Malicious behavior detection method and device, electronic equipment and storage medium

Abstract

The invention provides a malicious behavior detection method and device, electronic equipment and a storage medium, and the method comprises the steps: responding to the completion of receiving a target file, transferring and storing the received target file to an isolation environment, operating the target file in the isolation environment for security detection, marking and returning a detection result when a malicious behavior is detected, the target file is forbidden to be looked up when not authorized; according to the method, the sample file can be truly operated in the isolation environment, and the generated malicious behavior is marked and returned, so that a technician only pays attention to the dangerous behavior of the sample file and does not contact the privacy content contained in the sample, and compared with a traditional antivirus engine, the behavior of the file can be more comprehensively obtained, and the efficiency is improved. And the file does not need to be contacted, so that the privacy of the file is ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a malicious behavior detection method, device, electronic device and storage medium. Background Art

[0002] In the credit reporting business scenario, companies often receive sample files from multiple channels (such as data sources, financial institutions, and customer testing). These sample files contain a large amount of personal privacy information, such as personal identity information, credit records, transaction history, etc. This information is crucial for credit reporting business, but it also faces strict data protection and privacy compliance requirements.

[0003] Since these files may contain malicious code, such as viruses, Trojans, or ransomware, traditional security detection methods often require in-depth analysis and scanning of the file content. However, in the credit reporting business, due to the extremely high privacy of files, directly accessing the file content not only violates the principle of privacy protection, but may also cause legal risks and user trust crisis. Therefore, how to effectively detect and defend against malicious code in files without infringing on personal privacy has become a major challenge facing the credit reporting business. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a malicious behavior detection method, device, electronic device and storage medium, which can actually run sample files in an isolated environment, mark and return the generated malicious behaviors, so that technicians only focus on the dangerous behaviors of sample files without touching the private content contained in the samples. Compared with traditional antivirus engines, it can obtain the behavior of files more comprehensively and ensure the privacy of files without touching the files themselves.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a malicious behavior detection method, the method comprising:

[0007] In response to the completion of receiving the target file, the received target file is transferred and stored in an isolated environment; wherein the received target file comes from different data sources, the target file includes privacy information, and the target file is in a prohibited viewing state when it is not authorized;

[0008] The target file is run in the isolated environment to perform security detection on the target file, and when malicious behavior is detected, the malicious behavior and the malicious file that generates the malicious behavior are marked and the detection result is returned.

[0009] In a second aspect, an embodiment of the present application further provides a malicious behavior detection device, the device comprising:

[0010] A transfer module, configured to transfer and store the received target file in an isolated environment in response to completion of receiving the target file; wherein the received target file comes from different data sources, the target file includes privacy information, and the target file is in a prohibited access state when unauthorized;

[0011] The detection module is used to run the target file in the isolated environment to perform security detection on the target file, and when malicious behavior is detected, mark the malicious behavior and the malicious file that generates the malicious behavior and return the detection result.

[0012] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to execute the malicious behavior detection method described in any one of the first aspects.

[0013] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the malicious behavior detection method described in any one of the first aspects is executed.

[0014] The embodiments of the present application have the following beneficial effects:

[0015] (1) The embodiment of the present application avoids directly accessing the file content, thereby strictly following the privacy protection principle and reducing the legal risks and user trust crisis caused by the disclosure of personal privacy information. This not only helps to maintain the reputation and brand image of the enterprise, but also enhances the user's trust and satisfaction with the credit reporting service.

[0016] (2) Improve the detection rate of malicious code: By simulating the file's operating environment, this solution can monitor and analyze in real time the various behavioral characteristics generated by the file during execution, such as file read and write operations, network communication modes, resource consumption, etc. These behavioral characteristics provide an important basis for determining whether the file contains malicious behavior, thereby significantly improving the detection rate and accuracy of malicious code.

[0017] (3) Optimize the security detection process: Compared with traditional security detection methods, this solution does not require in-depth analysis and scanning of file content, thereby simplifying the security detection process and improving detection efficiency. This helps enterprises reduce security detection costs, increase business processing speed, and provide users with a more convenient and efficient service experience.

