the behavior type and behavior content of each script action of the target script during the running process.

[0076] Specifically, the security level of each behavior content under each behavior type can be preset.

[0077] For example, under the behavior type of file copying, if the behavior content is to copy any file in the system configuration file directory, set its security level to low; if the behavior content is to copy any file in the ordinary file directory, set its security level to high.

[0078] For another example, under the behavior type of setting auto-start items, if the behavior content is to set auto-start for software in a specified blacklist, set the corresponding security level to low; if the behavior content is to set auto-start for software in a specified whitelist, set the corresponding security level to medium.

[0079] Step 308: Determine the script action whose safety level is lower than the preset level as a dangerous action.

[0080] Optionally, the preset level is advanced.

[0081] That is to say, script actions that are judged to be low-level and medium-level can be identified as dangerous actions, and the specific manifestations of the dangerous actions of the target script can be used as a basis for determining whether the target script is a malicious script.

[0082] Step 310, based on the behavior type of each dangerous action of the target script during the running process and the execution order of the dangerous actions in the script behavior execution order, determine the second behavior structure information of all the dangerous actions of the target script.

[0083] In other words, the behavior structure of the overall action of the target script executing various dangerous actions in sequence during the running process is used as the initial basis for judging whether the target script is a malicious script.

[0084] Step 312, determine whether the preset virus script behavior structure set contains a preset behavior structure that matches the second behavior structure information; if the judgment result is that the preset virus script behavior structure set contains a preset behavior structure that matches the second behavior structure information, determine that the initial recognition result of the target script is that the target script hits the virus type corresponding to the preset behavior structure; if the judgment result is that the preset virus script behavior structure set does not contain a preset behavior structure that matches the second behavior structure information, determine that the initial recognition result of the target script is that the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0085] The preset virus script behavior structure set stores the behavior structures of dangerous actions executed successively when various known virus scripts are running. If the first behavior structure information of the target script hits a preset behavior structure in the preset virus script behavior structure set, it means that the target script may be a malicious script under the virus type corresponding to the preset behavior structure.

[0086] Of course, since the security script may have the same behavioral structure as the malicious script in actual operation, this initial recognition result can only indicate whether the current target script is likely to be a malicious script, but cannot be used as the final basis for judging whether the target script is a malicious script.

[0087] On the contrary, if the first behavior structure information of the target script does not match any preset behavior structure in the preset virus script behavior structure set, it means that the target script is not a malicious script under any virus type corresponding to the preset behavior structure.

[0088] However, since malicious scripts can transform themselves to obtain variants, the preset virus script behavior structure set cannot collect the behavior structures of all possible malicious scripts. Therefore, this initial recognition result can only indicate that the current target script is not a malicious script collected by the preset virus script behavior structure set, and cannot be used as the final basis for judging that the target script is not a malicious script.

[0089] Step 314, determining the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process.

[0090] Based on the above initial recognition results, the safety factor of the target script can be introduced as a new standard to further explore the security characteristics of the target script.

[0091] In one possible design, the safety factor of the target script may be determined based on the behavior types and behavior contents of all script actions of the target script during the running process and the execution order of the script behaviors during the running process.

[0092] The behavior type, behavior content, and execution order of script behaviors of each script action during the operation process can reflect the security performance level of the target script when executing the script action in different dimensions. The security performance level of each dimension can be combined to obtain the security factor of the target script. In other words, the security factor of the target script reflects the comprehensive security performance level of the target script in multiple dimensions such as the behavior type, behavior content, and execution order of script behaviors of different script actions. This comprehensive security performance level serves as one of the bases for identifying whether the target script is a malicious script.

[0093] In another possible design, the safety factor of the target script may be determined based on the behavior type and behavior content of the dangerous actions of the target script during the running process and the execution order of the script behaviors during the running process.

[0094] The behavior type, behavior content, and script behavior execution order of each dangerous action during the operation process can reflect the safety performance level of the target script when executing dangerous actions in different dimensions. The safety performance level of each dimension can be combined to obtain the safety factor of the target script. In other words, the safety factor of the target script reflects the comprehensive safety performance level of the target script in multiple dimensions such as the behavior type, behavior content, and script behavior execution order of different dangerous actions. This comprehensive safety performance level serves as one of the bases for identifying whether the target script is a malicious script.

[0095] Step 316, determining the confidence of the target script based on the safety factor, the initial recognition result and a preset script confidence calculation model.

