Malicious file detection method and device, electronic equipment and storage medium
By creating incremental file system snapshots in the container and marking suspicious files, we automatically detect malicious files in the container, solving the problem of slow response speed of traditional detection methods, and achieving the effect of rapid detection and prevention of malicious file attacks.
Patent Information
- Application Number
- CN202411829817.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-04-18
AI Technical Summary
Traditional malicious file detection methods require manual operation, resulting in slow response speed, inability to detect malicious files in time, and are prone to malicious file attacks.
When monitoring abnormal behavior in the container, create an incremental file system snapshot of the container, record files that have changed compared to the mirror layer, determine the file change type and path of the file, mark the file with the preset change type as a suspicious file, determine the threat level based on the file content, and perform malicious file detection.
It realizes that when abnormal behaviors occur in containers, it automatically performs malicious file detection without human operation, greatly improving the response speed and promptly discovering malicious files, effectively avoiding the risk of attack caused by untimely discovering malicious files.
Smart Images
Figure CN119848845A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the field of computer security technology, and in particular to a method, device, electronic device and storage medium for detecting malicious files. Background Art
[0002] Malicious files range from the simplest computer worms and Trojans to the most complex computer viruses. They can appear on desktop computers, laptops, and mobile devices. Depending on the operating system used by the device (Windows, Android, iOS, or Apple MacOS), malicious files may also attack in different ways.
[0003] Traditional malicious file detection methods include signature identification, heuristic detection, digital signature, virtual machine technology, etc. However, traditional malicious file detection methods all require manual operation, resulting in slow response speed and failure to detect malicious files in time, making it easy to be attacked by malicious files. Summary of the invention
[0004] In view of this, in order to effectively alleviate the technical problem that traditional malicious file detection methods require manual operation, resulting in slow response speed and failure to detect malicious files in time, and are easily attacked by malicious files, the embodiments of the present invention provide a method, device, electronic device and storage medium for malicious file detection.
[0005] In a first aspect, an embodiment of the present invention provides a method for detecting malicious files, the method comprising:
[0006] When abnormal behavior in the container is monitored, an incremental file system snapshot of the container is created; wherein the incremental file system snapshot is used to record the files that have changed in the container compared to the image layer;
[0007] Determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file;
[0008] For each suspicious file: obtain the file content based on the change path of the suspicious file, and determine the threat level of the suspicious file based on the file content;
[0009] Malicious file detection based on the threat level of each suspicious file.
[0010] In a possible implementation, marking the change type and change path of each file in the incremental file system snapshot includes:
[0011] Get the previous incremental file system snapshot;
[0012] By comparing the previous incremental file system snapshot with the incremental file system snapshot, the change type and change path of each file in the incremental file system snapshot are determined; wherein the change type is addition, modification or deletion.
[0013] In a possible implementation, marking a file whose change type is a preset change type as a suspicious file includes:
[0014] Mark files with the change type of new or modified as suspicious files.
[0015] In a possible implementation, determining the threat level of a suspicious file according to the file content includes:
[0016] Determine the threat score of suspicious files based on the file content;
[0017] Determine the threat level of suspicious files based on the threat score.
[0018] In one possible implementation, determining a threat score of a suspicious file based on the file content includes:
[0019] Determine the file hash value of the suspicious file based on the file content;
[0020] Compare the file hash value with the hash value in the threat intelligence library;
[0021] If the comparison is successful, the preset score is determined as the threat score of the suspicious file;
[0022] If the comparison fails, run the file in a sandbox environment based on the file content to obtain preset running behavior characteristics;
[0023] Querying a feature score matching a preset operation behavior feature from a feature score query library; wherein the feature score query library stores a correspondence between the preset operation behavior feature and the feature score;
[0024] Determines the threat score of the suspicious file based on the signature score.
[0025] In a possible implementation, determining the threat level of a suspicious file according to the threat score includes:
[0026] The threat level corresponding to the threat score is queried from the threat level query library; wherein the threat level query library stores the corresponding relationship between the threat score and the threat level.