[0018] In summary, the embodiments of the present application have achieved remarkable beneficial effects in protecting personal privacy, improving malicious code detection rate, enhancing system security protection capabilities, and optimizing security detection processes, providing more reliable and efficient security guarantees for credit reporting services. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a flowchart of steps S101-S102 provided in an embodiment of the present application;

[0021] Figure 2 It is a flowchart of steps S201-S202 provided in an embodiment of the present application;

[0022] Figure 3 It is a flowchart of steps S301-S302 provided in an embodiment of the present application;

[0023] Figure 4 It is a flowchart of steps S401-S402 provided in an embodiment of the present application;

[0024] Figure 5 It is a flowchart of steps S501-S502 provided in an embodiment of the present application;

[0025] Figure 6 It is a flowchart of steps S601-S602 provided in an embodiment of the present application;

[0026] Figure 7 is a schematic diagram of the structure of a malicious behavior detection device provided in an embodiment of the present application;

[0027] Figure 8 It is a schematic diagram of the composition structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0028] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0029] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0030] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0031] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0032] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0034] See also Figure 1 , Figure 1is a flowchart of steps S101-S102 of the malicious behavior detection method provided in the embodiment of the present application, which will be combined with Figure 1 Steps S101-S102 are shown for explanation.

[0035] In step S101, in response to completion of receiving the target file, the received target file is transferred and stored in an isolated environment; wherein the received target file comes from different data sources, the target file includes privacy information, and the target file is in a prohibited viewing state when unauthorized.

[0036] Here, secure file transfer protocols (such as SFTP, HTTPS, etc.) are used to receive target files from different data sources. After receiving, security personnel store these target files in an isolated environment to ensure that they do not interact directly with other parts of the system, thereby preventing potential malicious behavior from damaging the system. The target files contain private information, so security personnel cannot access these files without authorization to protect privacy security.

[0037] In step S102, the target file is run in the isolated environment to perform security detection on the target file, and when malicious behavior is detected, the malicious behavior and the malicious file that generates the malicious behavior are marked and the detection result is returned.

[0038] Here, the target file is run in an isolated environment. This step is performed in a controlled and secure environment to reduce the impact of malicious behavior on the system. By running the target file, the system is able to monitor its behavior and detect whether there is any malicious behavior. Once malicious behavior is detected, the system will mark the behavior and the malicious files it generates. The system will also return the detection results, including specific information about the malicious behavior detected and which files are marked as malicious files.

[0039] In some embodiments, see Figure 2 , Figure 2 It is a flowchart of steps S201-S202 provided in an embodiment of the present application. The method also includes steps S201-S202, which will be described in combination with each step.

[0040] In step S201, the malicious file is located based on the detection result.

[0041] In step S202, the malicious file is isolated and / or deleted, and the malicious behavior is detected and processed to determine the impact level information of the malicious behavior, and a security policy for dealing with the malicious behavior is determined based on the impact level information.

[0042] Here, based on the detection results returned in the previous step, the system can accurately locate the files marked as malicious. The located malicious files are isolated to prevent them from continuing to spread within the system or performing malicious operations. Depending on the needs of the security policy, these malicious files can also be deleted to completely eliminate security risks.

[0043] Conduct in-depth analysis of detected malicious behaviors to determine their impact. This includes but is not limited to the occupation of system resources by malicious behaviors, the degree of damage to data, and the risk of privacy leakage. Based on the impact of malicious behaviors, the system can intelligently formulate security strategies to deal with the malicious behaviors. These strategies include strengthening the security protection measures of the system, restoring damaged data, and notifying affected users.

[0044] In some embodiments, see Figure 3 , Figure 3 It is a flowchart of steps S301-S302 provided in an embodiment of the present application. Storing the received target file in an isolated environment can be achieved through steps S301-S302, which will be explained in combination with each step.

[0045] In step S301, it is determined whether the target file is a file that has undergone the security check. If not, the file information of the target file is recorded, the file information is stored in a database, and the target file is submitted to the isolation environment.

[0046] In step S302, if yes, the security check is skipped; wherein the file information at least includes transmission protocol information, file directory, file hash, and upload time.

[0047] Here, the system will first check whether the received target file has been security checked. This check is implemented by querying the database or checking the metadata of the file. If the target file is received for the first time and has not been security checked, the system will record the detailed information of the file and store it in the database. The file information includes at least the transmission protocol information (such as SFTP, HTTPS, etc.), the directory where the file is located, the file hash value (used to uniquely identify the file), the upload time, etc.

[0048] The system will then submit the target file to an isolated environment for subsequent security testing. If the target file has already been tested and the test result is safe or the known malicious behavior has been processed, the system will skip further testing of the file. This can save system resources and improve detection efficiency.