[0096] Among them, the script confidence calculation model is used to reflect the correlation between the safety performance level of the target script comprehensively reflected by the safety factor and the initial recognition result and the confidence of the target script.

[0097] The technical effects of the above steps are Figure 1 The embodiments described in the drawings are the same as those described in the drawings and will not be described in detail here.

[0098] Step 318: If the confidence level is lower than a predetermined confidence level threshold, the target script is determined to be a malicious script, and the execution instruction is intercepted.

[0099] In the above technical scheme, the initial recognition result can be determined by whether the behavior structure of the target script hits the preset behavior structure of the preset virus script behavior structure set, and the safety factor of the target script is determined based on the behavior type, behavior content and script behavior execution order of each dangerous action of the target script in the running process, so as to characterize the comprehensive safety performance level of the target script, and finally the initial recognition result and the comprehensive safety performance level are combined as the input information of the script confidence calculation model, and the confidence of the target script is obtained through the script confidence calculation model as the final basis for judging whether the target script is a malicious script. Therefore, compared with the judgment method of feature value matching, the security feature performance of the dangerous action of the target script in the pre-running process of the virtual machine can be deeply mined, so as to more accurately and deeply judge whether the target script is malicious based on these deeply mined security feature performances. At the same time, the timing of script security identification can be greatly advanced, which not only avoids the lag of script security identification, but also improves the accuracy of script identification, and can timely intercept the running instructions of the malicious script before the malicious script causes any damage to the computer system, thereby improving the overall security performance of the computer system.

[0100] In the above Figure 2 and Figure 3On the basis of the illustrated embodiment, specifically, in the process of determining the safety factor of the target script, first, for each script action of the target script during the running process, the danger level of the script action is determined based on the behavior type and the behavior content of the script action.

[0101] Of course, combined Figure 2 and Figure 3 It can be seen from the illustrated embodiments that the script actions described here may be all script actions of the target script, or may be only dangerous actions of the target script, which are collectively referred to as script actions below and will not be distinguished.

[0102] In a possible design, the behavior type and the behavior content of the script action of the target script are weighted and averaged to obtain the risk level of the script action.

[0103] Next, based on the behavior type, the behavior content, the risk level and the order of execution of the script behaviors, a safety factor calculation matrix is ​​constructed, wherein the element in the i-th row and j-th column of the safety factor calculation matrix is ​​the product of the weighted value of the i-th item and the weighted value of the j-th item in the behavior type, the behavior content, the risk level and the order.

[0104] That is to say, each element in the safety factor calculation matrix reflects the comprehensive safety performance under the influence of their respective weights after the two types of information, namely, the behavior type, the behavior content, the risk level and the ranking, are superimposed.

[0105] Furthermore, the respective weights of the behavior type, the behavior content, the risk level and the ranking are determined by the contribution of the behavior type, the behavior content, the risk level and the ranking to the historical safety factor in the historical script recognition results.

[0106] In one possible design, the method for determining the weight of each information includes: obtaining historical script recognition results of multiple historical scripts, and determining the proportion of correct recognition results in the historical script recognition results; determining the first occurrence frequency of each behavior type and each behavior content in the historical script recognition results in the historical script recognition results and the second occurrence frequency in the correct recognition results; for each information in each behavior type and each behavior content, determining the product of the ratio of the second occurrence frequency of the information to the first occurrence frequency and the proportion of correct recognition results as the weight of the information; for each script action of the target script during the running process, determining the square root of the product of the weight of the behavior type and the weight of the behavior content of the script action as the weight of the danger level of the script action; setting the weight of the ranking of the script action to the inverse of the ranking sequence number.

[0107] The historical script recognition result refers to whether the historical script is a malicious script. The first occurrence frequency of the behavior type in the historical script recognition result and the second occurrence frequency in the correct recognition result respectively reflect the number of times the behavior type is used and the number of times it contributes to the correct recognition result. The ratio of the second occurrence frequency to the first occurrence frequency reflects the probability that the behavior type contributes to the correct recognition result in the historical script recognition result. Then, the ratio of the second occurrence frequency to the first occurrence frequency is multiplied by the proportion of correct recognition results. The proportion of correct recognition results can be combined to more deeply reflect the possibility that the behavior type contributes to the correct recognition result in the historical script recognition result. Therefore, the product can be used as the weight of the behavior type.

[0108] The principle of setting the weight of the behavior content is the same as above and will not be repeated here.

