Malicious file detection method and device, computer equipment and storage medium

Abstract

The invention discloses a malicious file detection method and device, computer equipment and a storage medium. The malicious file detection method comprises the steps of determining a target file suspected to be a malicious file in a terminal; acquiring attack trace information corresponding to the target file in the terminal as first attack trace information; acquiring second attack trace information corresponding to a target sample file from a server based on a target identifier corresponding to the target file; and determining a detection result of the target file according to the first attack trace information and the second attack trace information. According to the method, detection is performed by using the specific behavior and the running state corresponding to the target file and the specific malicious behavior and the running state corresponding to the historical malicious file, so that the detection accuracy of the malicious file is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method, apparatus, computer device and storage medium for detecting malicious files. Background Art

[0002] In the process of detecting files in a computer system, when using Indicators of Compromise (IOC) to detect files, since IOC can only detect malicious files after attacking a computer system, it cannot detect malicious files that are attacking a computer system, so the accuracy of detecting malicious files is not high. Summary of the invention

[0003] In view of the above problems, the present application proposes a method, apparatus, computer device and storage medium for detecting malicious files.

[0004] In a first aspect, an embodiment of the present application provides a method for detecting malicious files, which is applied to a terminal, and the method includes: determining a target file in the terminal that is suspected to be a malicious file; obtaining attack trace information corresponding to the target file in the terminal as first attack trace information; based on a target identifier corresponding to the target file, obtaining second attack trace information corresponding to a target sample file from a server, wherein the target identifier is used to uniquely identify the target file, and the target sample file is determined from historical malicious files pre-acquired from the server based on the target identifier, and the second attack trace information is simulated attack trace information corresponding to the target sample file; based on the first attack trace information and the second attack trace information, determining a detection result of the target file, and the detection result is used to characterize whether the target file is a malicious file.

[0005] In a second aspect, an embodiment of the present application provides a method for detecting malicious files, which is applied to a server, and the method includes: based on a target identifier corresponding to a target file suspected to be a malicious file in a terminal, determining a target sample file corresponding to the target identifier from pre-acquired historical malicious files; according to the target sample file, determining simulated attack trace information corresponding to the target sample file as second attack trace information, and feeding back the second attack trace information to the terminal, so that the terminal determines the detection result of the target file according to the second attack trace information and the first attack trace information corresponding to the target file in the terminal, and the detection result is used to characterize whether the target file is a malicious file.

[0006] In a third aspect, an embodiment of the present application provides a malicious file detection device, which is applied to a terminal, and the device includes: a target file determination module, which is used to determine a target file in the terminal that is suspected to be a malicious file; a first attack trace information acquisition module, which is used to obtain attack trace information corresponding to the target file in the terminal as first attack trace information; a second attack trace information acquisition module, which is used to obtain second attack trace information corresponding to a target sample file from a server based on a target identifier corresponding to the target file, the target identifier is used to uniquely identify the target file, the target sample file is determined from a sample file pre-acquired from the server according to the target identifier, the second attack trace information is simulated attack trace information corresponding to the target sample file, and the sample file includes historical malicious files; a detection module, which is used to determine a detection result of the target file based on the first attack trace information and the second attack trace information, and the detection result is used to characterize whether the target file is a malicious file.

[0007] In a fourth aspect, an embodiment of the present application provides a malicious file detection device, which is applied to a server, and the device includes: a target sample file determination module, which is used to determine, based on a target identifier corresponding to a target file suspected of being a malicious file in a terminal, a target sample file corresponding to the target identifier from a pre-acquired sample file, wherein the sample file includes a historical malicious file; a second attack trace information determination module, which is used to determine, based on the target sample file, simulated attack trace information corresponding to the target sample file as second attack trace information, and feed back the second attack trace information to the terminal, so that the terminal determines the detection result of the target file based on the second attack trace information and the first attack trace information corresponding to the target file in the terminal, and the detection result is used to characterize whether the target file is a malicious file.

[0008] In a fifth aspect, an embodiment of the present application provides a computer device, comprising: one or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the malicious file detection method provided in the first and second aspects above.

[0009] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the malicious file detection method provided in the first and second aspects above.

