Method, device and equipment for automatically converting test of kill rules and medium
By parsing and converting static files to generate memory-level data, and transforming static detection rules into memory detection rules, the problem of static file detection rules failing in memory detection scenarios is solved, achieving efficient detection of malicious code in memory.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA ELECTRONICS CLOUD DIGITAL INTELLIGENCE TECH CO LTD
- Filing Date
- 2024-12-11
- Publication Date
- 2026-05-12
AI Technical Summary
Traditional file scanning methods struggle to detect memory backdoors in memory detection scenarios, making it impossible for existing static file scanning rules to identify malicious programs loaded into memory.
By parsing and transforming the target static file, memory-level data is generated. The static detection rules are then modified to obtain memory detection rules. These memory detection rules are used to match and detect the memory-level data, generating the final optimized rule results.
This technology improves the efficiency of detecting memory-mode data and reduces detection costs without actually running the file, thus ensuring the effective identification of memory backdoors.
Smart Images
Figure CN119760706B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of malware detection and removal technology, and in particular to an automatic conversion testing method, apparatus, device, and medium for detection and removal rules. Background Technology
[0002] In the field of malware detection, file-based static scanning technology is very mature. For example, the YARA malware detection tool in the open-source community is widely used due to its flexible rule definition capabilities and powerful feature matching effects. Relying on the large open-source rule library of the YARA community, security personnel can quickly create and apply file scanning rules to match file characteristics and efficiently identify malicious programs.
[0003] However, with the evolution of modern memory backdoor technology, traditional file scanning methods have gradually revealed their inadequacies in memory detection scenarios. At the same time, memory backdoor execution technology has also developed rapidly, allowing any traditional malware to be directly transformed into a memory backdoor without modification. Typical tools such as libreflect and ulexecve can easily bypass file system dependencies, directly loading ELF files into memory and executing them. These tools enable malware to run in memory, thus avoiding files being written to disk, greatly improving the ability to evade file detection. As a result, even if static file scanning rules like Yara can detect the corresponding static files, they become completely undetectable after being processed by these tools and loaded into memory. Summary of the Invention
[0004] To address the aforementioned technical issues, this disclosure provides an automatic conversion testing method, apparatus, equipment, and medium for detection and removal rules.
[0005] Firstly, this disclosure provides an automatic conversion testing method for detection rules, including:
[0006] The target static file is parsed and converted to obtain the corresponding memory-state data;
[0007] The static detection rules were modified to obtain the corresponding memory detection rules;
[0008] Based on the memory detection rules, the mirror data of the memory-state data is matched and detected to obtain the corresponding matching results;
[0009] If the matching result is successful, the final rule optimization result is determined.
[0010] Secondly, this disclosure provides an automatic conversion testing device for detection rules, including:
[0011] The first processing module is used to parse and transform the target static file to obtain the corresponding memory-state data;
[0012] The second processing module is used to modify the static scanning rules to obtain the corresponding memory scanning rules;
[0013] The third processing module is used to perform matching and detection processing on the mirror data of the memory state data based on the memory detection rules, and obtain the corresponding matching results.
[0014] The first determining module is used to determine the final rule optimization result when the matching result is a successful match.
[0015] Thirdly, this disclosure provides an automatic conversion testing device for detection rules, including:
[0016] processor;
[0017] Memory, used to store executable instructions;
[0018] The processor is used to read executable instructions from memory and execute the executable instructions to implement the automatic conversion test method of the first aspect of the detection rules.
[0019] Fourthly, this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to implement the automatic conversion test method for the detection rules of the first aspect.
[0020] The technical solution provided in this disclosure has the following advantages compared with the prior art:
[0021] The automatic conversion testing method, apparatus, device, and medium for detection rules disclosed in this embodiment can parse and convert target static files to obtain corresponding memory-state data. Then, the static detection rules are modified to obtain corresponding memory detection rules. Next, the mirror data of the memory-state data is matched and detected based on the memory detection rules to obtain corresponding matching results. Finally, if the matching result is successful, the final rule optimization result is determined. Therefore, by converting static files into memory-state data without actually running the file and modifying the static detection rules to obtain memory detection rules, matching and detection of memory-state data is achieved. This utilizes existing static detection rules to achieve automated conversion testing, reducing costs and improving detection efficiency. Attached Figure Description
[0022] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.
