Malicious file detection method and device, electronic equipment and storage medium

Abstract

The malicious file detection method and device, the electronic equipment and the storage medium provided by the embodiment of the invention comprise the following steps: when it is monitored that a sensitive process is created, scanning a file handle of the sensitive process to obtain a file path and a file type corresponding to a file opened by the sensitive process; determining a risk level of the file for the file of which the file type is a preset file type; delivering the file path of each file to a plurality of priority queues with different priorities based on the risk level; obtaining the number of file paths and equipment load resources of each priority queue; and determining a target priority queue from the plurality of priority queues according to the number of the file paths and the equipment load resources so as to perform malicious file detection on target files corresponding to target file paths in the target priority queue. Compared with the prior art, the technical scheme effectively avoids the technical problem of slow system operation caused by system resource exhaustion due to simultaneous malicious file detection on a large number of files.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer security technology, and in particular to a method, device, electronic device and storage medium for detecting malicious files. Background Art

[0002] As system security requirements increase, malware and backdoor programs increasingly use complex interactions between processes and files to launch attacks, especially through sensitive processes such as wget (web get) and curl (Command Line Uniform Resource Locator, client URL) to download malicious files and hide their traces. The traditional malicious file detection method is to directly scan the file handles of all processes. This method will cause high resource consumption, especially in large-scale server clusters, which can easily cause the system to run slowly and affect system performance. Summary of the invention

[0003] In view of this, in order to alleviate the technical problem that the existing malicious file detection method causes high resource consumption and easily leads to slow system operation and affects system performance, the embodiments of the present invention provide a method, device, electronic device and storage medium for malicious file detection.

[0004] In a first aspect, an embodiment of the present invention provides a method for detecting malicious files, the method comprising:

[0005] When the creation of a sensitive process is detected, the file path and file type corresponding to the file opened by the sensitive process are obtained by scanning the file handle of the sensitive process;

[0006] For a file whose file type is a preset file type, determine the risk level of the file;

[0007] Deliver the file path of each file to multiple priority queues with different priorities based on risk level;

[0008] Get the number of file paths and device load resources for each priority queue;

[0009] A target priority queue is determined from multiple priority queues according to the number of file paths and device load resources, so as to extract a target file path from the target priority queue and perform malicious file detection on a target file corresponding to the target file path.

[0010] In one possible implementation, determining the risk level of a file includes:

[0011] Get preset file characteristics of a file;

[0012] Querying a risk value corresponding to a preset file feature from a risk value query table; wherein the risk value query table stores a correspondence between the preset file feature and the risk value;

[0013] Determine the risk level of the file based on the risk value.

[0014] In a possible implementation, determining the risk level of a file based on the risk value includes:

[0015] Determine the total value at risk based on the value at risk;

[0016] The risk level corresponding to the total risk value is queried from the risk level query table; wherein the risk level query table stores the corresponding relationship between the total risk value and the risk level.

[0017] In one possible implementation, the file path of each file is delivered to a plurality of priority queues of different priorities based on the risk level, including:

[0018] For each file, the file path of the file is delivered to the priority queue corresponding to the priority matching the risk level of the file.

[0019] In a possible implementation, determining a target priority queue from a plurality of priority queues according to the number of file paths and device load resources includes:

[0020] determining a device load level based on the device load resource;

[0021] Determining whether the equipment load level is a preset load level;

[0022] In the case where it is determined that the device load level is the preset load level, the priority queue with the highest priority is determined as the target priority queue;

[0023] When it is determined that the device load level is not the preset load level, the priority queue with the largest number of file paths is determined as the target priority queue.

[0024] In a possible implementation, performing malicious file detection on a target file corresponding to a target file path includes:

[0025] Determine the threat level based on the file content of the target file;

[0026] Detect malicious files based on the threat level of the target file.

[0027] In a possible implementation, determining the threat level according to the file content of the target file includes:

[0028] Determine the threat score of the target file based on the file content;

[0029] Determine the threat level of the target file based on the threat score.

