Automatic conversion test method and device for searching and killing rules, equipment and medium

Abstract

The invention relates to an automatic conversion test method and device for searching and killing rules, equipment and a medium. The automatic conversion test method for the searching and killing rule comprises the following steps: performing analysis conversion processing on a target static file to obtain corresponding memory state data; transforming the static searching and killing rule to obtain a corresponding memory searching and killing rule; performing matching detection processing on the mirror data of the memory state data based on the memory searching and killing rule to obtain a corresponding matching result; and under the condition that the matching result is successful matching, determining a final rule optimization result. According to existing static searching and killing rules, automatic conversion testing is achieved, the cost is reduced, and the detection efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the application field of malware detection and killing technology, and in particular to an automatic conversion test method, device, equipment and medium for detecting and killing rules. Background Art

[0002] In the field of malware detection, static file-based detection technology has become very mature. For example, the YARA malicious file detection tool in the open source community is widely used due to its flexible rule definition capabilities and powerful feature matching effects. Relying on the large number of open source rule libraries in the YARA community, security personnel can quickly create and apply file detection rules to match file features and efficiently identify malicious programs.

[0003] However, with the evolution of modern memory backdoor technology, traditional file detection methods have gradually exposed their shortcomings in memory detection scenarios. At the same time, memory backdoor execution technology has also developed rapidly, allowing any traditional malicious program to be directly transformed into a memory backdoor without modification. Typical tools such as libreflect and ulexecve can easily bypass file system dependencies and directly load ELF files into memory and execute them. This type of tool allows malicious programs to run in memory, thereby preventing files from landing on disk, greatly improving the ability to evade file detection. As a result, even if Yara-type static file detection rules can detect the corresponding static files, the memory loading after the tool processing is completely undetectable. Summary of the invention

[0004] In order to solve the above technical problems, the present disclosure provides a method, device, equipment and medium for automatically converting and testing killing rules.

[0005] In a first aspect, the present disclosure provides an automatic conversion test method for killing rules, comprising:

[0006] Parse and convert the target static file to obtain the corresponding memory state data;

[0007] The static killing rules are modified to obtain the corresponding memory killing rules;

[0008] Based on the memory killing rule, the mirror data of the memory state data is matched and detected to obtain a corresponding matching result;

[0009] When the matching result is a successful match, a final rule optimization result is determined.

[0010] In a second aspect, the present disclosure provides an automatic conversion test device for killing rules, comprising:

[0011] The first processing module is used to parse and convert the target static file to obtain corresponding memory state data;

[0012] The second processing module is used to transform the static killing rules to obtain corresponding memory killing rules;

[0013] A third processing module is used to perform matching detection processing on the mirror data of the memory state data based on the memory killing rule to obtain a corresponding matching result;

[0014] The first determination module is used to determine the final rule optimization result when the matching result is a successful match.

[0015] In a third aspect, the present disclosure provides an automatic conversion test device for killing rules, including:

[0016] processor;

[0017] A memory for storing executable instructions;

[0018] The processor is used to read executable instructions from the memory and execute the executable instructions to implement the automatic conversion test method of the killing rules of the first aspect.

[0019] In a fourth aspect, the present disclosure provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor implements the automatic conversion test method of the killing rule of the first aspect.

[0020] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0021] The automatic conversion test method, device, equipment and medium of the killing rule of the disclosed embodiment can parse and convert the target static file to obtain the corresponding memory state data, then transform the static killing rule to obtain the corresponding memory killing rule, and then match the mirror data of the memory state data based on the memory killing rule to obtain the corresponding matching result, and finally determine the final rule optimization result when the matching result is a successful match. Thus, by not actually running the file, the static file is converted into memory state data, and the static killing rule is transformed to obtain the memory killing rule, and the matching detection processing of the memory state data is realized, thereby utilizing the existing static killing rules to realize automatic conversion testing, reduce costs, and improve detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0023] Figure 1 A flowchart of an automatic conversion test method for killing rules provided in an embodiment of the present disclosure;

[0024] Figure 2 A flowchart of another automatic conversion test method for killing rules provided by an embodiment of the present disclosure;

[0025] Figure 3 A schematic diagram of the structure of an automatic conversion test device for killing rules provided by an embodiment of the present disclosure;

[0026] Figure 4 A schematic diagram of the structure of an automatic conversion test device for killing rules provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0028] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0029] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0030] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0031] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0032] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0033] In order to solve the above problems, the present disclosure provides a method, device, equipment and medium for automatically converting the killing rules. Figure 1 to Figure 2 The automatic conversion test method of the killing rule provided by the embodiment of the present disclosure is described in detail.