[0023] Figure 1 A flowchart illustrating an automatic conversion testing method for detection rules provided in this embodiment of the disclosure;
[0024] Figure 2 A flowchart illustrating another automatic conversion testing method for detection rules provided in this embodiment of the present disclosure;
[0025] Figure 3 A schematic diagram of an automatic switching test device for detection rules provided in this embodiment of the present disclosure;
[0026] Figure 4 This is a schematic diagram of the structure of an automatic switching test device for detection rules provided in an embodiment of this disclosure. Detailed Implementation
[0027] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.
[0028] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.
[0029] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.
[0030] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.
[0031] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".
[0032] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.
[0033] To address the aforementioned problems, this disclosure provides an automatic conversion testing method, apparatus, device, and medium for detecting and eliminating malware. The following is in conjunction with… Figures 1 to 2 The automatic conversion testing method for detection rules provided in the embodiments of this disclosure will be described in detail.
[0034] Figure 1 The diagram shows a flowchart of an automatic conversion testing method for detection rules provided in an embodiment of this disclosure.
[0035] In this embodiment of the disclosure, the automatic conversion test method for the detection rule can be executed by an electronic device. The electronic device may include, but is not limited to, devices such as computer equipment, cloud servers, or cloud server clusters.
[0036] like Figure 1 As shown, the automatic conversion test method for this detection rule can include the following steps.
[0037] S110. Parse and convert the target static file to obtain the corresponding memory-state data.
[0038] In this embodiment of the disclosure, the electronic device can parse and convert the target static file to obtain the corresponding memory-state data.
[0039] Alternatively, the target static file can be an unprocessed file stored on the server, such as an ELF file.
[0040] Optionally, the memory-state data can be data with the data format after the file is loaded into memory.
[0041] Specifically, electronic devices can parse and transform target static files to obtain memory-state data with the data structure after the file is loaded into memory, that is, without actually running the file, the actual memory data structure can be obtained.
[0042] S120. Modify the static scanning rules to obtain the corresponding memory scanning rules.
[0043] In this embodiment of the disclosure, the electronic device can modify the static scanning rules to obtain corresponding memory scanning rules.
[0044] Optionally, static detection rules can be rules designed for static files to match file characteristics and efficiently identify malicious programs. For example, YARA rules.
[0045] Optionally, memory scanning rules can be rules for identifying malicious programs that run on files loaded into memory.
[0046] Specifically, electronic devices can modify static scanning rules, such as modifying YARA rules, to obtain memory scanning rules.
[0047] S130. Based on the memory detection rules, perform matching and detection processing on the mirror data of the memory state data to obtain the corresponding matching results.
[0048] In this embodiment of the disclosure, the electronic device can perform matching detection processing on the mirror data of the memory state data based on the memory detection rules to obtain the corresponding matching results.
[0049] Specifically, electronic devices can obtain mirror data of memory-state data, and then apply memory detection rules to the mirror data of memory-state data, that is, perform matching detection processing on the mirror data of memory-state data to obtain the corresponding matching results.
[0050] S140. If the matching result is a successful match, determine the final rule optimization result.
[0051] In this embodiment of the disclosure, if the matching result is a successful match, the electronic device can determine the final rule optimization result.
[0052] Therefore, in this embodiment, the target static file can be parsed and converted to obtain corresponding memory-state data. Then, the static detection rules are modified to obtain corresponding memory detection rules. Next, based on the memory detection rules, the mirror data of the memory-state data is matched and detected to obtain corresponding matching results. Finally, if the matching result is successful, the final rule optimization result is determined. Thus, by converting static files into memory-state data without actually running the file and modifying the static detection rules to obtain memory detection rules, matching and detection of memory-state data is achieved. This utilizes existing static detection rules to achieve automated conversion testing, reducing costs and improving detection efficiency.