[0030] In one possible implementation, determining a threat score of a target file based on the file content includes:

[0031] Determine a file hash value of a target file based on the file content;

[0032] Compare the file hash value with the hash value in the threat intelligence library;

[0033] If the comparison is successful, the preset score is determined as the threat score of the target file;

[0034] If the comparison fails, the file content is matched with the malicious strings in the malicious string library based on the preset matching rules;

[0035] When the file content successfully matches the malicious string in the malicious string library, the preset score is determined as the threat score of the target file;

[0036] If the file content fails to match the malicious string in the malicious string library, the file is run in a sandbox environment based on the file content to obtain preset running behavior characteristics;

[0037] Querying a feature score matching a preset operation behavior feature from a feature score query library; wherein the feature score query library stores a correspondence between the preset operation behavior feature and the feature score;

[0038] The threat score of the target file is determined based on the signature score.

[0039] In a possible implementation, determining the threat level of the target file according to the threat score includes:

[0040] The threat level corresponding to the threat score is queried from the threat level query library; wherein the threat level query library stores the corresponding relationship between the threat score and the threat level.

[0041] In a possible implementation, malicious file detection is performed based on the threat level of the target file, including:

[0042] Determining whether the threat level of the target file is a first preset threat level;

[0043] In the case where the threat level of the target file is determined to be a first preset threat level, detecting the target file as a malicious file;

[0044] When it is determined that the threat level of the target file is not the first preset threat level, the target file is detected as not being a malicious file.

[0045] In one possible implementation, the method further includes:

[0046] When it is detected that the threat level of the target file is a first preset threat level, a first abnormal response operation is generated to suspend or isolate the sensitive process;

[0047] When it is detected that the threat level of the target file is a second preset threat level, a second abnormal response operation is generated to restrict network access or send an alarm message.

[0048] In a second aspect, an embodiment of the present invention provides a device for detecting malicious files, the device comprising:

[0049] A scanning and obtaining module is used to obtain the file path and file type corresponding to the file opened by the sensitive process by scanning the file handle of the sensitive process when the creation of the sensitive process is detected;

[0050] A determination module, for determining a risk level of a file with a preset file type;

[0051] A delivery module, used to deliver the file path of each file to a plurality of priority queues of different priorities based on the risk level;

[0052] The acquisition module is used to obtain the number of file paths and device load resources of each priority queue;

[0053] The detection module is used to determine a target priority queue from multiple priority queues according to the number of file paths and device load resources, to extract a target file path from the target priority queue, and to perform malicious file detection on a target file corresponding to the target file path.

[0054] In a third aspect, an embodiment of the present invention provides an electronic device, which includes: a processor and a memory, the processor is used to execute a malicious file detection program stored in the memory to implement the above-mentioned malicious file detection method.

[0055] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned method for malicious file detection.

[0056] The method, device, electronic device and storage medium for malicious file detection provided by the embodiment of the present invention include: when the creation of a sensitive process is detected, the file path and file type corresponding to the file opened by the sensitive process are obtained by scanning the file handle of the sensitive process; for files of a preset file type, the risk level of the file is determined; based on the risk level, the file path of each file is delivered to a plurality of priority queues of different priorities; the number of file paths and device load resources of each priority queue are obtained; a target priority queue is determined from a plurality of priority queues according to the number of file paths and the device load resources, so as to extract the target file path from the target priority queue, and malicious file detection is performed on the target file corresponding to the target file path. The above technical scheme can first deliver the file paths of a large number of files that need to be detected for malicious files to a plurality of different priority queues, and then determine the target priority queue according to the number of file paths and the device load resources in each priority queue, so as to detect malicious files on the target files corresponding to the target path in the target priority queue, without the need to perform malicious file detection on a large number of files at the same time, which reduces resource consumption to a certain extent, and effectively avoids the technical problem of system resource exhaustion caused by performing malicious file detection on a large number of files at the same time, resulting in slow system operation and affecting system performance compared with the existing technical scheme. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A flowchart of an embodiment of a method for detecting malicious files provided by an embodiment of the present invention;

[0058] Figure 2 A flowchart of another method for detecting malicious files provided by an embodiment of the present invention;

[0059] Figure 3 A flowchart of another method for detecting malicious files provided by an embodiment of the present invention;

[0060] Figure 4 A flowchart of another method for detecting malicious files provided by an embodiment of the present invention;

[0061] Figure 5 A block diagram of an embodiment of a malicious file detection device provided by an embodiment of the present invention;

[0062] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0065] The present invention provides a method for detecting malicious files. Figure 1 , Figure 1 A flowchart of an embodiment of a method for detecting malicious files provided in an embodiment of the present invention. Figure 1 The process shown may include the following steps:

[0066] Step 101, when the creation of a sensitive process is detected, the file path and file type corresponding to the file opened by the sensitive process are obtained by scanning the file handle of the sensitive process;

[0067] Specifically, netlink (socket) can be used to monitor the creation of sensitive processes, where sensitive processes refer to processes that are considered to have potential security risks or require special attention, such as wget and curl.