[0027] In a possible implementation, malicious file detection is performed based on the threat level of each suspicious file, including:
[0028] For each suspicious file: determining whether the threat level of the suspicious file is a first preset threat level;
[0029] In the case where the threat level of the suspicious file is determined to be a first preset threat level, detecting the suspicious file as a malicious file;
[0030] When it is determined that the threat level of the suspicious file is not the first preset threat level, the suspicious file is detected as not being a malicious file.
[0031] In one possible implementation, the method further includes:
[0032] Get container information of the container;
[0033] Generate forensic reports based on incremental file system snapshots, threat levels of individual files, malicious file detection results, and container information.
[0034] In one possible implementation, the method further includes:
[0035] When it is detected that the threat level of the suspicious file is a first preset threat level, a first abnormal response operation is generated to suspend or isolate the container;
[0036] When the threat level of the monitored suspicious file is a second preset threat level, a second abnormal response operation is generated to restrict network access or send an alarm message.
[0037] In a second aspect, an embodiment of the present invention provides a device for detecting malicious files, the device comprising:
[0038] A creation module is used to create an incremental file system snapshot of the container when abnormal behavior in the container is monitored; wherein the incremental file system snapshot is used to record files that have changed in the container compared to the image layer;
[0039] A marking module, used to determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file;
[0040] A determination module is used for obtaining the file content based on the change path of each suspicious file and determining the threat level of the suspicious file according to the file content;
[0041] The detection module is used to detect malicious files based on the threat level of each suspicious file.
[0042] In a third aspect, an embodiment of the present invention provides an electronic device, which includes: a processor and a memory, the processor is used to execute a malicious file detection program stored in the memory to implement the above-mentioned malicious file detection method.
[0043] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned method for malicious file detection.
[0044] The method, device, electronic device and storage medium for malicious file detection provided by the embodiments of the present invention include: when abnormal behavior in the container is monitored, creating an incremental file system snapshot of the container; wherein the incremental file system snapshot is used to record files that have changed in the container compared to the image layer; determining the change type and change path of each file in the incremental file system snapshot, and marking the files with a preset change type as suspicious files; for each suspicious file: obtaining the file content based on the change path of the suspicious file, and determining the threat level of the suspicious file based on the file content; and performing malicious file detection based on the threat level of each suspicious file. The above technical solution automatically detects malicious files when abnormal behavior occurs in the container, without the need for manual operation, which greatly improves the response speed and timely detects malicious files, and effectively avoids the technical problem of being easily attacked by malicious files due to the failure to timely discover malicious files. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] Figure 1 A flowchart of an embodiment of a method for detecting malicious files provided by an embodiment of the present invention;
[0046] Figure 2 A flowchart of another method for detecting malicious files provided by an embodiment of the present invention;
[0047] Figure 3 A flowchart of another method for detecting malicious files provided by an embodiment of the present invention;
[0048] Figure 4 A block diagram of an embodiment of a malicious file detection device provided by an embodiment of the present invention;
[0049] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0051] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.
[0052] An embodiment of the present invention provides a method for detecting malicious files. The method is implemented by a malicious file detection system deployed on each container.
[0053] See also Figure 1 , Figure 1 A flowchart of an embodiment of a method for detecting malicious files provided in an embodiment of the present invention. Figure 1 The process shown may include the following steps:
[0054] Step 101, when abnormal behavior in the container is monitored, create an incremental file system snapshot of the container;
[0055] In specific implementation, the trigger conditions for abnormal behavior can be pre-configured in the container. For example, trigger conditions can be set on behaviors such as process startup, file access, network connection, etc. (such as traffic surge, system call abnormality, appearance of unknown files, etc.). When the behavioral data in the container reaches the trigger condition and abnormal behavior is monitored in the container, an incremental file system snapshot of the container is created.