[0053] Optionally, S110 may specifically include: performing file parsing processing on the target static file to obtain multiple segment data; identifying the architecture type of the target static file and performing cross-architecture compatibility on the multiple segment data based on the architecture type; arranging the multiple segment data according to the memory-state layout to generate the memory-state data.
[0054] In this embodiment of the disclosure, the electronic device can perform file parsing processing on the target static file to obtain multiple segment data.
[0055] Specifically, electronic devices can parse target static files (such as ELF files), extract ELF file headers, program header tables, and segment tables, and obtain characteristics such as the offset, size, and access permissions of each segment. This allows them to obtain the actual file segment layout by parsing the file structure, but without executing the file, ensuring that only memory-level data is generated, thus avoiding runtime dependencies, architectural compatibility issues, and security risks.
[0056] Furthermore, the electronic device can identify the architecture type of the target static file and perform cross-architecture compatibility on the multiple segment data based on the architecture type.
[0057] Specifically, the electronic device can identify the architecture type (such as x86, ARM, MIPS, etc.) and byte order of the target static file, ensuring that files of different architectures can be accurately parsed and converted. Differential processing is applied to file data for different architectures to preserve architecture-specific file characteristics and adapt to multi-architecture environments. A cross-architecture compatible method is used to process the segment data of the ELF file, ensuring that the conversion results are applicable to multiple architectures. This ensures that all segment data is laid out in the memory image according to architecture requirements, maintaining consistency in segment spacing, alignment, and permission information.
[0058] Furthermore, the electronic device can arrange the multiple segments of data according to the memory-state layout to generate the memory-state data.
[0059] Specifically, the electronic device can arrange the multiple segment data according to a memory-state layout. For example, the data of each loaded segment in the ELF file can be arranged according to the memory-state layout, removing the file header and segment table information, and retaining only the actual data content to generate memory-state data that conforms to the actual loading state. The resulting memory data image contains the possible characteristics of malicious code in memory without requiring actual file execution, thus avoiding execution complexities such as configuration dependencies and command-line parameters.
[0060] Optionally, S120 may specifically include: using a large model to identify conditions in the static detection rules that depend on file structure, and obtaining corresponding file header features; removing the file header features, and generating the memory detection rules.
[0061] In this embodiment of the disclosure, the electronic device can use a large model to identify the conditions in the static detection rules that depend on the file structure, and obtain the corresponding file header features.
[0062] Specifically, electronic devices can use large models to identify conditions in the static detection rules that depend on file structure. For example, large models can be used to analyze traditional file detection rules such as YARA to identify conditions in the rules that depend on file structure, such as ELF file header features.
[0063] Furthermore, the electronic device can remove the file header features to generate the memory scanning rules.
[0064] Specifically, the electronic device can remove the file header features, such as automatically removing the most basic conditional restrictions that depend on ELF header classes, to generate the memory detection rules. Thus, the memory detection rules retain as much of the original rule content as possible while ensuring they can be used for memory detection.
[0065] Optionally, S130 may specifically include: performing matching detection processing on the mirror data of the memory state data based on the memory detection rules; and enabling logging to record the matching results during the matching detection process.
[0066] In this embodiment of the disclosure, the electronic device can perform matching detection processing on the mirror data of the memory state data based on the memory detection rules.
[0067] For example, electronic devices can apply the modified memory detection rules to the generated image data, that is, use the memory-state data image as input to the YARA engine, test the matching effect of the modified rules without relying on the file structure, without involving file execution, and avoid runtime dependency issues such as architecture compatibility and parameter configuration.
[0068] Furthermore, the electronic device can enable logging of the matching results during the matching detection process.
[0069] For example, enabling YARA debug logging records detailed information during the matching detection process, including the matching status of each sub-rule. Analyzing the matching situation of each sub-rule in the debug log yields the corresponding matching results.