[0068] When a sensitive process is detected to be created or started, its file handle can be scanned to obtain the file path and file type corresponding to the file opened by the sensitive process. The specific process is: track the file handle of the sensitive machine process, scan its / proc / [pid] / fd directory, traverse the symbolic links under the / proc / [pid] / fd directory, and use readlink (read link) to obtain the file path of all files opened by the sensitive process pointed to by the file descriptor. Then, use the stat function to analyze the file attributes and determine the file type of each file based on the st_mode field; among them, file types include ordinary files, socket files, pipe files, directory files, link files, character device files, and block device files.

[0069] Step 102, for a file whose file type is a preset file type, determining the risk level of the file;

[0070] The preset file type refers to a common file. Common files are usually content that is persistently stored on disk. Attackers may implant malicious code or vulnerabilities through carefully constructed files. Therefore, it is necessary to perform subsequent malicious file detection on files with common file types to prevent them from being exploited to attack networks and systems.

[0071] The risk level is a grading indicator of the probability of occurrence of potential risks that a file may bring. It can be understood that the higher the risk level, the greater the probability that the file may be a malicious file. Conversely, the lower the risk level, the smaller the probability that the file may be a malicious file.

[0072] Step 103, delivering the file path of each file to a plurality of priority queues of different priorities based on the risk level;

[0073] In this embodiment, a priority queue with a priority corresponding to the risk level is preset. It can be understood that the risk level is divided into several levels, so several priority queues with different priorities are pre-constructed to place the file paths of files with risk levels matching the priorities, that is, for each file, the file path of the file is delivered to the priority queue corresponding to the priority matching the risk level of the file.

[0074] This step provides accurate guidance for the subsequent detection of malicious files in batches, and can effectively avoid the technical problem of high resource consumption caused by the existing malicious detection of a large number of files, which leads to slow system operation and affects system performance.

[0075] Step 104, obtaining the number of file paths and device load resources of each priority queue;

[0076] The number of file paths is the total number of file paths delivered to the priority queue, and the device load resources refer to the current CPU (Central Processing Unit), memory, I / O (Input / Output) load and other load resources of the device running the sensitive process.

[0077] Step 105, determining a target priority queue from multiple priority queues according to the number of file paths and device load resources, extracting a target file path from the target priority queue, and performing malicious file detection on a target file corresponding to the target file path.

[0078] In this embodiment, a target priority queue can be determined from multiple priority queues based on the number of file paths and device load resources, and then malicious file detection is performed on the target files corresponding to the target file paths in the target priority queue. This method of performing malicious file detection on files in batches can greatly reduce resource consumption, ensure the normal operation of the system, and maintain system performance.

[0079] The method for malicious file detection provided by the embodiment of the present invention includes, when the creation of a sensitive process is detected, obtaining the file path and file type corresponding to the file opened by the sensitive process by scanning the file handle of the sensitive process; determining the risk level of the file for the file type of the preset file type; delivering the file path of each file to a plurality of priority queues of different priorities based on the risk level; obtaining the number of file paths and device load resources of each priority queue; determining the target priority queue from the plurality of priority queues according to the number of file paths and the device load resources, extracting the target file path from the target priority queue, and performing malicious file detection on the target file corresponding to the target file path. The above technical scheme can first deliver the file paths of a large number of files that need to be detected for malicious files to a plurality of different priority queues, and then determine the target priority queue according to the number of file paths and the device load resources in each priority queue, so as to perform malicious file detection on the target file corresponding to the target path in the target priority queue, without the need to perform malicious file detection on a large number of files at the same time, thus reducing resource consumption to a certain extent, and effectively avoiding the technical problem of system resource exhaustion caused by performing malicious file detection on a large number of files at the same time, resulting in slow system operation and affecting system performance compared with the existing technical scheme.