[0056] Among them, the incremental file system snapshot is used to record the files that have changed in the container compared to the image layer; the incremental file system snapshot can be understood as a file list. For example, the content of the created incremental file system snapshot includes: / etc / added-file.conf; / etc / updated-file.conf; / var / log / old-log.log.
[0057] Among them, the incremental file system snapshot can be created using docker cp (Docker copy command), Docker API (Docker application program interface) or containerd API (containerd application program interface), and the specific creation process is not described in detail.
[0058] Step 102, determining the change type and change path of each file in the incremental file system snapshot, and marking the file whose change type is a preset change type as a suspicious file;
[0059] Specifically, the change type and change path of each file in the incremental file system snapshot can be determined by snapshot comparison. Specifically, the previous incremental file system snapshot is obtained; by comparing the previous incremental file system snapshot with the incremental file system snapshot, the change type and change path of each file in the incremental file system snapshot are determined; wherein the change type is addition, modification or deletion.
[0060] The previous incremental file system snapshot can be understood as the incremental file system snapshot of the container created when the abnormal behavior in the container was monitored last time. Specifically, you can use professional comparison tools, such as the "Compare Documents" function of Foxit Advanced PDF (Portable Document Format) Editor, or file comparison software such as Beyond Compare, to compare the two snapshots to determine the change type and change path of each file compared with the previous one.
[0061] The above-mentioned preset change type is addition or modification, that is, the file with the change type of the preset change type is marked as a suspicious file, specifically, the file with the change type of addition or modification is marked as a suspicious file. In actual application, only the modified or added files are likely to be malicious files. Therefore, all modified or added files in the incremental file system snapshot are marked as suspicious files for subsequent malicious file detection; and deleted files do not have attack capabilities, so the deleted files are not marked as suspicious files for subsequent malicious file detection.
[0062] Step 103, for each suspicious file: obtaining the file content based on the change path of the suspicious file, and determining the threat level of the suspicious file according to the file content;
[0063] The specific process of obtaining file content through a changing path can be: using the File class of Java (Java programming language) to create a File object according to the changing path; calling the exists method of the File object to confirm whether the file exists; using the FileReader (file reader) and BufferedReader (cached reader) classes to read the file content line by line; processing each line of content read, such as printing, storing or parsing; capturing and processing possible IOException (input and output exception) to ensure program robustness; through the above steps, file content can be safely and effectively obtained from the changing path to determine the threat level of subsequent suspicious files.
[0064] The threat level is a quantitative indicator used to measure the possibility that a suspicious file is a malicious file. It can be understood that a higher threat level indicates a greater possibility that the suspicious file is a malicious file, and vice versa, a lower threat level indicates a lower possibility that the suspicious file is a malicious file.
[0065] Step 104: Perform malicious file detection based on the threat level of each suspicious file.
[0066] Since the threat level can accurately measure whether a suspicious file is a malicious file, malicious files can be accurately detected according to the threat level of each suspicious file.
[0067] Through the method in this embodiment, when abnormal behavior in the container is monitored, an incremental file system snapshot of the container is created; wherein the incremental file system snapshot is used to record the files that have changed in the container compared to the image layer; the change type and change path of each file in the incremental file system snapshot are determined, and the files with the change type of the preset change type are marked as suspicious files; for each suspicious file: the file content is obtained based on the change path of the suspicious file, and the threat level of the suspicious file is determined according to the file content; malicious file detection is performed based on the threat level of each suspicious file. The above technical solution automatically detects malicious files when abnormal behavior occurs in the container, without the need for manual operation, which greatly improves the response speed and timely detects malicious files, and effectively avoids the technical problem of being easily attacked by malicious files due to the failure to timely discover malicious files.