[0070] Optionally, the automatic conversion test method for the detection rule may further include: if the matching result is unsuccessful, analyzing the reasons for the unmatched result and the corresponding sub-rules.
[0071] In this embodiment of the disclosure, when the matching result is unsuccessful, the electronic device can analyze the reasons for the unmatch and the corresponding sub-rules in the matching result.
[0072] Specifically, after obtaining the matching result, if the matching result is unsuccessful, the electronic device can analyze the reasons for the mismatch and the corresponding sub-rules in the matching result, generate an analysis report of the mismatch conditions based on the matching result, and record the reasons for the mismatch and the corresponding rules. This facilitates subsequent optimization processing.
[0073] Optionally, the automatic conversion testing method for the detection rule may further include: using a large model to analyze and process the reasons for non-matching and the corresponding sub-rules to obtain the corresponding optimization strategy; and optimizing the memory detection rule based on the optimization strategy to obtain the optimized memory detection rule.
[0074] In this embodiment of the disclosure, the electronic device can use a large model to analyze and process the reasons for non-matching and the corresponding sub-rules to obtain the corresponding optimization strategy.
[0075] Specifically, electronic devices can use large models to analyze and process the reasons for mismatches and corresponding sub-rules, and propose optimization suggestions based on information from the mismatch report. For example, by analyzing memory state characteristics, new matching schemes or adjustment strategies can be provided for mismatch conditions. When generating optimization suggestions, standard transformation rules in the rule transformation strategy library are referenced to ensure the applicability of the optimization scheme in memory state detection. The strategy library provides adaptation schemes from common file structures to memory features, enabling rules to be automatically transformed into matching conditions suitable for memory detection. The strategy library can also extract experience from manual transformations that the large model has not processed well.
[0076] Furthermore, the electronic device can optimize the memory scanning rules based on the optimization strategy to obtain optimized memory scanning rules.
[0077] Optionally, the automatic conversion testing method for the detection rule may further include: performing matching detection processing on the mirror data of the memory-state data based on the optimized memory detection rule to obtain the corresponding matching result; if the matching result is unsuccessful, continuing to iteratively optimize the optimized memory detection rule until the matching result is successful or exceeds a preset number of iterations; if the matching result is successful, determining the final rule optimization result; if the preset number of iterations is exceeded, adjusting the optimized memory detection rule in response to the user's manual adjustment operation until the matching result is successful.
[0078] In this embodiment of the disclosure, the electronic device can perform matching detection processing on the mirror data of the memory state data based on the optimized memory detection rules to obtain the corresponding matching results.
[0079] Specifically, the electronic device can perform matching and detection processing on the mirror data of the memory state data based on the optimized memory detection rules. That is, the optimized memory detection rules are input into the YARA engine, and matching and detection processing is performed on the mirror data of the memory state data to obtain the corresponding matching results.
[0080] Furthermore, if the matching result is unsuccessful, the electronic device can continue to iteratively optimize the optimized memory detection rules until the matching result is successful or the preset number of iterations is exceeded.
[0081] Specifically, after the matching detection process, if the matching result is successful, the final rule optimization result is output; if the result is unsuccessful, the electronic device can continue to iteratively optimize the optimized memory killing rule until the matching result is successful or exceeds the preset number of iterations. That is, in the case of unsuccessful matching, iterative optimization is continued through a large model until the matching result is successful or exceeds the preset number of iterations (such as 3 or 4 times).
[0082] In some embodiments, if the matching result is a successful match, the electronic device can determine the final rule optimization result.
[0083] In other embodiments, if the preset number of iterations is exceeded, the electronic device may adjust the optimized memory detection rules in response to the user's manual adjustment operation until the matching result is a successful match.
[0084] Specifically, when the preset number of iterations is exceeded, the user can analyze the unmatched reports and manually modify the rules based on memory state characteristics to adapt to memory detection. That is, in response to the user's manual adjustment operation, the optimized memory detection rules are adjusted. For example, the user adjusts the rules one by one, manually adjusting the unmatched rules, and optimizing the rule conditions by referring to the unmatched reports and the adaptation suggestions in the policy library to ensure that the modified rules can adapt to memory state characteristics and achieve accurate detection.