[0010] The solution provided by the present application obtains the first attack trace information corresponding to the target file suspected of being a malicious file at the terminal, and determines the target sample file matching the target identifier from the historical malicious files in the server according to the target identifier corresponding to the target file, and obtains the second attack trace information corresponding to the target sample file, and finally determines the detection result corresponding to the target file according to the first attack trace information and the second attack trace information. Since the target identifier is used to uniquely identify the target file, the target identifier is used to match the historical malicious file, and the historical malicious file matching the target file can be determined, and the identifier is only used to identify the file and does not carry the specific information of the file, thereby ensuring the security of the file information; and the attack trace information is used to determine the detection result, and the attack trace information usually includes specific malicious behavior and software running status, so the specific malicious behavior and running status corresponding to the target file are used to detect the specific malicious behavior and running status corresponding to the historical malicious file, avoiding the problem of low accuracy caused by using IOC detection, thereby improving the detection accuracy of malicious files. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0012] Figure 1 A flow chart of a malicious file detection method applied to a terminal provided in an embodiment of the present application is shown.

[0013] Figure 2 A flow chart of a malicious file detection method provided by another embodiment of the present application applied to a terminal is shown.

[0014] Figure 3 A flow chart of a method for detecting malicious files applied to a server provided in an embodiment of the present application is shown.

[0015] Figure 4 The overall flow chart of the malicious file detection method provided in the embodiment of the present application is shown.

[0016] Figure 5 A structural block diagram of a malicious file detection device applied to a terminal provided in an embodiment of the present application is shown.

[0017] Figure 6 A structural block diagram of a malicious file detection device applied to a server provided in an embodiment of the present application is shown.

[0018] Figure 7 A structural block diagram of a computer device provided in an embodiment of the present application for executing a malicious file detection method according to an embodiment of the present application is shown.

[0019] Figure 8 A storage medium provided by an embodiment of the present application for storing or carrying program codes for implementing a method for detecting malicious files according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0021] IOC is information used to determine whether a system, network, or application has been attacked or compromised. It contains known signs of malicious activity, such as file hashes, malicious IP addresses, malicious domain names, etc. When using IOC to detect computer systems, only malicious files that have completed attack behaviors can be detected based on known information, while in the computer system, there are also malicious files that are attacking the computer system. Malicious files that are attacking computer systems cannot be detected through IOC, resulting in low accuracy in detecting malicious files.

[0022] In the related art, in order to further improve the detection accuracy of malicious files, detection can be performed based on the specific malicious behavior corresponding to the file and the running status of the malicious file. However, before detection, the file to be detected in the terminal needs to be uploaded to the server so that the sandbox in the server can simulate the attack trace information corresponding to the file to be detected to obtain the specific malicious behavior of the file to be detected and the file running status. However, in the actual business use process, there are many files in the terminal, resulting in a long upload time, and some files in the terminal include user personal information. Based on the security of user information, the file cannot be uploaded to the server, which results in some files suspected to be malicious files cannot be uploaded and detected, and it is impossible to further ensure the security of computer equipment.

[0023] In view of the problems in the background technology, the inventor proposes a detection method, device, computer equipment and storage medium for malicious files provided by the embodiments of the present application. The first attack trace information corresponding to the target file suspected of being a malicious file is obtained at the terminal, and according to the target identifier corresponding to the target file, the target sample file matching the target identifier is determined from the historical malicious files in the server, and the second attack trace information corresponding to the target sample file is obtained, and finally the detection result corresponding to the target file is determined according to the first attack trace information and the second attack trace information. Since the target identifier is used to uniquely identify the target file, the target identifier is used to match the historical malicious file, and the historical malicious file matching the target file can be determined, and the identifier is only used to identify the file and does not carry the specific information of the file, thereby ensuring the security of the file information; and the attack trace information is used to determine the detection result, and the attack trace information usually includes specific malicious behavior and software running status, so the specific malicious behavior and running status corresponding to the target file are used to detect with the specific malicious behavior and running status corresponding to the historical malicious file, avoiding the problem of low accuracy caused by using IOC detection, thereby improving the detection accuracy of malicious files.

[0024] The following will describe in detail the malicious file detection method, device, computer equipment and storage medium provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0025] See also Figure 1 , Figure 1 The flowchart of the method for detecting malicious files applied to a terminal provided by the embodiment of the present application is shown. The method for detecting malicious files can be applied to Figure 5 The malicious file detection device 300 and the computer device 100 ( Figure 7 ).