[0109] Since the risk level is calculated from the behavior type and behavior content, it can be understood that the combination of the weights of the behavior type and the behavior content can determine the ability level of the risk level to play a role in the historical script recognition results, that is, the basis for calculating the weight of the risk level. Specifically, the square root of the product of the weight of the behavior type and the weight of the behavior content of the script action can be determined as the weight of the risk level of the script action.

[0110] Finally, based on the safety factor calculation matrix, the safety factor of the target script is determined.

[0111] In a possible design, the rank of the safety factor calculation matrix is ​​set to the safety factor of the target script.

[0112] In another possible design, the elements of the safety factor calculation matrix whose difference with the mean of all elements is greater than a specified difference threshold are replaced with the mean of all elements, and the rank of the matrix obtained after replacement is set as the safety factor of the target script. In this way, the risk values ​​in the original safety factor calculation matrix that differ too much from the mean of all elements and may affect the accuracy of the recognition result can be eliminated, and these risk values ​​can be replaced with the more stable mean of all elements, thereby reducing the entropy value of the safety factor calculation and helping to improve the accuracy of the script recognition result.

[0113] The present application embodiment provides a malicious script identification device, including: A simulation operation unit, configured to simulate the operation process of the target script in a virtual machine in response to an operation instruction for the target script; A simulation operation monitoring unit, used for monitoring script action association information of the target script during the operation process, wherein the script action association information is used for reflecting the safety performance level of the target script when executing the script action; An initial recognition unit, used to determine an initial recognition result of the target script based on the script action association information; A confidence calculation unit, used to determine the confidence of the target script based on the script action association information and the initial recognition result; The identification processing unit is used to determine that the target script is a malicious script and intercept the running instruction if the confidence level is lower than a predetermined confidence level threshold.

[0114] In one embodiment of the present application, optionally, the simulation operation monitoring unit is used to: monitor the behavior type and behavior content of each script action of the target script during the operation process and the script behavior execution order during the operation process.

[0115] In one embodiment of the present application, optionally, the initial identification unit includes: A first behavior structure information determining unit, configured to determine first behavior structure information of the target script based on a behavior type of each script action of the target script during the running process and an execution order of the script behaviors; A first judgment unit is used to judge whether a preset virus script behavior structure set contains a preset behavior structure that matches the first behavior structure information, wherein, if the judgment result is that the preset virus script behavior structure set contains a preset behavior structure that matches the first behavior structure information, the initial recognition result of the target script is determined to be that the target script hits the virus type corresponding to the preset behavior structure; if the judgment result is that the preset virus script behavior structure set does not contain a preset behavior structure that matches the first behavior structure information, the initial recognition result of the target script is determined to be that the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0116] In one embodiment of the present application, optionally, the initial identification unit includes: A security level determination unit, configured to determine the security level of each script action based on the behavior type and behavior content of each script action of the target script during the running process; A dangerous action screening unit, used for determining the script actions with a safety level lower than a preset level as dangerous actions; A second behavior structure information determining unit, for determining second behavior structure information of all the dangerous actions of the target script based on the behavior type of each dangerous action of the target script during the running process and the dangerous action execution order in the script behavior execution order; A second judgment unit is used to judge whether a preset virus script behavior structure set contains a preset behavior structure that matches the second behavior structure information, wherein, if the judgment result is that the preset virus script behavior structure set contains a preset behavior structure that matches the second behavior structure information, the initial recognition result of the target script is determined to be that the target script hits the virus type corresponding to the preset behavior structure; if the judgment result is that the preset virus script behavior structure set does not contain a preset behavior structure that matches the second behavior structure information, the initial recognition result of the target script is determined to be that the target script does not hit any virus type covered by the preset virus script behavior structure set.

[0117] In one embodiment of the present application, optionally, the confidence calculation unit includes: A safety factor determination unit, configured to determine the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process; The first execution unit is used to determine the confidence of the target script based on the safety factor, the initial recognition result and a preset script confidence calculation model, wherein the script confidence calculation model is used to reflect the correlation between the safety performance level of the target script comprehensively reflected by the safety factor and the initial recognition result and the confidence of the target script.