[0085] Next, the adjusted rules are re-input into the YARA engine to test their detection performance in memory-based data. If the test is successful, the final rules are recorded; otherwise, further optimization is performed until adaptation is complete. The final version of the memory detection rule library is output to ensure the applicability of the rules in memory backdoor detection scenarios. The final generated rule library is used for memory-based malicious code detection, ensuring the ability to detect malicious code in situations where no file execution is required.
[0086] Figure 2 A flowchart illustrating another automatic conversion testing method for detection rules provided in this embodiment is shown.
[0087] like Figure 2As shown, electronic devices can parse target static files (such as ELF files), extract ELF file headers, program header tables, and segment tables, and obtain characteristics such as the offset, size, and access permissions of each segment. This allows them to obtain the actual file segment layout by parsing the file structure, but without executing the file, ensuring that only memory-level data is generated, thus avoiding runtime dependencies, architectural compatibility issues, and security risks.
[0088] Furthermore, the electronic device can identify the architecture type (such as x86, ARM, MIPS, etc.) and byte order of the target static file, ensuring that files of different architectures can be accurately parsed and converted. Differential processing is applied to file data for different architectures to preserve architecture-specific file characteristics and adapt to multi-architecture environments. A cross-architecture compatible method is used to process the segment data of the ELF file, ensuring that the conversion results are applicable to multiple architectures. This ensures that all segment data is laid out in the memory image according to architecture requirements, maintaining consistency in segment spacing, alignment, and permission information.
[0089] Furthermore, the electronic device can arrange the multiple segment data according to a memory-state layout. For example, the data of each loaded segment in the ELF file can be arranged according to a memory-state layout, removing the file header and segment table information, and retaining only the actual data content to generate memory-state data that conforms to the actual loading state. The resulting memory data image contains the possible characteristics of malicious code in memory without requiring actual file execution, thus avoiding execution complexities such as configuration dependencies and command-line parameters.
[0090] Furthermore, electronic devices can use large models to identify conditions in the static detection rules that depend on file structures. For example, large models can be used to analyze traditional file detection rules such as YARA to identify conditions in the rules that depend on file structures, such as ELF file header features. Then, these file header features are removed; for example, the most basic conditional restrictions dependent on ELF header classes are automatically removed to generate the memory detection rules. Thus, the memory detection rules retain as much of the original rule content as possible while ensuring they can be used for memory detection.
[0091] Furthermore, the electronic device can apply the modified memory detection rules to the generated image data. This means using the memory-state data image as input to the YARA engine, testing the matching effect of the modified rules without relying on file structure. This avoids runtime dependencies such as architecture compatibility and parameter configuration issues by eliminating the need for file execution. YARA debug logging is enabled to record detailed information during the matching detection process, including the matching status of each sub-rule. Analyzing the matching situation of each sub-rule in the debug log yields the corresponding matching result. If the matching result is unsuccessful, the electronic device can analyze the reasons for the mismatch and the corresponding sub-rules, generating an analysis report of the mismatch conditions based on the matching results, recording the reasons for the mismatch and the corresponding rules. This facilitates subsequent optimization.
[0092] Furthermore, electronic devices can use large models to analyze and process the reasons for mismatches and corresponding sub-rules, and propose optimization suggestions based on information from the mismatch report. For example, by analyzing memory state characteristics, new matching schemes or adjustment strategies can be provided for mismatch conditions. When generating optimization suggestions, standard conversion rules in the rule conversion strategy library are referenced to ensure the applicability of the optimization scheme in memory state detection. The strategy library provides adaptation schemes from common file structures to memory features, enabling rules to be automatically converted into matching conditions suitable for memory detection. The strategy library can also extract experience from manual conversions that are not well processed by large models.