[0026] The malicious file detection method may specifically include the following steps:

[0027] Step S110: Determine a target file in the terminal that is suspected to be a malicious file.

[0028] Among them, malicious files refer to malicious program files, that is, malicious programs such as viruses and Trojans. These malicious files can cause harm to computer systems and personal privacy in various ways such as destroying file systems, blocking network connections, and stealing personal data. Suspected malicious files refer to files that may cause harm to computer systems. In the embodiment of the present application, the IOC in the terminal is used to preliminarily screen the terminal files. Since the accuracy of detection through IOC is low, the files that successfully match the information in the IOC are determined to be suspected malicious files. Whether they are malicious files requires further detection.

[0029] Step S120: Acquire attack trace information corresponding to the target file in the terminal as first attack trace information.

[0030] Among them, attack trace information refers to the trace information left when the target file attacks the computer system. The attack trace information includes but is not limited to the running status of the malicious file and the specific malicious behavior. The attack objects of the target file include but are not limited to log files, network traffic, account passwords, and server ports. Attack trace information includes but is not limited to process information, registry information, and network external connection information. Among them, process information includes parent process, process identity (Identity document, ID), process loading module, process parameters, and the user to which it belongs. Registry information includes startup items, driver information, and scheduled task information. Network external connections include domain names, Internet protocols (Internet Protocol, IP), and ports.

[0031] For example, when the target file attacks the log file, it will leave trace information such as the attack parent process, attack process ID, attack time, attack source, attack target, attack method and attack result.

[0032] Step S130: Based on the target identifier corresponding to the target file, obtain second attack trace information corresponding to the target sample file from the server, the target identifier is used to uniquely identify the target file, the target sample file is determined from the historical malicious files pre-acquired from the server according to the target identifier, and the second attack trace information is the simulated attack trace information corresponding to the target sample file.

[0033] The identifier may be a user-defined identifier or a unique identifier generated according to file information. The identifier is not specifically limited here.

[0034] Exemplarily, the identifier may be a hash value. A hash value is a small binary value of a fixed length that maps data of any length according to a hash algorithm. The hash algorithm may be a message digest algorithm (Message-Digest Algorithm, MD5), or a secure hash algorithm 1 (Secure Hash Algorithm 1, SHA-1), and the specific hash algorithm is not limited here.

[0035] Furthermore, historical malicious files refer to files that have been determined to be malicious files. The historical malicious files can be obtained from malicious file detection results in a terminal connected to the server, from other clouds, or input by a user. The method for obtaining historical malicious files is not limited here.

[0036] When a malicious file attacks a computer system, it will leave behind specific attack behavior information and attack trace information such as the file's running status. Therefore, the attack traces can be used to determine whether the file has any attack behavior on the computer system, and then determine whether the file is a malicious file. In other words, the attack trace information corresponding to the target file can be compared with the attack trace information corresponding to the historical malicious file to determine whether the attack trace information of the target file is consistent with or similar to the attack trace information corresponding to the historical malicious file, and then determine whether the target file is a malicious file. The target identifier corresponding to the target file is used to uniquely identify the target file. Therefore, the target identifier is used to determine the target sample file corresponding to the target identifier from the historical malicious files pre-stored on the server, and the simulated attack trace corresponding to the target sample file is obtained as the second attack trace information corresponding to the target sample file.

[0037] The target sample file can be determined by determining an identifier consistent with the target identifier from the server, and determining the historical malicious file corresponding to the identifier as the target sample file. The determination method can also be to determine an identifier whose matching degree with the target identifier reaches a matching degree threshold from the server, and determine the historical malicious file corresponding to the identifier as the target sample file. The determination method corresponding to the target sample file is not limited here.

[0038] Step S140: determining a detection result of the target file according to the first attack trace information and the second attack trace information, wherein the detection result is used to indicate whether the target file is a malicious file.

[0039] In an embodiment of the present application, the detection result can be determined based on the overall similarity between the first attack trace information and the second attack trace information or the similarity of partial information. When the similarity is greater than or equal to a similarity threshold, the target file is determined to be a malicious file. When the similarity is less than the similarity threshold, the target file is determined not to be a malicious file.