[0118] In one embodiment of the present application, optionally, the safety factor determination unit includes: a risk level determination unit, configured to determine, for each script action of the target script during the running process, the risk level of the script action based on the behavior type and the behavior content of the script action; a matrix construction unit, for constructing a safety factor calculation matrix based on the behavior type, the behavior content, the risk level and the order of the script behavior execution sequence, wherein the element in the i-th row and j-th column of the safety factor calculation matrix is ​​the product of the weighted value of the i-th item and the weighted value of the j-th item in the behavior type, the behavior content, the risk level and the order, and the respective weights of the behavior type, the behavior content, the risk level and the order are determined by the contribution of the behavior type, the behavior content, the risk level and the order in the historical script recognition result to the historical safety factor; The second execution unit is used to determine the safety factor of the target script based on the safety factor calculation matrix.

[0119] In one embodiment of the present application, optionally, the device further includes: A historical data acquisition unit, used to acquire historical script recognition results of multiple historical scripts, and determine the proportion of correct recognition results in the historical script recognition results; A historical frequency determination unit, used to determine the first occurrence frequency of each of the behavior types and each of the behavior contents in the historical script recognition results in the historical script recognition results and the second occurrence frequency in the correct recognition results; A first weight setting unit is used to determine, for each of the behavior types and each of the information in the behavior content, a product of a ratio of a first occurrence frequency to a second occurrence frequency of the information and a proportion of the correct recognition results as a weight of the information; A second weight setting unit is used to determine, for each script action of the target script during the running process, a square root of the product of the weight of the behavior type of the script action and the weight of the behavior content of the script action as the weight of the danger level of the script action; The third weight setting unit is used to set the weight of the ranking of each script action of the target script during the running process to the inverse of the ranking sequence number.

[0120] The device uses any of the solutions described in the above embodiments, and therefore has all the above technical effects, which will not be repeated here.

[0121] In addition, in one embodiment, the present application provides a computer device, which may be a server, and its internal structure diagram may be as shown in FIG. Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, the method described in any of the above embodiments can be implemented.

[0122] In one embodiment, the present application further provides a computer device, which may be a client, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, the method described in any of the above embodiments can be implemented.

[0123] Any of the above-mentioned computer devices in the embodiments of the present application may exist in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0124] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0125] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys, wearable devices, and portable car navigation devices.

[0126] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0127] (5) Other electronic devices with data interaction functions.

[0128] In addition, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to perform the following steps: In response to the running instruction for the target script, simulating the running process of the target script in the virtual machine; Monitoring script action association information of the target script during the running process, wherein the script action association information is used to reflect the safety performance level of the target script when executing the script action; Based on the script action association information, determining an initial recognition result of the target script; Determining the confidence of the target script based on the script action association information and the initial recognition result; If the confidence level is lower than a predetermined confidence level threshold, the target script is determined to be a malicious script, and the execution instruction is intercepted.

[0129] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant description in the aforementioned method embodiment. In order to avoid repetition, they will not be described one by one here.

[0130] The above describes in detail the technical solution of the present application in conjunction with the accompanying drawings. Through the technical solution of the present application, the step of script security identification is placed before the actual running of the script in the computer system, that is, before the script is run, it is identified as a malicious script through a virtual running mode. Therefore, compared with the feature value matching method in the related art, the timing of script security identification can be greatly advanced, which not only avoids the lag of script security identification, but also improves the accuracy of script identification. It can timely intercept the running instructions of the malicious script before the malicious script causes any damage to the computer system, thereby improving the overall security performance of the computer system.

[0131] It should be understood that although the terms first, second, etc. may be used to describe behavior structure information in the embodiments of the present application, the behavior structure information should not be limited to these terms. These terms are only used to distinguish behavior structure information from each other. For example, without departing from the scope of the embodiments of the present application, the first behavior structure information may also be referred to as the second behavior structure information, and similarly, the second behavior structure information may also be referred to as the first behavior structure information.

[0132] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0133] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0134] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0135] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0136] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0137] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for identifying malicious scripts, characterized in that: include: In response to the running instruction for the target script, simulating the running process of the target script in the virtual machine; Monitoring script action association information of the target script during the running process, wherein the script action association information is used to reflect the safety performance level of the target script when executing the script action; Based on the script action association information, determining an initial recognition result of the target script; Determining the confidence of the target script based on the script action association information and the initial recognition result; If the confidence level is lower than a predetermined confidence level threshold, the target script is determined to be a malicious script, and the execution instruction is intercepted.

2. The malicious script identification method according to claim 1, characterized in that: The monitoring of the script action association information of the target script during the running process includes: Monitor the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process.