[0093] Furthermore, the electronic device can perform matching detection processing on the mirror data of the memory-state data based on the optimized memory detection rules. That is, the optimized memory detection rules are input into the YARA engine, and matching detection processing is performed on the mirror data of the memory-state data to obtain the corresponding matching results. If the matching result is successful, the final rule optimization result is output; if the result is unsuccessful, the electronic device can continue to iteratively optimize the optimized memory detection rules until the matching result is successful or exceeds a preset number of iterations. In other words, if the matching is unsuccessful, iterative optimization continues using a large model until the matching result is successful or exceeds a preset number of iterations (e.g., 3 or 4 times). If the matching result is successful, the electronic device can determine the final rule optimization result. When the preset number of iterations is exceeded, users can analyze the unmatched reports and manually modify the rules based on memory-state characteristics to adapt to memory detection. This means that in response to user adjustments, the optimized memory detection rules are adjusted. For example, users manually adjust each unmatched rule, referring to the unmatched reports and adaptation suggestions in the policy library to optimize rule conditions, ensuring that the modified rules can adapt to memory-state characteristics and achieve accurate detection. Next, the adjusted rules are re-input into the YARA engine to test their detection effect in memory-state data. If the test is successful, the final rule is recorded; otherwise, further optimization is performed until adaptation is complete. The final version of the memory detection rule library is output, ensuring the applicability of the rules in memory backdoor detection scenarios. The final generated rule library is used for memory-state malicious code detection, ensuring malicious code detection capabilities even without file execution.
[0094] Figure 3 A schematic diagram of an automatic switching test device for detection rules provided in an embodiment of this disclosure is shown.
[0095] like Figure 3 As shown, the automatic conversion testing device 300 for detecting and killing rules may include a first processing module 310, a second processing module 320, a third processing module 330, and a first determination module 340.
[0096] The first processing module 310 can be used to parse and convert the target static file to obtain the corresponding memory-state data.
[0097] The second processing module 320 can be used to modify static detection rules to obtain corresponding memory detection rules.
[0098] The third processing module 330 can be used to perform matching and detection processing on the mirror data of the memory state data based on the memory detection rules, and obtain the corresponding matching results.
[0099] The first determining module 340 can be used to determine the final rule optimization result when the matching result is a successful match.
[0100] Therefore, in this embodiment, the target static file can be parsed and converted to obtain corresponding memory-state data. Then, the static detection rules are modified to obtain corresponding memory detection rules. Next, based on the memory detection rules, the mirror data of the memory-state data is matched and detected to obtain corresponding matching results. Finally, if the matching result is successful, the final rule optimization result is determined. Thus, by converting static files into memory-state data without actually running the file and modifying the static detection rules to obtain memory detection rules, matching and detection of memory-state data is achieved. This utilizes existing static detection rules to achieve automated conversion testing, reducing costs and improving detection efficiency.
[0101] In some embodiments of this disclosure, the first processing module 310 may specifically include a first processing unit, a first identification unit, and a data arrangement unit.
[0102] The first processing unit can be used to perform file parsing processing on the target static file to obtain multiple segment data.
[0103] The first identification unit can be used to identify the architecture type of the target static file and perform cross-architecture compatibility of the multiple segment data based on the architecture type.
[0104] This data arrangement unit can be used to arrange the multiple segments of data according to the memory state layout to generate the memory state data.
[0105] In some embodiments of this disclosure, the second processing module 320 may specifically include a second identification unit and a rule generation unit.
[0106] The second identification unit can be used to identify the conditions in the static detection rules that depend on the file structure using a large model, and obtain the corresponding file header features.
[0107] The rule generation unit can be used to remove the file header features and generate the memory detection rules.
[0108] In some embodiments of this disclosure, the third processing module 330 may specifically include a second processing unit and a log recording unit.
[0109] The second processing unit can be used to perform matching and detection processing on the mirror data of the memory state data based on the memory detection rules.
[0110] This logging unit can be used to enable logging of the matching results during the matching detection process.