[0080] like Figure 2 As shown, as an optional implementation, as in the above method, step 102 of determining the risk level of the file includes the following steps:

[0081] Step 201, obtaining a preset file feature of a file;

[0082] Preset file features are feature information related to files that can detect file risks, such as 1. Static feature analysis features: file extension, hash value, file size and other features. 2. Dynamic behavior analysis features: abnormal system calls, network connections, process creation and other features. 3. Context information features: the source of file creation (such as download source, email attachment), the path to which the file belongs (such as / tmp directory, user download directory). Association analysis features: such as system logs, process behavior and other features. If the above preset file features exist after analyzing the file, they are obtained for subsequent risk level determination.

[0083] Step 202, querying the risk value corresponding to the preset file feature from the risk value query table;

[0084] In actual application, the risk values ​​corresponding to different preset file features are all different. For example, the risk value corresponding to the file extension is 3, the risk value corresponding to the hash value is 2, and the risk value corresponding to the file size is 5. They are not described one by one here. The risk value query table pre-stores the correspondence between the preset file features and the risk values, so that the risk value corresponding to the preset file features obtained can be queried and determined through the risk value query table.

[0085] Step 203: determine the risk level of the file based on the risk value.

[0086] The process of determining the risk level of a file based on the risk value is as follows: determining a total risk value based on the risk value; and querying a risk level corresponding to the total risk value from a risk level query table.

[0087] If multiple preset file features are obtained, the total risk value is obtained by adding the risk values ​​corresponding to each preset file feature. If only one preset file feature is obtained, the total risk value is the risk value corresponding to the preset file feature.

[0088] Among them, the risk level query table stores the corresponding relationship between the total risk value and the risk level. For ease of understanding, the risk level query table is shown in Table 1:

[0089] Table 1

[0090] Total Value at Risk Risk Level 0-39 Low Level 40-79 intermediate 80-100 advanced

[0091] It should be noted that the correspondence between the total risk value and the risk level listed above is only an example. The specific correspondence between the total risk value and the risk level can be set according to actual needs and is not limited here.

[0092] For example, the preset file features obtained are file extension, hash value and file size, among which the risk value corresponding to the file extension is 3, the risk value corresponding to the hash value is 2, and the risk value corresponding to the file size is 5. Then the total risk value is 3+2+5=10. By querying Table 1, it can be seen that the total risk value 10 is in the range of 0-39. Therefore, the risk level of this file is low.

[0093] like Figure 3 As shown, as an optional implementation, as in the aforementioned method, step 105 determines the target priority queue from multiple priority queues according to the number of file paths and device load resources, including the following steps:

[0094] Step 301, determining a device load level based on device load resources;

[0095] Specifically, the load resource score may be calculated using the device load resources first, and then determined by querying the device load level query table based on the load resource score.

[0096] The calculation of the load resource score is to obtain the score of each load resource in the device load resource, and then add the scores of each load resource to obtain the load resource score; the score of each load resource can be determined by querying the load resource score query table, and the load resource score query table stores the corresponding relationship between the load resource and the score. For example, the example stored in the load resource score query table is: the score corresponding to CPU (0-10) is 4, the score corresponding to CPU (11-40) is 7, the score corresponding to memory (64 bytes) is 4, the score corresponding to memory (128 bytes) is 6, the score corresponding to I / O load (20%-40%) is 3, and the score corresponding to I / O load (60%-80%) is 6. It should be noted that the above-listed corresponding relationship is only an example and is not limited here. When the CPU is 35, the memory is 128 bytes and the I / O load is 70%, then the load resource score is 7+6+6=19.

[0097] The device load level query table stores the correspondence between the load resource score and the device load level. For example, the load resource score (0-50) corresponds to a low device load level, and the load resource score (51-100) corresponds to a high device load level. It should be noted that the above-listed correspondence is only an example and is not limited here. Continuing with the previous example, the load resource score is 19. By querying the device load level query table, it can be seen that the device load level is low.

[0098] The device load level is a quantitative indicator used to characterize the device resource usage. The higher the device load level, the higher the device resource usage. Conversely, the lower the device load level, the lower the device resource usage.