3. The malicious script identification method according to claim 2, characterized in that: The determining of the initial recognition result of the target script based on the script action association information includes: Determine first behavior structure information of the target script based on the behavior type of each script action of the target script during the running process and the execution order of the script behavior; Determining whether a preset virus script behavior structure set has a preset behavior structure that matches the first behavior structure information; If the judgment result is that the preset virus script behavior structure set has a preset behavior structure matching the first behavior structure information, determining that the initial recognition result of the target script is that the target script hits the virus type corresponding to the preset behavior structure; If the judgment result is that the preset virus script behavior structure set does not have a preset behavior structure matching the first behavior structure information, the initial recognition result of the target script is determined as the target script does not hit any virus type covered by the preset virus script behavior structure set.

4. The malicious script identification method according to claim 2, characterized in that: The determining of the initial recognition result of the target script based on the script action association information includes: Determining the security level of each script action based on the behavior type and behavior content of each script action of the target script during the running process; Determine the script action whose safety level is lower than the preset level as a dangerous action; Determine second behavior structure information of all the dangerous actions of the target script based on the behavior type of each dangerous action of the target script during the running process and the execution order of the dangerous actions in the script behavior execution order; Determining whether a preset virus script behavior structure set has a preset behavior structure matching the second behavior structure information; If the judgment result is that the preset virus script behavior structure set has a preset behavior structure that matches the second behavior structure information, determining that the initial recognition result of the target script is that the target script hits the virus type corresponding to the preset behavior structure; If the judgment result is that the preset virus script behavior structure set does not have a preset behavior structure matching the second behavior structure information, the initial recognition result of the target script is determined as the target script does not hit any virus type covered by the preset virus script behavior structure set.

5. The malicious script identification method according to claim 3 or 4, characterized in that: The determining the confidence of the target script based on the script action association information and the initial recognition result includes: Determine the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process; Based on the safety factor, the initial recognition result and a preset script confidence calculation model, the confidence of the target script is determined, wherein the script confidence calculation model is used to reflect the correlation between the safety performance level of the target script comprehensively reflected by the safety factor and the initial recognition result and the confidence of the target script.

6. The malicious script identification method according to claim 5, characterized in that: The determining of the safety factor of the target script based on the behavior type and behavior content of each script action of the target script during the running process and the script behavior execution order during the running process includes: For each script action of the target script during the running process, determining the danger level of the script action based on the behavior type and the behavior content of the script action; Based on the behavior type, behavior content, risk level and order of the script behavior execution sequence, a safety factor calculation matrix is ​​constructed, wherein: The element in the i-th row and j-th column of the safety factor calculation matrix is ​​the behavior type, the behavior content, the risk level, and the product of the weighted value of the i-th item and the weighted value of the j-th item in the sorting. The weights of the behavior type, the behavior content, the risk level and the ranking are determined by the contribution of the behavior type, the behavior content, the risk level and the ranking to the historical safety factor in the historical script recognition result; Based on the safety factor calculation matrix, the safety factor of the target script is determined.

7. The malicious script identification method according to claim 6, characterized in that: Also includes: Obtaining historical script recognition results of multiple historical scripts, and determining a proportion of correct recognition results in the historical script recognition results; Determine the first occurrence frequency of each of the behavior types and each of the behavior contents in the historical script recognition results in the historical script recognition results and the second occurrence frequency in the correct recognition results; For each of the behavior types and each of the information in the behavior content, determine the product of the ratio of the first occurrence frequency to the second occurrence frequency of the information and the proportion of the correct recognition results as the weight of the information; For each script action of the target script during the running process, Determine the square root of the product of the weight of the behavior type of the script action and the weight of the behavior content as the weight of the danger level of the script action; The weight of the ranking of the script actions is set to the inverse of the ranking sequence number.

8. A malicious script identification device, characterized in that: include: A simulation operation unit, configured to simulate the operation process of the target script in a virtual machine in response to an operation instruction for the target script; A simulation operation monitoring unit, used for monitoring script action association information of the target script during the operation process, wherein the script action association information is used for reflecting the safety performance level of the target script when executing the script action; An initial recognition unit, used to determine an initial recognition result of the target script based on the script action association information; A confidence calculation unit, used to determine the confidence of the target script based on the script action association information and the initial recognition result; The identification processing unit is used to determine that the target script is a malicious script and intercept the running instruction if the confidence level is lower than a predetermined confidence level threshold.

9. A computer device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are configured to enable the processor to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are configured to execute the method according to any one of claims 1 to 7.

Images