[0068] like Figure 2 As shown, as an optional implementation, as in the above method, step 103 of determining the threat level of the suspicious file according to the file content includes the following steps:
[0069] Step 201, determining a threat score of a suspicious file based on the file content;
[0070] The threat score is a specific numerical indicator used to measure the possibility that a suspicious file is a malicious file. It can be understood that a larger threat score indicates a greater possibility that the suspicious file is a malicious file, and vice versa, a smaller threat score indicates a smaller possibility that the suspicious file is a malicious file. It can be seen that the threat score is directly related to the threat level. Therefore, after determining the threat score, the threat level of the suspicious file can be determined. The above step 201 can be specifically implemented through steps A1 to A6:
[0071] Step A1, determining a file hash value of a suspicious file based on the file content;
[0072] The calculation process of the file hash value is as follows: select a suitable hash algorithm according to the needs, such as MD5 (Message-Digest Algorithm 5), SHA (Secure Hash Algorithm)-1, SHA-256, etc., read the file content into the memory, or read it block by block to process large files, use the hash algorithm to process the file content, and obtain the file hash value.
[0073] Step A2, comparing the file hash value with the hash value in the threat intelligence library;
[0074] The threat intelligence library stores hash values corresponding to various malicious files. The file hash value is compared with each hash value in the threat intelligence library. If the file hash value is consistent with a hash value in the threat intelligence library, that is, if the comparison is successful, execute step A3; if the file hash value is inconsistent with each hash value in the threat intelligence library, that is, if the comparison is unsuccessful, execute step A4.
[0075] Step A3, determining the preset score as the threat score of the suspicious file;
[0076] If the comparison is successful, it means that the suspicious file is very likely to be a malicious file, so the threat score of the suspicious file is directly set to a high preset score, such as 10 points, wherein the preset score can be set according to actual needs and is not limited here.
[0077] Step A4, running in a sandbox environment based on the file content to obtain preset running behavior characteristics;
[0078] If the comparison is unsuccessful, it is necessary to further determine whether the suspicious file is a malicious file. Therefore, the file content of the suspicious file is run in a sandbox environment to obtain the preset operating behavior characteristics during the operation process, where the preset operating behavior characteristics are malicious behavior characteristics, such as unconventional communications, modification / deletion of key files, attempts to obtain root permissions, triggered behaviors involving sensitive objects (such as system key files), encryption, compression, obfuscation of codes and other preset operating behavior characteristics.
[0079] When the above preset running behavior characteristics are present in the running file content, they are obtained for subsequent threat score determination.
[0080] Step A5, querying a feature score matching a preset running behavior feature from a feature score query library;
[0081] Among them, the feature score query library stores the correspondence between the preset operation behavior features and the feature scores; for ease of understanding, the feature score query library is shown in Table 1:
[0082] Table 1
[0083] Preset operating behavior characteristics Feature score Try connecting to an unknown external IP 2 Modify / etc / passwd 3 Try to get root privileges 2 Encrypted part of the code 1
[0084] It should be noted that the correspondence between the preset operating behavior characteristics and the characteristic scores listed above is only an example, and the specific correspondence between the preset operating behavior characteristics and the characteristic scores can be set according to actual needs and is not limited here.
[0085] For example, the preset operation behavior features obtained are unconventional communication 1 and attempt to obtain root permissions. Then, by querying Table 1, it can be known that the feature score corresponding to modifying / etc / passwd is 3, and the feature score corresponding to attempting to obtain root permissions is 2.
[0086] Step A6: determining the threat score of the suspicious file based on the feature score.
[0087] Specifically, each feature score is added together to determine the threat score of the suspicious file. Continuing with the previous example, the feature score corresponding to modifying / etc / passwd is 3, and the feature score corresponding to attempting to obtain root permissions is 2, so the threat score of the suspicious file is 3+2=5.
[0088] Step 202: Determine the threat level of the suspicious file according to the threat score.
[0089] In one implementation, the threat level corresponding to the threat score is queried from a threat level query library; wherein the threat level query library stores a correspondence between the threat score and the threat level.