[0099] Step 302, determining whether the equipment load level is a preset load level;

[0100] In this embodiment, the preset load level is the advanced level mentioned above. When it is determined that the device load level is the preset load level, it means that the device load is relatively high, so files with high risk levels are processed first. Therefore, step 303 needs to be executed; when it is determined that the device load level is not the preset load level, it means that the device load is not high, and step 304 needs to be executed.

[0101] Step 303, determining the priority queue with the highest priority as the target priority queue;

[0102] Step 304: determine the priority queue with the largest number of file paths as the target priority queue.

[0103] For example, there are three priority queues, and the corresponding priorities of each priority queue are high, medium and low, among which the number of file paths in the high priority queue is 100, the number of file paths in the medium priority queue is 200, and the number of file paths in the low priority queue is 300. Then, it is necessary to determine the low priority queue as the target priority queue to give priority to malicious file detection for the target files corresponding to the target file paths in the low priority queue.

[0104] In this embodiment, the processing order of the priority queue can be dynamically determined based on the number of file paths and device load resources to facilitate the detection of malicious files, effectively avoiding the problem of system resource exhaustion caused by the detection of malicious files in the existing technical solutions.

[0105] like Figure 4 As shown, as an optional implementation, as in the aforementioned method, step 105 of performing malicious file detection on the target file corresponding to the target file path includes the following steps:

[0106] Step 401, determining a threat level according to the file content of the target file;

[0107] The threat level is a quantitative indicator used to measure the possibility that a suspicious file is a malicious file. It can be understood that a higher threat level indicates a greater possibility that the suspicious file is a malicious file, and vice versa, a lower threat level indicates a lower possibility that the suspicious file is a malicious file.

[0108] The process of determining the threat level is as follows: step A1, determining the threat score of the target file based on the file content; step A2, determining the threat level of the target file according to the threat score.

[0109] The threat score is a specific numerical indicator used to measure the possibility that the target file is a malicious file. It can be understood that the larger the threat score, the greater the possibility that the target file is a malicious file. Conversely, the smaller the threat score, the smaller the possibility that the target file is a malicious file. It can be seen that the threat score is directly related to the threat level. Therefore, after determining the threat score, the threat level of the target file can be determined. The above step A1 can be implemented through steps B1 to B7:

[0110] Step B1, determining a file hash value of a target file based on the file content;

[0111] The calculation process of the file hash value is as follows: select a suitable hash algorithm according to the needs, such as MD5 (Message-Digest Algorithm 5), SHA (Secure Hash Algorithm)-1, SHA-256, etc., read the file content into the memory, or read it block by block to process large files, use the hash algorithm to process the file content, and obtain the file hash value.

[0112] Step B2, comparing the file hash value with the hash value in the threat intelligence library;

[0113] The threat intelligence library stores hash values ​​corresponding to various malicious files. The file hash value is compared with each hash value in the threat intelligence library. If the file hash value is consistent with a hash value in the threat intelligence library, that is, if the comparison is successful, execute step B3; if the file hash value is inconsistent with each hash value in the threat intelligence library, that is, if the comparison is unsuccessful, execute step B4.

[0114] Step B3, determining the preset score as the threat score of the target file;

[0115] If the comparison is successful, it means that the target file is very likely to be a malicious file, so the threat score of the target file is directly set to a high preset score, such as 10 points, where the preset score can be set according to actual needs and is not limited here.

[0116] Step B4, matching the file content with the malicious character string in the malicious character string library based on a preset matching rule;

[0117] Various malicious strings are pre-stored in the malicious string library. The preset matching rule can adopt the YARA (Yet Another Recursive Acronym) rule to match the file content of the target file with the malicious strings in the malicious string library one by one, and detect whether the target file contains known malicious code.

[0118] Step B5, when the file content successfully matches the malicious string in the malicious string library, the preset score is determined as the threat score of the target file;

[0119] When the file content successfully matches the malicious string in the malicious string library, it indicates that the target file is highly likely to be a malicious file, and the threat score of the target file is directly set to the above preset score, such as 10 points.

[0120] Step B6, when the file content fails to match the malicious string in the malicious string library, run the program in a sandbox environment based on the file content to obtain a preset running behavior feature;

[0121] When the file content fails to match the malicious string in the malicious string library, it is necessary to further determine whether the target file is a malicious file. Therefore, the file content of the target file is run in a sandbox environment to obtain the preset running behavior characteristics during the running process, where the preset running behavior characteristics are malicious behavior characteristics, such as unconventional communication, modification / deletion of key files, attempts to obtain root permissions, triggered behaviors involving sensitive objects (such as system key files), encryption, compression, obfuscation of code and other preset running behavior characteristics.