[0040] Exemplarily, whether the target file is a malicious file can be determined based on the specific malicious behavior in the attack trace information. If the specific malicious behavior in the first attack trace information is consistent with the specific malicious behavior in the second attack trace information, the target file is determined to be a malicious file; if the specific malicious behavior in the first attack trace information is inconsistent with the specific malicious behavior in the second attack trace information, the target file is determined not to be a malicious file.

[0041] In some embodiments, after determining that the target file is a malicious file, the first attack trace information is associated with the target file and output as an identification result to record the malicious attack behavior and operating status corresponding to the target file, so as to record the malicious attack behavior and operating status of the target file.

[0042] The solution provided in this embodiment obtains the first attack trace information corresponding to the target file suspected of being a malicious file at the terminal, and determines the target sample file matching the target identifier from the historical malicious files in the server according to the target identifier corresponding to the target file, and obtains the second attack trace information corresponding to the target sample file, and finally determines the detection result corresponding to the target file according to the first attack trace information and the second attack trace information. Since the target identifier is used to uniquely identify the target file, the target identifier is used to match the historical malicious file, and the historical malicious file matching the target file can be determined, and the identifier is only used to identify the file and does not carry the specific information of the file, thereby ensuring the security of the file information; and the attack trace information is used to determine the detection result, and the attack trace information usually includes specific malicious behavior and software running status, so the specific malicious behavior and running status corresponding to the target file are used to detect the specific malicious behavior and running status corresponding to the historical malicious file, avoiding the problem of low accuracy caused by using IOC detection, thereby improving the accuracy of malicious file detection.

[0043] See also Figure 2 , Figure 2 A flow chart of a malicious file detection method provided by another embodiment of the present application applied to a terminal is shown.

[0044] Step S210: Acquire the file to be detected in the terminal.

[0045] The file to be detected may be any file in the terminal. The method for obtaining the file to be detected may be based on the file input corresponding to the user, and the file input by the user is determined as the file to be detected. The method for obtaining the file to be detected may also be based on the file confirmation instruction of the user, and the file confirmed by the user is determined as the file to be detected. The method for obtaining the file to be detected, the input method of the user, and the file confirmation instruction of the user are not specifically limited here.

[0046] In some implementations, obtaining the file to be detected in the terminal includes: obtaining a file that is not in a whitelist from the files of the terminal as the file to be detected, wherein the whitelist includes file information confirmed as safe files.

[0047] In an embodiment of the present application, the whitelist includes file information confirmed as safe files, that is, files not in the whitelist may pose a security risk to the computer and need to be further tested to determine whether the file is a malicious file.

[0048] Step S220: Determine an identifier corresponding to the file to be detected according to the file information corresponding to the file to be detected.

[0049] The identifier may be obtained from the file information, or may be obtained after processing the file information. How to obtain the identifier based on the file information is not specifically limited herein.

[0050] Exemplarily, when the identifier is a hash value, hash processing is performed on the file information to obtain a unique hash value corresponding to the file information, and a corresponding relationship between the hash value and the file information is established.

[0051] Step S230: If the identifier corresponding to the file to be detected matches any identifier in the local threat intelligence library, the file to be detected is determined to be the target file, and the local threat intelligence library includes identifiers corresponding to multiple malicious files.

[0052] Among them, the local threat intelligence library includes IOC, and the local threat intelligence library can be used to store multiple malicious file corresponding identifiers and the corresponding relationship between each identifier and the malicious file. The local threat intelligence library can also store multiple malicious files and the identifier corresponding to each malicious file.

[0053] Furthermore, since the identifier is used to uniquely identify the file, the matching method may be a complete match, that is, when the identifier is completely consistent with any identifier in the local threat intelligence library, the file to be detected is determined to be the target file.

[0054] Specifically, after the file to be detected is determined, the identifier corresponding to the file to be detected is matched with the identifier in the local threat intelligence library. When the identifier corresponding to the file to be detected matches any identifier in the local threat intelligence library, it means that the file to be detected is similar to or consistent with the malicious file corresponding to the matching identifier. At this time, the file to be detected is determined as a target file suspected to be a malicious file, and the file is further tested to determine whether the target file is a malicious file.

[0055] Step S240: Acquire attack trace information corresponding to the target file in the terminal as first attack trace information.