[0090] For ease of understanding, the threat level query library is shown in Table 2:
[0091] Table 1
[0092] Threat score Threat Level 1-3 Low threat level 4-6 Medium Threat Level 7-15 High Threat Level
[0093] Among them, a low threat level indicates that the suspicious file may have false positives or slight risks, a medium threat level indicates that the suspicious file has potential harm but has not shown a clear attack, and a high threat level indicates that the suspicious file is a known or obvious malicious sample. It should be noted that the correspondence between the preset operation behavior characteristics and the characteristic scores listed above is only an example. The specific correspondence between the preset operation behavior characteristics and the characteristic scores can be set according to actual needs and is not limited here.
[0094] If the threat score is 8, then by querying Table 2, it can be known that the threat level of the suspicious file is a high threat level; if the threat score is 5, then by querying Table 2, it can be known that the threat level of the suspicious file is a medium threat level; if the threat score is 0, it indicates that there is no problem with the suspicious file.
[0095] like Figure 3 As shown, as an optional implementation, as in the above method, step 104 of performing malicious file detection based on the threat level of each suspicious file includes the following steps:
[0096] Step 301, for each suspicious file: determining whether the threat level of the suspicious file is a first preset threat level;
[0097] The first preset threat level is a threat level indicating that the suspicious file is a malicious file, such as the high threat level mentioned above, that is, it is determined whether the threat level of the suspicious file is a high threat level.
[0098] Step 302, when it is determined that the threat level of the suspicious file is a first preset threat level, detecting the suspicious file as a malicious file;
[0099] That is, when the threat level of the suspicious file is a high threat level, the suspicious file is detected as an aggressive malicious file.
[0100] Step 303: If it is determined that the threat level of the suspicious file is not the first preset threat level, detect that the suspicious file is not a malicious file.
[0101] That is, when the threat level of the suspicious file is not a high threat level, the suspicious file is detected as a non-aggressive malicious file, that is, a normal file.
[0102] In actual application, in order to facilitate subsequent tracking and analysis, the container information of the container can be obtained; a forensic report can be generated based on the incremental file system snapshot, the threat level of each file, the malicious file detection results and the container information. The above container information is the unique identification information that identifies the container, such as the container ID (IDentity, identity identification number), and the generated forensic report is formal evidence in JSON (JavaScript Object Notation) or PDF format. The above forensic report can be recorded in the log of the malicious file detection system for further review and response by the security team.
[0103] Furthermore, in order to ensure network security, when the threat level of the suspicious file detected is a first preset threat level, a first exception response operation can be generated to suspend or isolate the container; when the threat level of the suspicious file detected is a second preset threat level, a second exception response operation can be generated to restrict network access or send an alarm message.
[0104] The specific second preset threat level is a threat level indicating that the suspicious file is not a malicious file but may have false positives or minor risks or have potential harm but do not manifest as a clear attack, such as the medium threat level or low threat level mentioned above. Then, when the threat level of the suspicious file is a high threat level, the malicious file detection system can perform the first abnormal response operation of automatically pausing or isolating the container to prevent the further spread of maliciousness; when the threat level of the suspicious file is a medium threat level or a low threat level, the second abnormal response operation of restricting network access or sending an alarm message is performed, and the isolation / restriction status can be recorded in the log of the malicious file detection system to ensure subsequent traceability.
[0105] See also Figure 4 , is a block diagram of an embodiment of a malicious file detection device provided by an embodiment of the present invention. Figure 4 As shown, the device comprises:
[0106] A creation module 401 is used to create an incremental file system snapshot of the container when abnormal behavior in the container is monitored; wherein the incremental file system snapshot is used to record files that have changed in the container compared to the image layer;
[0107] The marking module 402 is used to determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file;
[0108] The determination module 403 is used for obtaining the file content based on the change path of the suspicious file for each suspicious file, and determining the threat level of the suspicious file according to the file content;
[0109] The detection module 404 is used to detect malicious files based on the threat level of each suspicious file.