[0049] In some embodiments, see Figure 4 , Figure 4It is a flowchart of steps S401-S402 provided in an embodiment of the present application. The method also includes steps S401-S402, which will be described in combination with each step.

[0050] In step S401, in response to a modification operation on a file that has undergone the security check, file information of the modified target file is determined.

[0051] In step S402, it is determined whether the file information of the modified target file is the same as that before the modification. If not, a security check is performed again on the modified target file.

[0052] Here, when the system receives a modification operation on a file that has been security checked (such as an update to the file content, a change to the file name, etc.), the system will respond to this operation. The system will re-acquire detailed information about the modified target file, including transfer protocol information (if applicable), the directory where the file is located, the file hash value (new), the upload time (or modification time), etc. The system will compare the modified file information with the file information before the modification, especially the file hash value, to determine whether the file has changed substantially. If key information such as the file hash value changes, it means that the file content or attributes have been modified and security checks need to be re-performed. For files that have changed, the system will resubmit them to the isolated environment and run the security check process. This step is similar to the detection process when the file is first received, and is intended to ensure that the modified file still meets security standards.

[0053] In some embodiments, the malicious file is located in the following manner:

[0054] Query the database for file information corresponding to the malicious file;

[0055] The malicious file is located based on file information corresponding to the malicious file.

[0056] Here, when the system detects malicious behavior and marks malicious files, it will store the relevant information of these malicious files (such as file hash values, file names, directories, etc.) in a database. When it is necessary to locate malicious files, the system will first access this database and query the corresponding file information based on the characteristics of the malicious files (such as hash values). After querying the file information of the malicious file, the system will use this information to locate the specific location of the malicious file in the storage system, including traversing the file system, calling the API of the cloud storage service, and other operations, depending on the file storage method and the system architecture.

[0057] In some embodiments, see Figure 5 , Figure 5It is a flow chart of steps S501-S502 provided in an embodiment of the present application. The isolation environment is a file sandbox, and the file sandbox includes multiple isolation areas. Each of the multiple isolation areas is used to store a target file of a file type. The method also includes steps S501-S502, which will be explained in combination with each step.

[0058] In step S501, the file type of the target file is determined.

[0059] In step S502, the target files belonging to the same file type are transferred and stored in the corresponding isolation area.

[0060] Here, the file sandbox is a safe and controlled environment for storing and processing potentially dangerous target files. It is similar to a virtual "sandpile" in which any malicious code running is confined to the sandpile and cannot escape to other parts of the system. The file sandbox is divided into multiple isolation areas, each of which is dedicated to storing and processing a specific type of file. For example, one isolation area may be dedicated to storing document files (such as PDF, Word documents, etc.), while another isolation area may be dedicated to storing executable files (such as EXE, DLL, etc.).

[0061] After receiving the target file, the system will first analyze the file's extension, content, or other features to determine its file type. This step is the prerequisite for subsequently storing the file in the corresponding quarantine area. Once the file type of the target file is determined, the system will transfer it to the corresponding quarantine area in the file sandbox. In this way, files of the same type will be stored together for easy management and security detection.

[0062] In some embodiments, see Figure 6 , Figure 6 It is a flow chart of steps S601-S602 provided in an embodiment of the present application. Running the target file in the isolated environment to perform security detection on the target file can be achieved through steps S601-S602, which will be explained in combination with each step.

[0063] In step S601, a static check is performed on the target file before running to determine whether there is malicious code in the target file.

[0064] In step S602, if the static detection result is abnormal, the corresponding detection result is returned; if the static detection result is normal, dynamic detection is performed, the target file is run in the isolated environment and behavior monitoring is performed, and compared with a preset security baseline or behavior pattern library to identify the malicious behavior; wherein the monitoring content includes at least one of file reading and writing operations, network communication behavior, inter-process communication, resource consumption, and system call sequence.

[0065] Here, before the target file is run, the system will first perform static detection on it. Static detection mainly checks the code structure, function calls, data flow, etc. of the target file to identify whether there are known malicious code features, malicious signatures, or suspicious programming patterns. If static analysis finds anomalies, such as the presence of malicious code or suspicious behavior, the system will immediately mark the file as a malicious file and take appropriate measures.