[0034] Figure 1 A flow chart of an automatic conversion test method for killing rules provided by an embodiment of the present disclosure is shown.

[0035] In the disclosed embodiment, the automatic conversion test method of the killing rule can be executed by an electronic device, wherein the electronic device can include but is not limited to devices such as computer devices, cloud servers or cloud server clusters.

[0036] like Figure 1 As shown, the automatic conversion test method of the killing rule may include the following steps.

[0037] S110, parsing and converting the target static file to obtain corresponding memory state data.

[0038] In the disclosed embodiment, the electronic device may parse and convert the target static file to obtain corresponding memory state data.

[0039] Optionally, the target static file may be a file stored on the server and not processed, such as an ELF file.

[0040] Optionally, the memory-state data may be data in a data format after the file is loaded into the memory.

[0041] Specifically, the electronic device can parse and convert the target static file to obtain memory state data having the data structure after the file is loaded into the memory, that is, the real memory data structure can be obtained without actually running the file.

[0042] S120: The static killing rule is modified to obtain a corresponding memory killing rule.

[0043] In the disclosed embodiment, the electronic device may modify the static killing rules to obtain corresponding memory killing rules.

[0044] Optionally, the static killing rule may be a rule for matching file features for static files and efficiently identifying malicious programs, for example, a YARA rule.

[0045] Optionally, the memory killing rule may be a rule for identifying malicious programs for files loaded into the memory for execution.

[0046] Specifically, the electronic device can modify the static killing rules, such as modifying the YARA rules, to obtain the memory killing rules.

[0047] S130: Perform matching detection processing on the mirror data of the memory state data based on the memory killing rule to obtain a corresponding matching result.

[0048] In the disclosed embodiment, the electronic device may perform matching detection processing on the mirror data of the memory state data based on the memory killing rule to obtain a corresponding matching result.

[0049] Specifically, the electronic device can obtain the mirror data of the memory state data, and then apply the memory killing rule to the mirror data of the memory state data, that is, perform matching detection processing on the mirror data of the memory state data to obtain a corresponding matching result.

[0050] S140: When the matching result is a successful match, determine a final rule optimization result.

[0051] In the embodiment of the present disclosure, when the matching result is a successful match, the electronic device can determine the final rule optimization result.

[0052] Therefore, in the disclosed embodiment, the target static file can be parsed and converted to obtain the corresponding memory state data, and then the static killing rules can be modified to obtain the corresponding memory killing rules, and then the mirror data of the memory state data can be matched and detected based on the memory killing rules to obtain the corresponding matching results, and finally, when the matching result is a successful match, the final rule optimization result is determined. Therefore, by not actually running the file, the static file is converted into memory state data, and the static killing rules are modified to obtain the memory killing rules, and the matching detection processing of the memory state data is realized, thereby utilizing the existing static killing rules to realize automated conversion testing, reduce costs, and improve detection efficiency.

[0053] Optionally, S110 may specifically include: performing file parsing processing on the target static file to obtain multiple segment data; identifying the architecture type of the target static file, and making the multiple segment data cross-architecture compatible based on the architecture type; arranging the multiple segment data according to the memory state layout to generate the memory state data.

[0054] In the disclosed embodiment, the electronic device may perform file parsing processing on the target static file to obtain a plurality of segment data.

[0055] Specifically, the electronic device can parse the target static file (such as ELF file), extract the ELF file header, program header table and segment table information, and obtain the offset, size, access rights and other characteristics of each segment data. Thus, the real file segment layout is obtained by parsing the file structure, but the file is not executed, ensuring that only memory state data is generated, avoiding dependencies, architecture compatibility and security risks during operation.

[0056] Furthermore, the electronic device may identify the architecture type of the target static file, and perform cross-architecture compatibility on the multiple segment data based on the architecture type.