[0111] In some embodiments of this disclosure, the automatic conversion testing device 300 for detecting and eliminating rules may further include a result analysis module.
[0112] This result analysis module can be used to analyze the reasons for the unmatched result and the corresponding sub-rules when the matching result is unsuccessful.
[0113] In some embodiments of this disclosure, the automatic conversion testing device 300 for detecting and eliminating rules may further include a fourth processing module and a fifth processing module.
[0114] This fourth processing module can be used to analyze and process the reasons for non-matching and the corresponding sub-rules using a large model, and obtain the corresponding optimization strategy.
[0115] The fifth processing module can be used to optimize the memory scanning rules based on the optimization strategy to obtain optimized memory scanning rules.
[0116] In some embodiments of this disclosure, the automatic conversion testing device 300 for detecting and eliminating rules may further include a sixth processing module, an iterative optimization module, a second determination module, and a rule adjustment module.
[0117] The sixth processing module can be used to perform matching and detection processing on the mirror data of the memory state data based on the optimized memory detection rules, and obtain the corresponding matching results.
[0118] This iterative optimization module can be used to continue iteratively optimizing the optimized memory detection rules if the matching result is unsuccessful, until the matching result is successful or the preset number of iterations is exceeded.
[0119] The second determining module can be used to determine the final rule optimization result when the matching result is a successful match.
[0120] This rule adjustment module can be used to adjust the optimized memory detection rules in response to user manual adjustment operations when the preset number of iterations is exceeded, until the matching result is a successful match.
[0121] It should be noted that, Figure 3 The automatic conversion test device 300 for the shown detection rules can execute... Figures 1 to 2 The various steps in the method embodiment shown are implemented. Figures 1 to 2 The processes and effects in the method embodiments shown are not described in detail here.
[0122] Figure 4 A schematic diagram of the structure of an automatic switching test device for detection rules provided in an embodiment of this disclosure is shown.
[0123] In some embodiments of this disclosure, Figure 4 The automatic conversion test device for the detection rules shown can be an electronic device. Specifically, electronic devices can include, but are not limited to, devices such as computer equipment, cloud servers, or cloud server clusters.
[0124] like Figure 4 As shown, the automatic conversion test device for the detection and removal rules may include a processor 401 and a memory 402 storing computer program instructions.
[0125] Specifically, the processor 401 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.
[0126] Memory 402 may include a large-capacity storage for information or instructions. For example, and not limitingly, memory 402 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 402 may include removable or non-removable (or fixed) media. Where appropriate, memory 402 may be internal or external to the integrated gateway device. In a particular embodiment, memory 402 is a non-volatile solid-state memory. In a particular embodiment, memory 402 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (Electrically Programmable ROM, EPROM), an electrically erasable programmable PROM (EEPROM), an electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these.
[0127] The processor 401 reads and executes computer program instructions stored in the memory 402 to perform the steps of the automatic conversion test method for detection rules provided in this embodiment of the disclosure.
[0128] In one example, the automatic switching test device for the detection rule may also include a transceiver 403 and a bus 404. For example, Figure 4 As shown, the processor 401, memory 402 and transceiver 403 are connected via bus 404 and communicate with each other.
[0129] Bus 404 includes hardware, software, or both. For example, and not limitingly, a bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 404 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.
[0130] This disclosure also provides a computer-readable storage medium that can store a computer program. When the computer program is executed by a processor, the processor enables the processor to implement the automatic conversion testing method for detection rules provided in this disclosure.
[0131] The aforementioned storage medium may include, for example, a memory 402 containing computer program instructions, which can be executed by the processor 401 of the automatic conversion testing device for detection rules to complete the automatic conversion testing method for detection rules provided in this embodiment. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), compact disc ROM (CD-ROM), magnetic tape, floppy disk, and optical data storage device.
[0132] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.