[0066] If the static analysis result shows no abnormalities, the system will perform dynamic detection, allow the target file to run in an isolated environment, and monitor its dynamic behavior. Dynamic behavior monitoring focuses on the actual behavior of the target file during operation, including file read and write operations, network communication behavior, inter-process communication, resource consumption (such as CPU, memory usage), system call sequence, etc. The system will compare the monitored behavior with the preset security baseline or behavior pattern library to identify whether there is malicious behavior. The security baseline may include normal file operation behavior, network communication rules, resource usage thresholds, etc.; the behavior pattern library may contain known malicious behavior patterns or attack methods.

[0067] In summary, the embodiments of the present application have the following beneficial effects:

[0068] (1) The embodiment of the present application avoids directly accessing the file content, thereby strictly following the privacy protection principle and reducing the legal risks and user trust crisis caused by the disclosure of personal privacy information. This not only helps to maintain the reputation and brand image of the enterprise, but also enhances the user's trust and satisfaction with the credit reporting service.

[0069] (2) Improve the detection rate of malicious code: By simulating the file's operating environment, this solution can monitor and analyze in real time the various behavioral characteristics generated by the file during execution, such as file read and write operations, network communication modes, resource consumption, etc. These behavioral characteristics provide an important basis for determining whether the file contains malicious behavior, thereby significantly improving the detection rate and accuracy of malicious code.

[0070] (3) Optimize the security detection process: Compared with traditional security detection methods, this solution does not require in-depth analysis and scanning of file content, thereby simplifying the security detection process and improving detection efficiency. This helps enterprises reduce security detection costs, increase business processing speed, and provide users with a more convenient and efficient service experience.

[0071] In summary, the embodiments of the present application have achieved remarkable beneficial effects in protecting personal privacy, improving malicious code detection rate, enhancing system security protection capabilities, and optimizing security detection processes, providing more reliable and efficient security guarantees for credit reporting services.

[0072] Based on the same inventive concept, the embodiments of the present application also provide a malicious behavior detection device corresponding to the malicious behavior detection method in the first embodiment. Since the principle of solving the problem by the device in the embodiments of the present application is similar to the above-mentioned malicious behavior detection method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0073] like Figure 7 As shown, Figure 7 : is a schematic diagram of the structure of a malicious behavior detection device 700 provided in an embodiment of the present application. The malicious behavior detection device 700 includes:

[0074] The transfer module 701 is used for transferring and storing the received target file in an isolated environment in response to the completion of receiving the target file; wherein the received target file comes from different data sources, the target file includes privacy information, and the target file is in a prohibited access state when it is not authorized;

[0075] The detection module 702 is used to run the target file in the isolated environment to perform security detection on the target file, and when malicious behavior is detected, mark the malicious behavior and the malicious file that generates the malicious behavior and return the detection result.

[0076] Those skilled in the art should understand that Figure 7 The implementation functions of each unit in the malicious behavior detection device 700 shown can be understood by referring to the relevant description of the aforementioned malicious behavior detection method. Figure 7 The functions of each unit in the malicious behavior detection device 700 shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0077] In a possible implementation, the detection module 702 further includes:

[0078] Locating the malicious file based on the detection result;

[0079] The malicious file is isolated and / or deleted, and the malicious behavior is detected and processed to determine the impact degree information of the malicious behavior, and a security policy for dealing with the malicious behavior is determined based on the impact degree information.

[0080] In a possible implementation, the receiving module 701 stores the received target file in an isolated environment, including:

[0081] Determine whether the target file is a file that has undergone the security check, and if not, record the file information of the target file, store the file information in a database, and submit the target file to the isolation environment;

[0082] If yes, skip the security check; wherein the file information at least includes transmission protocol information, file directory, file hash, and upload time.

[0083] In a possible implementation, the detection module 702 further includes:

[0084] In response to a modification operation on a file that has undergone the security check, determining file information of the modified target file;

[0085] Determine whether the file information of the modified target file is the same as that before modification; if not, re-perform security check on the modified target file.

[0086] In a possible implementation, the detection module 702 locates the malicious file in the following manner:

[0087] Query the database for file information corresponding to the malicious file;

[0088] The malicious file is located based on file information corresponding to the malicious file.

[0089] In a possible implementation, the isolation environment is a file sandbox, the file sandbox is a multi-level sandbox, each layer of the multi-level sandbox corresponds to a different isolation level, and the receiving module 701 further includes:

[0090] Determine the risk level of each data source for different data sources;

[0091] Based on the risk level of each data source, the received target file is stored in a sandbox layer corresponding to the risk level.