[0057] Specifically, the electronic device can identify the architecture type (such as x86, ARM, MIPS, etc.) and byte order of the target static file, ensure that files of different architectures can be accurately parsed and converted, and perform differentiated processing on file data of different architectures to retain the file features specific to each architecture and adapt to multi-architecture environments. Use a cross-architecture compatible method to process the segment data of the ELF file to ensure that the conversion result is applicable to multiple architectures, thereby ensuring that all segment data are laid out in the memory image according to the architecture requirements, and keep the segment spacing, alignment and permission information consistent.

[0058] Furthermore, the electronic device may arrange the plurality of segment data according to a memory state layout to generate the memory state data.

[0059] Specifically, the electronic device can arrange the multiple segment data according to the memory state layout, for example, arrange the data of each loading segment in the ELF file according to the memory state layout, remove the file header and segment table information, and only retain the actual data content to generate memory state data that conforms to the actual loading state. The output memory data image thus contains the possible characteristics of the malicious code in the memory without the need for actual file execution, thus avoiding execution complexity such as configuration dependency and command line parameters.

[0060] Optionally, S120 may specifically include: using a large model to identify conditions in the static killing rule that depend on the file structure, and obtaining corresponding file header features; removing the file header features, and generating the memory killing rule.

[0061] In the disclosed embodiment, the electronic device may use a large model to identify the conditions in the static killing rule that depend on the file structure, and obtain the corresponding file header features.

[0062] Specifically, the electronic device can use a large model to identify the conditions in the static killing rules that depend on the file structure, for example, use a large model to analyze traditional file killing rules such as YARA, and identify the conditions in the rules that depend on the file structure, such as ELF file header features.

[0063] Furthermore, the electronic device can remove the file header features and generate the memory killing rules.

[0064] Specifically, the electronic device can remove the file header features, such as automatically removing the most basic conditional restrictions that rely on the ELF header class, to generate the memory detection rule. Thus, the memory detection rule maintains the original rule content as much as possible while ensuring that it can be used for memory detection.

[0065] Optionally, S130 may specifically include: performing a matching detection process on the mirror data of the memory state data based on the memory killing rule; and enabling a log to record the matching result during the matching detection process.

[0066] In an embodiment of the present disclosure, the electronic device may perform matching detection processing on the mirror data of the memory state data based on the memory killing rule.

[0067] For example, electronic devices can apply the modified memory killing rules to the generated image data, that is, use the memory data image as the input of the YARA engine, test the matching effect of the modified rules without relying on the file structure, and do not need to involve file operation, avoiding operation dependency issues such as architecture compatibility and parameter configuration.

[0068] Furthermore, the electronic device may enable a log to record the matching result during the matching detection process.

[0069] For example, enable the YARA debug log to record detailed information during the match detection process, including the matching status of each sub-rule, analyze the matching status of each sub-rule in the debug log, and obtain the corresponding matching results.

[0070] Optionally, the automatic conversion test method of the killing rule may further include: when the matching result is a failed match, analyzing the reasons for the failure to match and the corresponding sub-rules in the matching result.

[0071] In the embodiment of the present disclosure, when the matching result is an unsuccessful match, the electronic device may analyze the unmatched reason and the corresponding sub-rule in the matching result.

[0072] Specifically, after obtaining the matching result, if the matching result is a failed match, the electronic device can analyze the unmatched reason and the corresponding sub-rule in the matching result, generate an analysis report of the unmatched condition according to the matching result, and record the mismatched reason and the corresponding rule, so as to facilitate subsequent optimization processing.

[0073] Optionally, the automatic conversion test method of the killing rule may also include: using a large model to analyze and process the reasons for non-matching and corresponding sub-rules to obtain corresponding optimization strategies; optimizing the memory killing rules based on the optimization strategies to obtain optimized memory killing rules.

[0074] In the disclosed embodiment, the electronic device may use a large model to analyze and process the mismatching reasons and the corresponding sub-rules to obtain a corresponding optimization strategy.

[0075] Specifically, electronic devices can use large models to analyze and process the causes of mismatches and corresponding sub-rules, and make optimization suggestions based on the information in the mismatch report. For example, by analyzing memory state characteristics, new matching solutions or adjustment strategies are provided for mismatch conditions. When generating optimization suggestions, refer to the standard conversion rules in the rule conversion policy library to ensure the applicability of the optimization solution in memory state detection. The policy library provides adaptation solutions from common file structures to memory features, so that rules can be automatically converted into matching conditions suitable for memory detection. The policy library can also be based on experience extraction of manual conversion that is not handled well by the large model.