[0133] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. An automatic conversion testing method for detection rules, characterized in that, include: The target static file is parsed and converted to obtain the corresponding memory-state data; The static detection rules were modified to obtain the corresponding memory detection rules; Based on the memory detection rules, the mirror data of the memory-state data is matched and detected to obtain the corresponding matching results; If the matching result is successful, the final rule optimization result is determined; The step of parsing and converting the target static file to obtain the corresponding memory-state data includes: The target static file is parsed to obtain multiple segment data. Identify the architecture type of the target static file, and perform cross-architecture compatibility on the multiple segment data based on the architecture type; The multiple segments of data are arranged according to the memory-state layout to generate the memory-state data; The modification of static detection rules to obtain corresponding memory detection rules includes: The large model is used to identify the conditions in the static detection rules that depend on the file structure, and the corresponding file header features are obtained. Remove the file header features to generate the memory detection rules; The method further includes: The large model is used to analyze and process the reasons for non-matching and the corresponding sub-rules to obtain the corresponding optimization strategies; The memory scanning rules are optimized based on the optimization strategy to obtain optimized memory scanning rules; The method further includes: Based on the optimized memory detection rules, the mirror data of the memory state data is matched and detected to obtain the corresponding matching results; If the matching result is unsuccessful, the optimized memory detection rule continues to be iteratively optimized until the matching result is successful or the preset number of iterations is exceeded. If the matching result is successful, the final rule optimization result is determined; If the preset number of iterations is exceeded, the optimized memory detection rules are adjusted in response to the user's manual adjustment operation until the matching result is a successful match.
2. The method according to claim 1, characterized in that, The process of matching and detecting the mirrored data of the memory-state data based on the memory detection rules to obtain the corresponding matching results includes: Based on the memory detection rules, the mirror data of the memory-state data is matched and detected; Enable logging of the matching results during the matching detection process.
3. The method according to claim 2, characterized in that, The method further includes: If the matching result is unsuccessful, analyze the reasons for the non-match and the corresponding sub-rules in the matching result.
4. An automatic conversion testing device for detection rules, characterized in that, include: The first processing module is used to parse and transform the target static file to obtain the corresponding memory-state data; The second processing module is used to modify the static scanning rules to obtain the corresponding memory scanning rules; The third processing module is used to perform matching and detection processing on the mirror data of the memory state data based on the memory detection rules, and obtain the corresponding matching results. The first determining module is used to determine the final rule optimization result when the matching result is a successful match; The first processing module includes: The first processing unit is used to perform file parsing processing on the target static file to obtain multiple segment data; The first identification unit is used to identify the architecture type of the target static file and perform cross-architecture compatibility on the multiple segment data based on the architecture type; A data arrangement unit is used to arrange the multiple segments of data according to the memory state layout to generate the memory state data; The second processing module includes: The second identification unit is used to use a large model to identify the conditions in the static detection rules that depend on the file structure, and to obtain the corresponding file header features. The rule generation unit is used to remove the file header features and generate the memory scanning rules. The device further includes: The fourth processing module is used to analyze and process the reasons for non-matching and the corresponding sub-rules using the large model, and obtain the corresponding optimization strategy; The fifth processing module is used to optimize the memory scanning rules based on the optimization strategy to obtain optimized memory scanning rules. The device further includes: The sixth processing module is used to perform matching and detection processing on the mirror data of the memory state data based on the optimized memory detection rules, and obtain the corresponding matching results; The iterative optimization module is used to continue iteratively optimizing the optimized memory detection rule if the matching result is unsuccessful, until the matching result is successful or the preset number of iterations is exceeded. The second determining module is used to determine the final rule optimization result when the matching result is a successful match; The rule adjustment module is used to adjust the optimized memory detection rules in response to the user's manual adjustment operation when the preset number of iterations is exceeded, until the matching result is a successful match.
5. An automatic conversion testing device for detection rules, characterized in that, include: processor; Memory, used to store executable instructions; The processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the automatic conversion test method for detection rules as described in any one of claims 1-3.
6. A non-volatile computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, causes the processor to implement the automatic conversion test method for the detection rules as described in any one of claims 1-3.