[0092] In a possible implementation, the detection module 702 runs the target file in the isolated environment to perform security detection on the target file, including:

[0093] Performing static analysis on the target file before running to determine whether there is malicious code in the target file;

[0094] If the static analysis result shows no abnormality, the target file is run in the isolated environment and behavior monitoring is performed, and compared with a preset security baseline or behavior pattern library to identify the malicious behavior; wherein the monitoring content includes at least one of file reading and writing operations, network communication behavior, inter-process communication, resource consumption, and system call sequence.

[0095] The above malicious behavior detection device has the following beneficial effects:

[0096] (1) The embodiment of the present application avoids directly accessing the file content, thereby strictly following the privacy protection principle and reducing the legal risks and user trust crisis caused by the disclosure of personal privacy information. This not only helps to maintain the reputation and brand image of the enterprise, but also enhances the user's trust and satisfaction with the credit reporting service.

[0097] (2) Improve the detection rate of malicious code: By simulating the file's operating environment, this solution can monitor and analyze in real time the various behavioral characteristics generated by the file during execution, such as file read and write operations, network communication modes, resource consumption, etc. These behavioral characteristics provide an important basis for determining whether the file contains malicious behavior, thereby significantly improving the detection rate and accuracy of malicious code.

[0098] (3) Optimize the security detection process: Compared with traditional security detection methods, this solution does not require in-depth analysis and scanning of file content, thereby simplifying the security detection process and improving detection efficiency. This helps enterprises reduce security detection costs, increase business processing speed, and provide users with a more convenient and efficient service experience.

[0099] In summary, the embodiments of the present application have achieved remarkable beneficial effects in protecting personal privacy, improving malicious code detection rate, enhancing system security protection capabilities, and optimizing security detection processes, providing more reliable and efficient security guarantees for credit reporting services.

[0100] like Figure 8 As shown, Figure 8 The present invention provides a schematic diagram of the structure of an electronic device 800 according to an embodiment of the present invention. The electronic device 800 includes:

[0101] A processor 801, a storage medium 802 and a bus 803, wherein the storage medium 802 stores machine-readable instructions executable by the processor 801. When the electronic device 800 is running, the processor 801 communicates with the storage medium 802 via the bus 803, and the processor 801 executes the machine-readable instructions to perform the steps of the malicious behavior detection method described in the embodiment of the present application.

[0102] In actual application, the components in the electronic device 800 are coupled together via bus 803. It is understood that bus 803 is used to realize the connection and communication between these components. Bus 803 includes not only a data bus, but also a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus 803.

[0103] The above electronic device has the following beneficial effects:

[0104] (1) The embodiment of the present application avoids directly accessing the file content, thereby strictly following the privacy protection principle and reducing the legal risks and user trust crisis caused by the disclosure of personal privacy information. This not only helps to maintain the reputation and brand image of the enterprise, but also enhances the user's trust and satisfaction with the credit reporting service.

[0105] (2) Improve the detection rate of malicious code: By simulating the file's operating environment, this solution can monitor and analyze in real time the various behavioral characteristics generated by the file during execution, such as file read and write operations, network communication modes, resource consumption, etc. These behavioral characteristics provide an important basis for determining whether the file contains malicious behavior, thereby significantly improving the detection rate and accuracy of malicious code.

[0106] (3) Optimize the security detection process: Compared with traditional security detection methods, this solution does not require in-depth analysis and scanning of file content, thereby simplifying the security detection process and improving detection efficiency. This helps enterprises reduce security detection costs, increase business processing speed, and provide users with a more convenient and efficient service experience.

[0107] In summary, the embodiments of the present application have achieved remarkable beneficial effects in protecting personal privacy, improving malicious code detection rate, enhancing system security protection capabilities, and optimizing security detection processes, providing more reliable and efficient security guarantees for credit reporting services.

[0108] The embodiment of the present application also provides a computer-readable storage medium, which stores executable instructions. When the executable instructions are executed by at least one processor 801, the malicious behavior detection method described in the embodiment of the present application is implemented.

[0109] In some embodiments, the storage medium can be a magnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface storage, an optical disk, or a compact disc read-only memory (CDROM); it can also be various devices including one or any combination of the above memories.

[0110] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0111] As an example, executable instructions may, but do not necessarily, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (for example, files storing one or more modules, subroutines, or code portions).