[0076] Furthermore, the electronic device can optimize the memory killing rule based on the optimization strategy to obtain an optimized memory killing rule.

[0077] Optionally, the automatic conversion test method of the killing rule may also include: performing match detection processing on the mirror data of the memory state data based on the optimized memory killing rule to obtain a corresponding matching result; if the matching result is an unsuccessful match, continuing to iteratively optimize the optimized memory killing rule until the matching result is a successful match or exceeds a preset number of iterations; when the matching result is a successful match, determining the final rule optimization result; when the preset number of iterations is exceeded, adjusting the optimized memory killing rule in response to a manual adjustment operation of the user until the matching result is a successful match.

[0078] In the disclosed embodiment, the electronic device may perform matching detection processing on the mirror data of the memory state data based on the optimized memory killing rule to obtain a corresponding matching result.

[0079] Specifically, the electronic device can perform matching detection processing on the mirror data of the memory state data based on the optimized memory killing rule, that is, input the optimized memory killing rule into the YARA engine, and perform matching detection processing on the mirror data of the memory state data to obtain the corresponding matching result.

[0080] Furthermore, if the matching result is an unsuccessful match, the electronic device may continue to iteratively optimize the optimized memory killing rule until the matching result is a successful match or exceeds a preset number of iterations.

[0081] Specifically, after the match detection process, if the match result is a successful match, the final rule optimization result is output; if the result is an unsuccessful match, the electronic device can continue to iteratively optimize the optimized memory killing rule until the match result is a successful match or exceeds the preset number of iterations, that is, in the case of an unsuccessful match, continue to iterate and optimize through the large model until the match result is a successful match or exceeds the preset number of iterations (such as 3 or 4 times).

[0082] In some embodiments, when the matching result is a successful match, the electronic device may determine a final rule optimization result.

[0083] In other embodiments, when the number of iterations exceeds a preset number, the electronic device may adjust the optimized memory killing rule in response to a manual adjustment operation by the user until the matching result is a successful match.

[0084] Specifically, when the preset number of iterations is exceeded, the user can analyze the unmatched report and manually modify the rules according to the memory state characteristics to adapt to memory detection. That is, in response to the user's manual adjustment operation, the optimized memory detection and killing rules are adjusted. For example, the user adjusts the rules, manually adjusts the unmatched rules one by one, and optimizes the rule conditions with reference to the unmatched report and the adaptation suggestions in the policy library to ensure that the modified rules can adapt to the memory state characteristics and achieve accurate detection.

[0085] Next, re-enter the adjusted rules into the YARA engine to test its detection effect in memory data. If the test is successful, the final rules are recorded. If not, further optimization is performed until the adaptation is completed. Output the final version of the memory killing rule base to ensure the applicability of the rules in the memory backdoor detection scenario. The final generated rule base is used for memory state malicious code killing to ensure the ability to detect malicious code without file execution.

[0086] Figure 2 A flow chart of another automatic conversion test method for killing rules provided by an embodiment of the present disclosure is shown.

[0087] like Figure 2As shown, the electronic device can parse the target static file (such as ELF file), extract the ELF file header, program header table and segment table information, and obtain the offset, size, access rights and other characteristics of each segment data. Thus, the real file segment layout is obtained by parsing the file structure, but the file is not executed, ensuring that only memory state data is generated, avoiding dependencies, architecture compatibility and security risks during operation.

[0088] Furthermore, the electronic device can identify the architecture type (such as x86, ARM, MIPS, etc.) and byte order of the target static file, ensure that files of different architectures can be accurately parsed and converted, and perform differentiated processing on file data of different architectures to retain the file features specific to each architecture and adapt to multi-architecture environments. Use a cross-architecture compatible method to process the segment data of the ELF file to ensure that the conversion result is applicable to multiple architectures, thereby ensuring that all segment data are laid out in the memory image according to the architecture requirements, and keep the segment spacing, alignment and permission information consistent.

[0089] Furthermore, the electronic device can arrange the multiple segment data according to the memory state layout, for example, arranging the data of each loading segment in the ELF file according to the memory state layout, removing the file header and segment table information, and retaining only the actual data content to generate memory state data that conforms to the real loading state. Thus, the output memory data image contains the possible characteristics of the malicious code in the memory without the need for actual file execution, avoiding the execution complexity such as configuration dependence and command line parameters.