[0056] Step S250: Based on the target identifier corresponding to the target file, obtain second attack trace information corresponding to the target sample file from the server, the target identifier is used to uniquely identify the target file, the target sample file is determined from the historical malicious files pre-acquired from the server according to the target identifier, and the second attack trace information is the simulated attack trace information corresponding to the target sample file.

[0057] For detailed description of steps S240 to S250 , please refer to steps S120 to S130 in the aforementioned embodiment, which will not be repeated here.

[0058] Step S260: Obtain the similarity between the first attack trace information and the second attack trace information.

[0059] Step S270: If the similarity is greater than or equal to the similarity threshold, the target file is determined to be a malicious file.

[0060] Step S280: If the similarity is less than the similarity threshold, it is determined that the target file is not a malicious file.

[0061] The similarity may be a final similarity obtained by synthesizing the similarities of each attack trace, or may be a cosine similarity between the first attack trace information and the second attack trace information, as the similarity between the first attack trace information and the second attack trace information, or may be a Hamming distance between the first attack trace information and the second attack trace information. It may also be a combination of multiple similarity determination methods to determine the similarity between the first attack trace information and the second attack trace information. The method for obtaining the similarity is not specifically limited here.

[0062] When the similarity is greater than or equal to the similarity threshold, the specific attack behavior and attack state of the target file on the computer system and the specific attack behavior and attack state of the computer system simulated by the target sample file reach the similarity threshold, and then the target file is determined to be a malicious file. On the contrary, when the similarity is less than the similarity threshold, it is determined that the target file is not a malicious file. The similarity threshold can be 80% or 90%, and the similarity threshold is not specifically limited here.

[0063] The solution provided by this embodiment, when in the terminal, first determines whether the file to be detected in the terminal is suspected to be a malicious file based on the local threat intelligence library in the terminal. When it is determined that the file to be detected is suspected to be a malicious file, the attack trace information corresponding to the file is obtained, and based on the target identifier corresponding to the file, the target sample file corresponding to the target identifier is determined from the historical malicious files in the server, and the attack trace information corresponding to the target sample file is obtained. Finally, it is determined whether the target file is a malicious file based on the similarity between the attack trace information corresponding to the target file and the attack trace information corresponding to the target sample file. Since the target identifier is used to uniquely identify the target file, the target identifier is used to match the historical malicious file, and the historical malicious file matching the target file can be determined. The identifier is only used to identify the file and does not carry the specific information of the file, thereby ensuring the security of the file information; and the attack trace information including specific malicious behavior and running status is used to determine the detection result, avoiding the low accuracy caused by using IOC detection, thereby improving the accuracy of malicious file detection.

[0064] See also Figure 3 , Figure 3 The flowchart of the method for detecting malicious files applied to a server provided by the embodiment of the present application is shown. The method for detecting malicious files can be applied to Figure 6 The malicious file detection device 400 and the computer device 100 ( Figure 7 ).

[0065] The malicious file detection method may specifically include the following steps:

[0066] Step S310: Based on a target identifier corresponding to a target file suspected to be a malicious file in the terminal, a target sample file corresponding to the target identifier is determined from pre-acquired historical malicious files.

[0067] In an embodiment of the present application, when the server receives a target identifier corresponding to a target file in a terminal, it determines a target sample file that matches the target identifier from a historical malicious file. The matching method can refer to the matching method in the aforementioned embodiment, which will not be described here. The historical malicious file can be stored anywhere on the server. In an embodiment of the present application, the historical malicious file is stored in the cloud intelligence library of the server, and the relevant information in the cloud intelligence library is obtained by calling the interface corresponding to the cloud intelligence library.

[0068] Step S320: According to the target sample file, determine the simulated attack trace information corresponding to the target sample file as the second attack trace information, and feed back the second attack trace information to the terminal, so that the terminal determines the detection result of the target file according to the second attack trace information and the first attack trace information corresponding to the target file in the terminal, and the detection result is used to characterize whether the target file is a malicious file.