[0110] The malicious file detection device provided by the embodiment of the present invention includes: when abnormal behavior in the container is monitored, creating an incremental file system snapshot of the container; wherein the incremental file system snapshot is used to record the files that have changed in the container compared to the image layer; determining the change type and change path of each file in the incremental file system snapshot, and marking the files with a preset change type as suspicious files; for each suspicious file: obtaining the file content based on the change path of the suspicious file, and determining the threat level of the suspicious file based on the file content; and performing malicious file detection based on the threat level of each suspicious file. The above technical solution automatically detects malicious files when abnormal behavior occurs in the container, without the need for manual operation, which greatly improves the response speed and timely detects malicious files, and effectively avoids the technical problem of being easily attacked by malicious files due to the failure to timely discover malicious files.
[0111] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, Figure 5 The electronic device 1200 shown includes: at least one processor 1201, a memory 1202, at least one network interface 1204 and other user interfaces 1203. The various components in the electronic device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Figure 5 Various buses are labeled as bus system 1205.
[0112] The user interface 1203 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).
[0113] It can be understood that the memory 1202 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 1202 described herein is intended to include, but is not limited to, these and any other suitable types of memory.
[0114] In some embodiments, the memory 1202 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 12021 and an application program 12022 .
[0115] The operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 12022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 12022.
[0116] In the embodiment of the present invention, by calling the program or instruction stored in the memory 1202, specifically, the program or instruction stored in the application 12022, the processor 1201 is used to execute the method steps provided by each method embodiment, for example, including:
[0117] When abnormal behavior in the container is monitored, an incremental file system snapshot of the container is created; wherein the incremental file system snapshot is used to record the files that have changed in the container compared to the image layer;
[0118] Determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file;
[0119] For each suspicious file: obtain the file content based on the change path of the suspicious file, and determine the threat level of the suspicious file based on the file content;
[0120] Malicious file detection based on the threat level of each suspicious file.
[0121] In a possible implementation, marking the change type and change path of each file in the incremental file system snapshot includes:
[0122] Get the previous incremental file system snapshot;
[0123] By comparing the previous incremental file system snapshot with the incremental file system snapshot, the change type and change path of each file in the incremental file system snapshot are determined; wherein the change type is addition, modification or deletion.
[0124] In a possible implementation, marking a file whose change type is a preset change type as a suspicious file includes:
[0125] Mark files with the change type of new or modified as suspicious files.
[0126] In a possible implementation, determining the threat level of a suspicious file according to the file content includes:
[0127] Determine the threat score of suspicious files based on the file content;
[0128] Determine the threat level of suspicious files based on the threat score.
[0129] In one possible implementation, determining a threat score of a suspicious file based on the file content includes:
[0130] Determine the file hash value of the suspicious file based on the file content;
[0131] Compare the file hash value with the hash value in the threat intelligence library;
[0132] If the comparison is successful, the preset score is determined as the threat score of the suspicious file;
[0133] If the comparison fails, run the file in a sandbox environment based on the file content to obtain preset running behavior characteristics;
[0134] Querying a feature score matching a preset operation behavior feature from a feature score query library; wherein the feature score query library stores a correspondence between the preset operation behavior feature and the feature score;
[0135] Determines the threat score of the suspicious file based on the signature score.
[0136] In a possible implementation, determining the threat level of a suspicious file according to the threat score includes:
[0137] The threat level corresponding to the threat score is queried from the threat level query library; wherein the threat level query library stores the corresponding relationship between the threat score and the threat level.
[0138] In a possible implementation, malicious file detection is performed based on the threat level of each suspicious file, including:
[0139] For each suspicious file: determining whether the threat level of the suspicious file is a first preset threat level;
[0140] In the case where the threat level of the suspicious file is determined to be a first preset threat level, detecting the suspicious file as a malicious file;
[0141] When it is determined that the threat level of the suspicious file is not the first preset threat level, the suspicious file is detected as not being a malicious file.