[0090] Furthermore, the electronic device can use a large model to identify the conditions in the static killing rules that depend on the file structure, for example, using a large model to analyze traditional file killing rules such as YARA, and identify the conditions in the rules that depend on the file structure, such as ELF file header features. Then remove the file header features, for example, automatically remove the most basic conditional restrictions that depend on the ELF header class, and generate the memory killing rules. In this way, the memory killing rules maintain the original rule content as much as possible while ensuring that they can be used for memory detection.

[0091] Furthermore, the electronic device can apply the modified memory killing rules to the generated image data, that is, use the memory state data image as the input of the YARA engine, test the matching effect of the modified rules without relying on the file structure, and do not need to involve file operation, avoiding operation dependency issues such as architecture compatibility and parameter configuration. And enable the YARA debug log to record detailed information during the matching detection process, including the matching status of each sub-rule, analyze the matching status of each sub-rule in the debug log, and obtain the corresponding matching results. If the matching result is an unsuccessful match, the electronic device can analyze the reasons for the unmatched and the corresponding sub-rules in the matching results, generate an analysis report of the unmatched conditions based on the matching results, and record the reasons for the mismatch and their corresponding rules. This facilitates subsequent optimization processing.

[0092] Furthermore, electronic devices can use large models to analyze and process the causes of mismatches and corresponding sub-rules, and make optimization suggestions based on the information in the mismatch report, such as providing new matching solutions or adjustment strategies for mismatch conditions by analyzing memory state characteristics. When generating optimization suggestions, refer to the standard conversion rules in the rule conversion policy library to ensure the applicability of the optimization solution in memory state detection. The policy library provides adaptation solutions from common file structures to memory features, so that rules can be automatically converted into matching conditions suitable for memory detection. The policy library can also be based on experience extraction of manual conversion that is not handled well by the large model.

[0093] Furthermore, the electronic device can perform a match detection process on the mirror data of the memory state data based on the optimized memory killing rule, that is, input the optimized memory killing rule into the YARA engine, and perform a match detection process on the mirror data of the memory state data to obtain the corresponding matching result. If the matching result is a successful match, the final rule optimization result is output; if the result is an unsuccessful match, the electronic device can continue to iteratively optimize the optimized memory killing rule until the matching result is a successful match or exceeds a preset number of iterations, that is, in the case of an unsuccessful match, continue to iterate and optimize through the large model until the matching result is a successful match or exceeds a preset number of iterations (such as 3 or 4 times). In the case where the matching result is a successful match, the electronic device can determine the final rule optimization result. When the preset number of iterations is exceeded, the user can analyze the unmatched report and manually modify the rules according to the memory state characteristics to adapt to memory detection, that is, in response to the user's manual adjustment operation, adjust the optimized memory killing rules, such as adjusting the rules by the user, manually adjusting the unmatched rules one by one, and optimizing the rule conditions with reference to the unmatched report and the adaptation suggestions in the policy library to ensure that the modified rules can adapt to the memory state characteristics and achieve accurate detection. Then, re-enter the adjusted rules into the YARA engine to test its detection effect in the memory state data. If the test is successful, the final rules are recorded. If not, further optimization is performed until the adaptation is completed. Output the final version of the memory killing rule base to ensure the applicability of the rules in the memory backdoor detection scenario. The final generated rule base is used for memory state malicious code killing to ensure the ability to detect malicious code without file execution.

[0094] Figure 3 A schematic diagram of the structure of an automatic conversion test device for killing rules provided by an embodiment of the present disclosure is shown.

[0095] like Figure 3 As shown, the automatic conversion test device 300 for checking and killing rules may include a first processing module 310 , a second processing module 320 , a third processing module 330 and a first determining module 340 .

[0096] The first processing module 310 can be used to parse and convert the target static file to obtain corresponding memory state data.

[0097] The second processing module 320 can be used to transform the static killing rules to obtain corresponding memory killing rules.

[0098] The third processing module 330 can be used to perform matching detection processing on the mirror data of the memory state data based on the memory killing rule to obtain a corresponding matching result.

[0099] The first determination module 340 may be configured to determine a final rule optimization result when the matching result is a successful match.