[0069] Among them, simulated attack trace information refers to simulating the attack of the target sample file on the computer system according to the information of the target sample file to obtain simulated attack trace information, and then recording the running status and specific malicious behavior of the malicious file when the target sample file attacks the computer. The simulated attack trace information can be simulated after the target sample file is determined, or it can be simulated immediately after the historical malicious file is obtained to obtain the simulated attack trace information, and establish a corresponding relationship between the historical malicious file and the simulated attack trace information. After the target sample file is determined according to the target identifier, the second attack trace information corresponding to the target sample file can be determined according to the corresponding relationship. The method for obtaining the simulated attack trace information is not limited here.

[0070] In some implementations, determining, based on the target sample file, simulated attack trace information corresponding to the target sample file as the second attack trace information includes: inputting the target sample file into a cloud sandbox in the server. Using the cloud sandbox to simulate the attack behavior of the target sample file, obtain simulated attack trace information corresponding to the target sample file as the second attack trace information.

[0071] Among them, the sandbox is a security mechanism that provides an isolated environment for running programs. It can provide a simulated test environment for some program files (malicious files) whose sources are unreliable, destructive, or whose program intentions cannot be determined, and then obtain the simulated experiment information of the file.

[0072] In the implementation manner of the present application, the target sample file is input into the cloud sandbox so that the cloud sandbox simulates the attack behavior corresponding to the target sample file to obtain simulated attack trace information.

[0073] In other embodiments, according to the target sample file, determining the simulated attack trace information corresponding to the target sample file as the second attack trace information includes: simulating the attack behavior corresponding to the historical malicious file in the cloud intelligence library through the cloud sandbox to obtain the attack trace information corresponding to the historical malicious file in the cloud intelligence library, and establishing a corresponding relationship between the historical malicious file and the attack trace information, and then matching the target sample file with the historical malicious file in the cloud intelligence library, and determining the attack trace information corresponding to the successfully matched historical malicious file as the second attack trace information corresponding to the target sample file. By simulating the attack trace information corresponding to the historical malicious file in advance and establishing a corresponding relationship between the historical malicious file information and the simulated attack trace information, the efficiency of obtaining the second attack trace information corresponding to the target sample file can be improved, thereby improving the detection efficiency of malicious files.

[0074] In an embodiment of the present application, after the simulated attack trace information corresponding to the target sample file is determined based on the target sample file, the second attack trace information is fed back to the terminal, so that the terminal determines whether the target file is a malicious file based on the attack trace information corresponding to the target file suspected to be a malicious file in the terminal and the second attack trace information corresponding to the target sample file.

[0075] In the solution provided by the present embodiment, the server determines the target sample file corresponding to the target identifier from the historical malicious files based on the target identifier corresponding to the target file suspected to be a malicious file in the terminal, obtains the simulated attack trace information corresponding to the target sample file, and feeds back the simulated attack trace information to the terminal, so that the terminal can determine whether the target file is a malicious file based on the simulated attack trace information and the attack trace information corresponding to the target file in the terminal, without simulating the attack traces on the target file, and only uses the identifier to match the historical malicious file corresponding to the target file. The identifier is only used to identify the target file and does not carry the specific information of the file, which can ensure the security of the file information. Moreover, the detection result is determined by including the attack trace information of specific malicious behavior and running status, which further improves the detection accuracy of malicious files.