[0122] When the above preset running behavior characteristics are present in the running file content, they are obtained for subsequent threat score determination.

[0123] Step B7, querying a feature score matching a preset running behavior feature from a feature score query library;

[0124] Among them, the feature score query library stores the correspondence between the preset operation behavior features and the feature scores; for ease of understanding, the feature score query library is shown in Table 2:

[0125] Table 2

[0126]

[0127]

[0128] It should be noted that the correspondence between the preset operating behavior characteristics and the characteristic scores listed above is only an example, and the specific correspondence between the preset operating behavior characteristics and the characteristic scores can be set according to actual needs and is not limited here.

[0129] For example, the preset operation behavior features obtained are unconventional communication 1 and attempting to obtain root permissions. Then, by querying Table 2, it can be known that the feature score corresponding to modifying / etc / passwd is 3, and the feature score corresponding to attempting to obtain root permissions is 2.

[0130] Step B8: determining the threat score of the target file based on the feature score.

[0131] Specifically, each feature score is added together to determine the threat score of the target file. Continuing with the previous example, the feature score corresponding to modifying / etc / passwd is 3, and the feature score corresponding to attempting to obtain root permissions is 2, then the threat score of the target file is 3+2=5.

[0132] The implementation process of the above step A2 is: querying the threat level corresponding to the threat score from the threat level query library; wherein the threat level query library stores the corresponding relationship between the threat score and the threat level.

[0133] For ease of understanding, the threat level query library is shown in Table 3:

[0134] Table 3

[0135] Threat score Threat Level 1-3 Low threat level 4-6 Medium Threat Level 7-15 High Threat Level

[0136] Among them, a low threat level indicates that the target file may have false positives or slight risks, a medium threat level indicates that the target file has potential harm but has not yet manifested itself as a clear attack, and a high threat level indicates that the target file is a known or obvious malicious sample. It should be noted that the correspondence between the preset operation behavior characteristics and the characteristic scores listed above is only an example, and the specific correspondence between the preset operation behavior characteristics and the characteristic scores can be set according to actual needs and is not limited here.

[0137] If the threat score is 8, then by querying Table 2, it can be known that the threat level of the target file is a high threat level; if the threat score is 5, then by querying Table 2, it can be known that the threat level of the target file is a medium threat level; if the threat score is 0, it indicates that there is no problem with the target file.

[0138] Step 402: Perform malicious file detection based on the threat level of the target file.

[0139] The above step 402 can be implemented through steps C1 to C3:

[0140] Step C1, for each target file: determining whether the threat level of the target file is a first preset threat level;

[0141] The first preset threat level is a threat level indicating that the target file is a malicious file, such as the high threat level mentioned above, that is, it is determined whether the threat level of the target file is a high threat level.

[0142] Step C2, when it is determined that the threat level of the target file is a first preset threat level, detecting the target file as a malicious file;

[0143] That is, when the threat level of the target file is a high threat level, the target file is detected as an aggressive malicious file.

[0144] Step C3: if it is determined that the threat level of the target file is not the first preset threat level, detecting that the target file is not a malicious file.

[0145] That is, when the threat level of the target file is not a high threat level, the target file is detected as a non-aggressive malicious file, that is, a normal file.

[0146] In actual application, in order to facilitate subsequent tracking and analysis, the container information of the container can be obtained; a forensic report can be generated based on the incremental file system snapshot, the threat level of each file, the malicious file detection results and the container information. The above container information is the unique identification information that identifies the container, such as the container ID (IDentity, identity identification number), and the generated forensic report is formal evidence in JSON (JavaScript Object Notation) or PDF format. The above forensic report can be recorded in the log of the malicious file detection system for further review and response by the security team.

[0147] Furthermore, in order to ensure network security, when the threat level of the target file is detected to be a first preset threat level, a first exception response operation can be generated to suspend or isolate the sensitive process; when the threat level of the target file is detected to be a second preset threat level, a second exception response operation can be generated to restrict network access or send an alarm message.