[0100] Therefore, in the disclosed embodiment, the target static file can be parsed and converted to obtain the corresponding memory state data, and then the static killing rules can be modified to obtain the corresponding memory killing rules, and then the mirror data of the memory state data can be matched and detected based on the memory killing rules to obtain the corresponding matching results, and finally, when the matching result is a successful match, the final rule optimization result is determined. Therefore, by not actually running the file, the static file is converted into memory state data, and the static killing rules are modified to obtain the memory killing rules, and the matching detection processing of the memory state data is realized, thereby utilizing the existing static killing rules to realize automated conversion testing, reduce costs, and improve detection efficiency.

[0101] In some embodiments of the present disclosure, the first processing module 310 may specifically include a first processing unit, a first identification unit and a data arrangement unit.

[0102] The first processing unit may be used to perform file parsing processing on the target static file to obtain a plurality of segment data.

[0103] The first identification unit may be used to identify the architecture type of the target static file, and perform cross-architecture compatibility on the plurality of segment data based on the architecture type.

[0104] The data arrangement unit may be used to arrange the plurality of segment data according to a memory state layout to generate the memory state data.

[0105] In some embodiments of the present disclosure, the second processing module 320 may specifically include a second identification unit and a rule generation unit.

[0106] The second identification unit can be used to use a large model to identify the conditions that depend on the file structure in the static killing rule to obtain corresponding file header features.

[0107] The rule generation unit can be used to remove the file header features and generate the memory killing rules.

[0108] In some embodiments of the present disclosure, the third processing module 330 may specifically include a second processing unit and a log recording unit.

[0109] The second processing unit may be configured to perform matching detection processing on the mirror data of the memory state data based on the memory killing rule.

[0110] The logging unit may be used to enable logging of the matching result during the matching detection process.

[0111] In some embodiments of the present disclosure, the automatic conversion testing device 300 for detecting and killing rules may further include a result analysis module.

[0112] The result analysis module can be used to analyze the reasons for the failure to match and the corresponding sub-rules in the matching result when the matching result is a failure to match.

[0113] In some embodiments of the present disclosure, the automatic conversion test device 300 for killing rules may further include a fourth processing module and a fifth processing module.

[0114] The fourth processing module can be used to use the large model to analyze and process the mismatch reasons and corresponding sub-rules to obtain corresponding optimization strategies.

[0115] The fifth processing module can be used to optimize the memory killing rule based on the optimization strategy to obtain the optimized memory killing rule.

[0116] In some embodiments of the present disclosure, the automatic conversion test device 300 for detecting and killing rules may further include a sixth processing module, an iterative optimization module, a second determination module, and a rule adjustment module.

[0117] The sixth processing module can be used to perform matching detection processing on the mirror data of the memory state data based on the optimized memory killing rule to obtain a corresponding matching result.

[0118] The iterative optimization module can be used to continue iteratively optimizing the optimized memory killing rule if the matching result is a failed match, until the matching result is a successful match or exceeds a preset number of iterations.

[0119] The second determination module can be used to determine the final rule optimization result when the matching result is a successful match.

[0120] The rule adjustment module can be used to adjust the optimized memory killing rule in response to a manual adjustment operation of a user when the number of iterations exceeds a preset number, until the matching result is a successful match.

[0121] It should be noted that Figure 3 The automatic conversion test device 300 of the killing rule shown can execute Figure 1 to Figure 2 The various steps in the method embodiment shown in the figure are implemented Figure 1 to Figure 2 The various processes and effects in the method embodiment shown are not described in detail here.

[0122] Figure 4 A schematic diagram of the structure of an automatic conversion test device for checking and killing rules provided by an embodiment of the present disclosure is shown.

[0123] In some embodiments of the present disclosure, Figure 4 The automatic conversion test device of the killing rule shown can be an electronic device. Specifically, the electronic device can include but is not limited to devices such as computer devices, cloud servers or cloud server clusters.

[0124] like Figure 4 As shown, the automatic conversion test device of the killing rule may include a processor 401 and a memory 402 storing computer program instructions.