[0076] In conjunction with the above-mentioned embodiment scheme, please refer to Figure 4 , Figure 4The overall flow chart of the malicious file detection method provided by the embodiment of the present application is shown. Start to detect malicious files on the inspected host. Collect the files to be detected of the inspected host. The files to be detected can be determined according to the whitelist in the inspected host. Determine whether the file to be detected is suspected to be a malicious file based on the local threat intelligence library IOC. If a target file suspected to be a malicious file is found in the file to be detected, collect the local attack trace information corresponding to the target file as the first attack trace information, and call the cloud intelligence interface. The cloud intelligence includes historical malicious files and the hash value corresponding to each historical malicious file. Determine the target sample file corresponding to the target file in the cloud intelligence according to the hash value corresponding to the target file, and collect the second attack trace information obtained by simulating the attack behavior corresponding to the target sample file in the sandbox. When the first attack trace information is similar to the second attack trace information (for example, the attack target and attack method in the first attack trace information are consistent with the attack target and attack method in the second attack trace information, but other information is inconsistent, then it is determined that the first attack trace information is similar to the second attack trace information), the attack behavior corresponding to the target file is determined according to the first attack trace information, and the target file is associated with the first attack trace information as the identification result, and the detection is exited. When the first attack trace information is not similar to the second attack trace information, the detection is exited. If no target file suspected to be a malicious file is found in the files to be detected, the detection is exited. During the detection process, there is no need to upload files in the inspected host to the server, which ensures the security of files in the inspected host. Moreover, by comparing the attack trace information including specific malicious behaviors and running status to determine whether the target file is a malicious file, the low detection accuracy caused by IOC detection is avoided, and the detection accuracy of malicious files is improved. Please refer to Figure 5, which shows a structural block diagram of a malicious file detection device 300 applied to a terminal provided by an embodiment of the present application. The malicious file detection device 300 is applied to a computer device 100, and the malicious file detection device 300 includes: a target file determination module 310, which is used to determine a target file suspected to be a malicious file in the terminal; a first attack trace information acquisition module 320, which is used to obtain the attack trace information corresponding to the target file in the terminal as the first attack trace information; a second attack trace information acquisition module 330, which is used to obtain the second attack trace information corresponding to the target sample file from the server based on the target identifier corresponding to the target file, the target identifier is used to uniquely identify the target file, the target sample file is determined from the sample file pre-acquired from the server according to the target identifier, the second attack trace information is the simulated attack trace information corresponding to the target sample file, and the sample file includes a historical malicious file; a detection module 340, which is used to determine the detection result of the target file according to the first attack trace information and the second attack trace information, and the detection result is used to characterize whether the target file is a malicious file.

[0077] In some embodiments of the present application, the detection module 340 includes: a similarity determination submodule, used to obtain the similarity between the first attack trace information and the second attack trace information; a malicious file determination submodule, used to determine that the target file is a malicious file if the similarity is greater than or equal to a similarity threshold; a non-malicious file determination submodule, used to determine that the target file is not a malicious file if the similarity is less than the similarity threshold.

[0078] In some embodiments of the present application, the target file determination module 310 includes: a file to be detected acquisition submodule, used to acquire the file to be detected in the terminal; an identifier determination submodule, used to determine the identifier corresponding to the file to be detected based on the file information corresponding to the file to be detected; a target file determination submodule, used to determine that the file to be detected is the target file if the identifier corresponding to the file to be detected matches any identifier in the local threat intelligence library, and the local threat intelligence library includes identifiers corresponding to multiple malicious files.

[0079] In some embodiments of the present application, the file to be detected acquisition submodule includes: a file to be detected determination unit, which is used to obtain a file that is not in the whitelist from the files of the terminal as the file to be detected, and the whitelist includes file information confirmed as a safe file.

[0080] See also Figure 6, which shows a block diagram of a malicious file detection device 400 provided in an embodiment of the present application. The malicious file detection device 400 is applied to a computer device 100, and the malicious file detection device 300 includes: a target sample file determination module 410, which is used to determine a target sample file corresponding to the target identifier from a pre-acquired sample file based on a target identifier corresponding to a target file suspected to be a malicious file in a terminal, and the sample file includes a historical malicious file; a second attack trace information determination module 420, which is used to determine the simulated attack trace information corresponding to the target sample file according to the target sample file as the second attack trace information, and feed back the second attack trace information to the terminal, so that the terminal determines the detection result of the target file according to the second attack trace information and the first attack trace information corresponding to the target file in the terminal, and the detection result is used to characterize whether the target file is a malicious file.

[0081] In some embodiments of the present application, the second attack trace information determination module 420 includes: a data input submodule, used to input the target sample file into the cloud sandbox in the server; an attack trace information simulation submodule, used to simulate the attack behavior of the target sample file through the cloud sandbox, and obtain the simulated attack trace information corresponding to the target sample file as the second attack trace information.

[0082] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0083] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.

[0084] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0085] A structural block diagram of a computer device provided in an embodiment of the present application. Please refer to Figure 7, which shows a block diagram of a computer device provided in an embodiment of the present application. The computer device 100 may be a computer device such as a computer, a server, etc. that can run an application program. The computer device 100 in the present application may include one or more of the following components: a processor 101, a memory 102, and one or more application programs, wherein the one or more application programs may be stored in the memory 102 and configured to be executed by one or more processors 101, and the one or more programs are configured to execute the method described in the aforementioned method embodiment.