[0148] The specific second preset threat level is a threat level indicating that the target file is not a malicious file but may have false positives or minor risks or have potential harm but do not manifest as a clear attack, such as the medium threat level or low threat level mentioned above. Then, when the threat level of the target file is a high threat level, the malicious file detection system can execute the first abnormal response operation of automatically pausing or isolating the sensitive process to prevent the further spread of maliciousness; when the threat level of the target file is a medium threat level or a low threat level, the second abnormal response operation of restricting network access or sending an alarm message is executed, and the isolation / restriction status can be recorded in the log of the malicious file detection system to ensure subsequent traceability.

[0149] See also Figure 5 , is a block diagram of an embodiment of a malicious file detection device provided by an embodiment of the present invention. Figure 5 As shown, the device comprises:

[0150] The scanning and obtaining module 501 is used to obtain the file path and file type corresponding to the file opened by the sensitive process by scanning the file handle of the sensitive process when the sensitive process is detected to be created;

[0151] A determination module 502, for determining a risk level of a file whose file type is a preset file type;

[0152] A delivery module 503, for delivering the file path of each file to a plurality of priority queues of different priorities based on the risk level;

[0153] An acquisition module 504 is used to acquire the number of file paths and device load resources of each priority queue;

[0154] The detection module 505 is used to determine a target priority queue from multiple priority queues according to the number of file paths and device load resources, to extract a target file path from the target priority queue, and to perform malicious file detection on a target file corresponding to the target file path.

[0155] The malicious file detection device provided by the embodiment of the present invention includes, when the sensitive process is detected to be created, obtaining the file path and file type corresponding to the file opened by the sensitive process by scanning the file handle of the sensitive process; determining the risk level of the file for the file type of the preset file type; delivering the file path of each file to a plurality of priority queues of different priorities based on the risk level; obtaining the number of file paths and device load resources of each priority queue; determining the target priority queue from the plurality of priority queues according to the number of file paths and device load resources, extracting the target file path from the target priority queue, and performing malicious file detection on the target file corresponding to the target file path. The above technical scheme can first deliver the file paths of a large number of files that need to be detected for malicious files to a plurality of different priority queues, and then determine the target priority queue according to the number of file paths and device load resources in each priority queue, so as to perform malicious file detection on the target file corresponding to the target path in the target priority queue, without having to perform malicious file detection on a large number of files at the same time, thus reducing resource consumption to a certain extent, and effectively avoiding the technical problem of system resource exhaustion caused by performing malicious file detection on a large number of files at the same time, resulting in slow system operation and affecting system performance compared with the existing technical scheme.

[0156] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, Figure 6 The electronic device 1200 shown includes: at least one processor 1201, a memory 1202, at least one network interface 1204 and other user interfaces 1203. The various components in the electronic device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Figure 6 Various buses are labeled as bus system 1205.

[0157] The user interface 1203 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0158] It can be understood that the memory 1202 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 1202 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0159] In some embodiments, the memory 1202 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 12021 and an application program 12022 .

[0160] The operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 12022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 12022.

[0161] In the embodiment of the present invention, by calling the program or instruction stored in the memory 1202, specifically, the program or instruction stored in the application 12022, the processor 1201 is used to execute the method steps provided by each method embodiment.

[0162] The method disclosed in the above embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above processor 1201 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the above method in combination with its hardware.

[0163] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0164] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0165] The electronic device provided in this embodiment may be Figure 6 The electronic device shown in FIG. 1 may perform the following steps: Figure 1-4 All steps of the malicious file detection method in Figure 1-4 For details, please refer to the technical effect of the malicious file detection method shown in Figure 1-4 For the sake of brevity, the relevant description is not repeated here.

[0166] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0167] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned method of malicious file detection can be implemented.

[0168] The processor is used to execute the malicious file detection program stored in the memory to implement the steps of the malicious file detection method.

[0169] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0170] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0171] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting malicious files, characterized in that: The method comprises: When the creation of a sensitive process is detected, the file path and file type corresponding to the file opened by the sensitive process are obtained by scanning the file handle of the sensitive process; For a file whose file type is a preset file type, determining a risk level of the file; Delivering the file path of each of the files to a plurality of priority queues of different priorities based on the risk level; Obtain the number of file paths and device load resources of each priority queue; A target priority queue is determined from the plurality of priority queues according to the number of the file paths and the device load resources, so as to extract the target file path from the target priority queue, and malicious file detection is performed on the target file corresponding to the target file path.