[0112] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0113] The computer-readable storage medium has the following advantages:

[0114] (1) The embodiment of the present application avoids directly accessing the file content, thereby strictly following the privacy protection principle and reducing the legal risks and user trust crisis caused by the disclosure of personal privacy information. This not only helps to maintain the reputation and brand image of the enterprise, but also enhances the user's trust and satisfaction with the credit reporting service.

[0115] (2) Improve the detection rate of malicious code: By simulating the file's operating environment, this solution can monitor and analyze in real time the various behavioral characteristics generated by the file during execution, such as file read and write operations, network communication modes, resource consumption, etc. These behavioral characteristics provide an important basis for determining whether the file contains malicious behavior, thereby significantly improving the detection rate and accuracy of malicious code.

[0116] (3) Optimize the security detection process: Compared with traditional security detection methods, this solution does not require in-depth analysis and scanning of file content, thereby simplifying the security detection process and improving detection efficiency. This helps enterprises reduce security detection costs, increase business processing speed, and provide users with a more convenient and efficient service experience.

[0117] In summary, the embodiments of the present application have achieved remarkable beneficial effects in protecting personal privacy, improving malicious code detection rate, enhancing system security protection capabilities, and optimizing security detection processes, providing more reliable and efficient security guarantees for credit reporting services.

[0118] In the several embodiments provided in the present application, it should be understood that the disclosed methods and electronic devices can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0119] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0120] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0121] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0122] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A malicious behavior detection method, characterized in that: The method comprises: In response to the completion of receiving the target file, the received target file is transferred and stored in an isolated environment; wherein the received target file comes from different data sources, the target file includes privacy information, and the target file is in a prohibited viewing state when it is not authorized; The target file is run in the isolated environment to perform security detection on the target file, and when malicious behavior is detected, the malicious behavior and the malicious file that generates the malicious behavior are marked and the detection result is returned.

2. The method according to claim 1, characterized in that: The method further comprises: Locating the malicious file based on the detection result; The malicious file is isolated and / or deleted, and the malicious behavior is detected and processed to determine the impact degree information of the malicious behavior, and a security policy for dealing with the malicious behavior is determined based on the impact degree information.

3. The method according to claim 1, characterized in that: The storing the received target file in an isolated environment includes: Determine whether the target file is a file that has undergone the security check, and if not, record the file information of the target file, store the file information in a database, and submit the target file to the isolation environment; If yes, skip the security check; wherein the file information at least includes transmission protocol information, file directory, file hash, and upload time.

4. The method according to claim 1, characterized in that The method further comprises: In response to a modification operation on a file that has undergone the security check, determining file information of the modified target file; Determine whether the file information of the modified target file is the same as that before modification; if not, re-perform security check on the modified target file.

5. The method according to claim 3, characterized in that: The malicious file is located in the following ways: Query the database for file information corresponding to the malicious file; The malicious file is located based on file information corresponding to the malicious file.

6. The method according to claim 1, characterized in that The isolation environment is a file sandbox, the file sandbox includes a plurality of isolation areas, each of the plurality of isolation areas is used to store a target file of a file type, and the method further includes: Determine the file type of the target file; The target files belonging to the same file type are transferred and stored in the corresponding isolation area.

7. The method according to claim 1, characterized in that The running the target file in the isolated environment to perform security detection on the target file includes: Performing static detection on the target file before running to determine whether there is malicious code in the target file; If the static detection result is abnormal, the corresponding detection result is returned; if the static detection result is normal, dynamic detection is performed, the target file is run in the isolated environment and behavior monitoring is performed, and compared with a preset security baseline or behavior pattern library to identify the malicious behavior; wherein the monitoring content includes at least one of file reading and writing operations, network communication behavior, inter-process communication, resource consumption, and system call sequence.

8. A malicious behavior detection device, characterized in that: The device comprises: A transfer module, configured to transfer and store the received target file in an isolated environment in response to completion of receiving the target file; wherein the received target file comes from different data sources, the target file includes privacy information, and the target file is in a prohibited access state when unauthorized; The detection module is used to run the target file in the isolated environment to perform security detection on the target file, and when malicious behavior is detected, mark the malicious behavior and the malicious file that generates the malicious behavior and return the detection result.

9. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the storage medium communicate through the bus, and the processor executes the machine-readable instructions to execute the malicious behavior detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the malicious behavior detection method according to any one of claims 1 to 7 is executed.

Images