[0142] In one possible implementation, the method further includes:
[0143] Get container information of the container;
[0144] Generate forensic reports based on incremental file system snapshots, threat levels of individual files, malicious file detection results, and container information.
[0145] In one possible implementation, the method further includes:
[0146] When it is detected that the threat level of the suspicious file is a first preset threat level, a first abnormal response operation is generated to suspend or isolate the container;
[0147] When the threat level of the monitored suspicious file is a second preset threat level, a second abnormal response operation is generated to restrict network access or send an alarm message.
[0148] The method disclosed in the above embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above processor 1201 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the above method in combination with its hardware.
[0149] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.
[0150] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.
[0151] The electronic device provided in this embodiment may be Figure 5 The electronic device shown in FIG. 1 may perform the following steps: Figure 1-3 All steps of the malicious file detection method in Figure 1-3 For details, please refer to the technical effect of the malicious file detection method shown in Figure 1-3 For the sake of brevity, the relevant description is not repeated here.
[0152] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.
[0153] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned method of malicious file detection can be implemented.
[0154] The processor is used to execute a malicious file detection program stored in the memory to implement the following steps of the malicious file detection method:
[0155] When abnormal behavior in the container is monitored, an incremental file system snapshot of the container is created; wherein the incremental file system snapshot is used to record the files that have changed in the container compared to the image layer;
[0156] Determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file;
[0157] For each suspicious file: obtain the file content based on the change path of the suspicious file, and determine the threat level of the suspicious file based on the file content;
[0158] Malicious file detection based on the threat level of each suspicious file.
[0159] In a possible implementation, marking the change type and change path of each file in the incremental file system snapshot includes:
[0160] Get the previous incremental file system snapshot;
[0161] By comparing the previous incremental file system snapshot with the incremental file system snapshot, the change type and change path of each file in the incremental file system snapshot are determined; wherein the change type is addition, modification or deletion.
[0162] In a possible implementation, marking a file whose change type is a preset change type as a suspicious file includes:
[0163] Mark files with the change type of new or modified as suspicious files.
[0164] In a possible implementation, determining the threat level of a suspicious file according to the file content includes:
[0165] Determine the threat score of suspicious files based on the file content;
[0166] Determine the threat level of suspicious files based on the threat score.
[0167] In one possible implementation, determining a threat score of a suspicious file based on the file content includes:
[0168] Determine the file hash value of the suspicious file based on the file content;
[0169] Compare the file hash value with the hash value in the threat intelligence library;
[0170] If the comparison is successful, the preset score is determined as the threat score of the suspicious file;
[0171] If the comparison fails, run the file in a sandbox environment based on the file content to obtain preset running behavior characteristics;
[0172] Querying a feature score matching a preset operation behavior feature from a feature score query library; wherein the feature score query library stores a correspondence between the preset operation behavior feature and the feature score;
[0173] Determines the threat score of the suspicious file based on the signature score.
[0174] In a possible implementation, determining the threat level of a suspicious file according to the threat score includes:
[0175] The threat level corresponding to the threat score is queried from the threat level query library; wherein the threat level query library stores the corresponding relationship between the threat score and the threat level.
[0176] In a possible implementation, malicious file detection is performed based on the threat level of each suspicious file, including:
[0177] For each suspicious file: determining whether the threat level of the suspicious file is a first preset threat level;
[0178] In the case where the threat level of the suspicious file is determined to be a first preset threat level, detecting the suspicious file as a malicious file;
[0179] When it is determined that the threat level of the suspicious file is not the first preset threat level, the suspicious file is detected as not being a malicious file.
[0180] In one possible implementation, the method further includes:
[0181] Get container information of the container;
[0182] Generate forensic reports based on incremental file system snapshots, threat levels of individual files, malicious file detection results, and container information.