[0125] Specifically, the processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0126] The memory 402 may include a large capacity memory for information or instructions. By way of example and not limitation, the memory 402 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive or a combination of two or more of these. Where appropriate, the memory 402 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 402 may be inside or outside the integrated gateway device. In a particular embodiment, the memory 402 is a non-volatile solid-state memory. In a particular embodiment, the memory 402 includes a read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (Electrically Erasable Programmable ROM, EEPROM), an electrically rewritable ROM (EAROM) or a flash memory, or a combination of two or more of these.

[0127] The processor 401 reads and executes the computer program instructions stored in the memory 402 to perform the steps of the automatic conversion test method of the killing rule provided in the embodiment of the present disclosure.

[0128] In one example, the automatic conversion test device of the killing rule may further include a transceiver 403 and a bus 404. Figure 4 As shown, the processor 401, the memory 402 and the transceiver 403 are connected via a bus 404 and communicate with each other.

[0129] The bus 404 includes hardware, software, or both. For example, but not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a Memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 404 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0130] The embodiment of the present disclosure also provides a computer-readable storage medium, which can store a computer program. When the computer program is executed by a processor, the processor implements the automatic conversion test method of the killing rule provided by the embodiment of the present disclosure.

[0131] The above-mentioned storage medium may, for example, include a memory 402 of computer program instructions, and the above-mentioned instructions may be executed by the processor 401 of the automatic conversion test device of the killing rule to complete the automatic conversion test method of the killing rule provided by the embodiment of the present disclosure. Optionally, the storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, a random access memory (Random Access Memory, RAM), a compact disc read-only memory (Compact Disc ROM, CD-ROM), a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0132] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0133] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for automatically converting killing rules, characterized in that: include: Parse and convert the target static file to obtain the corresponding memory state data; The static killing rules are modified to obtain the corresponding memory killing rules; Based on the memory killing rule, the mirror data of the memory state data is matched and detected to obtain a corresponding matching result; When the matching result is a successful match, a final rule optimization result is determined.

2. The method according to claim 1, characterized in that The target static file is parsed and converted to obtain corresponding memory state data, including: Performing file parsing processing on the target static file to obtain multiple segment data; Identify the architecture type of the target static file, and make the plurality of segment data cross-architecture compatible based on the architecture type; The plurality of segment data are arranged according to a memory state layout to generate the memory state data.

3. The method according to claim 1, characterized in that The static killing rules are modified to obtain corresponding memory killing rules, including: Use the large model to identify the conditions in the static killing rule that depend on the file structure, and obtain the corresponding file header features; The file header feature is removed to generate the memory killing rule.

4. The method according to claim 1, characterized in that: The matching detection process is performed on the mirror data of the memory state data based on the memory killing rule to obtain a corresponding matching result, including: Performing matching detection processing on the mirror data of the memory state data based on the memory killing rule; Enable logging of the matching results during the matching detection process.

5. The method according to claim 4, characterized in that The method further comprises: When the matching result is a failed match, the reasons for the failure to match and the corresponding sub-rules in the matching result are analyzed.

6. The method according to claim 1, characterized in that The method further comprises: Use the big model to analyze and process the mismatch reasons and corresponding sub-rules to obtain the corresponding optimization strategy; The memory killing rule is optimized based on the optimization strategy to obtain an optimized memory killing rule.

7. The method according to claim 6, characterized in that The method further comprises: Based on the optimized memory killing rule, the mirror data of the memory state data is matched and detected to obtain a corresponding matching result; If the matching result is a failed match, continue to iteratively optimize the optimized memory killing rule until the matching result is a successful match or exceeds a preset number of iterations; If the matching result is successful, determining a final rule optimization result; In the case where the preset number of iterations is exceeded, the optimized memory killing rule is adjusted in response to a manual adjustment operation by the user until the matching result is a successful match.

8. An automatic conversion test device for killing rules, characterized in that: include: The first processing module is used to parse and convert the target static file to obtain corresponding memory state data; The second processing module is used to transform the static killing rules to obtain corresponding memory killing rules; A third processing module is used to perform matching detection processing on the mirror data of the memory state data based on the memory killing rule to obtain a corresponding matching result; The first determination module is used to determine the final rule optimization result when the matching result is a successful match.

9. An automatic conversion test device for killing rules, characterized in that: include: processor; A memory for storing executable instructions; The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the automatic conversion test method of the killing rules described in any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the processor implements the automatic conversion test method of the killing rule described in any one of claims 1 to 7.

Images