2. The method according to claim 1, characterized in that Determine the risk level of the document in question, including: Obtaining preset file features of the file; Querying the risk value corresponding to the preset file feature from a risk value query table; wherein the risk value query table stores a correspondence between the preset file feature and the risk value; A risk level of the file is determined based on the risk value.

3. The method according to claim 2, characterized in that The determining the risk level of the file based on the risk value includes: determining a total value at risk based on the value at risk; The risk level corresponding to the total risk value is queried from a risk level query table; wherein the risk level query table stores a correspondence between the total risk value and the risk level.

4. The method according to claim 1, characterized in that: The delivering the file paths of the respective files to priority queues of multiple different priorities based on the risk level includes: For each of the files, the file path of the file is delivered to a priority queue corresponding to a priority matching the risk level of the file.

5. The method according to claim 1, characterized in that The step of determining a target priority queue from the plurality of priority queues according to the number of file paths and device load resources includes: determining a device load level based on the device load resources; Determining whether the device load level is a preset load level; In the case where it is determined that the device load level is the preset load level, determining the priority queue with the highest priority as the target priority queue; When it is determined that the device load level is not the preset load level, the priority queue with the largest number of file paths is determined as the target priority queue.

6. The method according to claim 1, characterized in that The performing malicious file detection on the target file corresponding to the target file path includes: Determining a threat level based on the file content of the target file; Malicious files are detected based on the threat level of the target files.

7. The method according to claim 6, characterized in that The determining the threat level according to the file content of the target file includes: Determining a threat score of the target file based on the file content; The threat level of the target file is determined according to the threat score.

8. The method according to claim 7, characterized in that The determining the threat score of the target file based on the file content includes: Determine a file hash value of the target file based on the file content; Compare the hash value of the file with the hash value in the threat intelligence library; If the comparison is successful, the preset score is determined as the threat score of the target file; If the comparison is unsuccessful, matching the file content with the malicious character string in the malicious character string library based on a preset matching rule; In the case where the file content successfully matches the malicious character string in the malicious character string library, determining the preset score as the threat score of the target file; In the case where the file content fails to match the malicious string in the malicious string library, running the file in a sandbox environment based on the file content to obtain a preset running behavior feature; Querying a feature score matching the preset operation behavior feature from a feature score query library; wherein the feature score query library stores a correspondence between the preset operation behavior feature and the feature score; A threat score of the target file is determined based on the feature score.

9. The method according to claim 7, characterized in that: Determining the threat level of the target file according to the threat score includes: The threat level corresponding to the threat score is queried from a threat level query library; wherein the threat level query library stores a correspondence between threat scores and threat levels.

10. The method according to claim 6, characterized in that The detecting of malicious files based on the threat level of the target file includes: Determining whether the threat level of the target file is a first preset threat level; In the case where it is determined that the threat level of the target file is the first preset threat level, detecting that the target file is a malicious file; When it is determined that the threat level of the target file is not the first preset threat level, the target file is detected as not being a malicious file.

11. The method according to claim 10, characterized in that The method further comprises: In the case where it is detected that the threat level of the target file is the first preset threat level, generating a first abnormal response operation to suspend or isolate the sensitive process; When it is detected that the threat level of the target file is a second preset threat level, a second abnormal response operation is generated to restrict network access or send an alarm message.

12. A device for detecting malicious files, characterized in that: The device comprises: A scanning and obtaining module, for obtaining the file path and file type corresponding to the file opened by the sensitive process by scanning the file handle of the sensitive process when the sensitive process is detected to be created; A determination module, used for determining the risk level of a file of a preset file type; A delivery module, used for delivering the file path of each of the files to a plurality of priority queues of different priorities based on the risk level; An acquisition module, used to acquire the number of file paths and device load resources of each priority queue; The detection module is used to determine a target priority queue from the multiple priority queues according to the number of file paths and device load resources, to extract the target file path from the target priority queue, and to perform malicious file detection on the target file corresponding to the target file path.

13. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a malicious file detection program stored in the memory to implement the malicious file detection method according to any one of claims 1 to 11.

14. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for malicious file detection according to any one of claims 1 to 11.

Images