[0183] In one possible implementation, the method further includes:
[0184] When it is detected that the threat level of the suspicious file is a first preset threat level, a first abnormal response operation is generated to suspend or isolate the container;
[0185] When the threat level of the monitored suspicious file is a second preset threat level, a second abnormal response operation is generated to restrict network access or send an alarm message.
[0186] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0187] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0188] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for detecting malicious files, characterized in that: The method comprises: When abnormal behavior in the container is monitored, an incremental file system snapshot of the container is created; wherein the incremental file system snapshot is used to record files that have changed in the container compared to the image layer; Determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file; For each of the suspicious files: obtaining the file content based on the change path of the suspicious file, and determining the threat level of the suspicious file according to the file content; Malicious file detection is performed based on the threat level of each of the suspicious files.
2. The method according to claim 1, characterized in that The marking of the change type and the change path of each file in the incremental file system snapshot includes: Get the previous incremental file system snapshot; By comparing the previous incremental file system snapshot with the incremental file system snapshot, the change type and change path of each file in the incremental file system snapshot are determined; wherein the change type is addition, modification or deletion.
3. The method according to claim 2, characterized in that The step of marking the file whose change type is a preset change type as a suspicious file includes: The files whose change types are new or modified are marked as suspicious files.
4. The method according to claim 1, characterized in that: Determining the threat level of the suspicious file according to the file content includes: Determining a threat score of the suspicious file based on the file content; The threat level of the suspicious file is determined according to the threat score.
5. The method according to claim 4, characterized in that The determining the threat score of the suspicious file based on the file content includes: Determining a file hash value of the suspicious file based on the file content; Compare the hash value of the file with the hash value in the threat intelligence library; If the comparison is successful, the preset score is determined as the threat score of the suspicious file; If the comparison is unsuccessful, running the file in a sandbox environment based on the file content to obtain preset running behavior characteristics; Querying a feature score matching the preset operation behavior feature from a feature score query library; wherein the feature score query library stores a correspondence between the preset operation behavior feature and the feature score; A threat score of the suspicious file is determined based on the feature score.
6. The method according to claim 4, characterized in that Determining the threat level of the suspicious file according to the threat score includes: The threat level corresponding to the threat score is queried from a threat level query library; wherein the threat level query library stores a correspondence between threat scores and threat levels.
7. The method according to claim 1, characterized in that The malicious file detection based on the threat level of each of the suspicious files includes: For each of the suspicious files: determining whether the threat level of the suspicious file is a first preset threat level; In the case where it is determined that the threat level of the suspicious file is the first preset threat level, detecting the suspicious file as a malicious file; When it is determined that the threat level of the suspicious file is not the first preset threat level, the suspicious file is detected as not being a malicious file.
8. The method according to claim 1, characterized in that The method further comprises: Obtaining container information of the container; A forensic report is generated based on the incremental file system snapshot, the threat level of each of the files, the malicious file detection result and the container information.
9. The method according to claim 7, characterized in that: The method further comprises: When it is detected that the threat level of the suspicious file is the first preset threat level, generating a first abnormal response operation to suspend or isolate the container; When it is detected that the threat level of the suspicious file is a second preset threat level, a second abnormal response operation is generated to restrict network access or send an alarm message.
10. A device for detecting malicious files, characterized in that: The device comprises: A creation module, used to create an incremental file system snapshot of the container when abnormal behavior in the container is monitored; wherein the incremental file system snapshot is used to record files of the container that have changed compared to the image layer; a marking module, used to determine the change type and change path of each file in the incremental file system snapshot, and mark the file whose change type is a preset change type as a suspicious file; A determination module is used for: for each suspicious file: obtaining the file content based on the change path of the suspicious file, and determining the threat level of the suspicious file according to the file content; The detection module is used to detect malicious files based on the threat level of each of the suspicious files.
11. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a malicious file detection program stored in the memory to implement the malicious file detection method according to any one of claims 1 to 9.
12. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for detecting malicious files according to any one of claims 1 to 9.