[0086] The processor 101 may include one or more processing cores. The processor 101 uses various interfaces and lines to connect various parts of the entire computer device 100, and executes various functions and processes data of the computer device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 102, and calling data stored in the memory 102. Optionally, the processor 101 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 101 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 101, but may be implemented separately through a communication chip.

[0087] The memory 102 may include a random access memory (RAM) or a read-only memory (ROM). The memory 102 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 102 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the computer device 100 during use.

[0088] Please refer to Figure 8, which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable storage medium 200 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0089] The computer-readable storage medium 200 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 200 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 200 has storage space for program code 210 that performs any method steps of the above method. These program codes can be read from or written to one or more computer program products. The program code 210 can be compressed, for example, in an appropriate form.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting malicious files, characterized in that: Applied to a terminal, the method comprises: Determine a target file in the terminal that is suspected to be a malicious file; Acquire attack trace information corresponding to the target file in the terminal as first attack trace information; Based on the target identifier corresponding to the target file, second attack trace information corresponding to the target sample file is obtained from the server, the target identifier is used to uniquely identify the target file, the target sample file is determined from the historical malicious file pre-acquired by the server according to the target identifier, and the second attack trace information is the simulated attack trace information corresponding to the target sample file; A detection result of the target file is determined according to the first attack trace information and the second attack trace information, where the detection result is used to indicate whether the target file is a malicious file.

2. The method according to claim 1, characterized in that The determining the detection result of the target file according to the first attack trace information and the second attack trace information includes: Obtaining a similarity between the first attack trace information and the second attack trace information; If the similarity is greater than or equal to the similarity threshold, determining that the target file is a malicious file; If the similarity is less than the similarity threshold, it is determined that the target file is not a malicious file.

3. The method according to claim 1 or 2, characterized in that: The determining of a target file in the terminal that is suspected to be a malicious file includes: Obtaining the file to be detected in the terminal; Determine, according to the file information corresponding to the file to be detected, an identifier corresponding to the file to be detected; If the identifier corresponding to the file to be detected matches any identifier in the local threat intelligence library, the file to be detected is determined to be the target file, and the local threat intelligence library includes identifiers corresponding to multiple malicious files.

4. The method according to claim 3, characterized in that The obtaining of the file to be detected in the terminal includes: A file that is not in a whitelist is obtained from files of the terminal as the file to be detected, wherein the whitelist includes file information confirmed as safe files.

5. A method for detecting malicious files, characterized in that: Applied to a server, the method comprises: Based on a target identifier corresponding to a target file suspected to be a malicious file in the terminal, determining a target sample file corresponding to the target identifier from pre-acquired historical malicious files; According to the target sample file, simulated attack trace information corresponding to the target sample file is determined as second attack trace information, and the second attack trace information is fed back to the terminal, so that the terminal determines the detection result of the target file according to the second attack trace information and the first attack trace information corresponding to the target file in the terminal, and the detection result is used to characterize whether the target file is a malicious file.

6. The method according to claim 5, characterized in that The step of determining, according to the target sample file, simulated attack trace information corresponding to the target sample file as second attack trace information includes: Inputting the target sample file into the cloud sandbox in the server; The attack behavior of the target sample file is simulated by the cloud sandbox to obtain simulated attack trace information corresponding to the target sample file as the second attack trace information.

7. A malicious file detection device, characterized in that: Applied to a terminal, the device comprises: A target file determination module, used to determine a target file in the terminal that is suspected to be a malicious file; A first attack trace information acquisition module, used to acquire the attack trace information corresponding to the target file in the terminal as the first attack trace information; A second attack trace information acquisition module is used to acquire second attack trace information corresponding to a target sample file from a server based on a target identifier corresponding to the target file, wherein the target identifier is used to uniquely identify the target file, and the target sample file is determined from a sample file pre-acquired from the server according to the target identifier, and the second attack trace information is simulated attack trace information corresponding to the target sample file, and the sample file includes a historical malicious file; The detection module is used to determine the detection result of the target file according to the first attack trace information and the second attack trace information, and the detection result is used to indicate whether the target file is a malicious file.

8. A malicious file detection device, characterized in that: Applied to a server, the device comprises: A target sample file determination module, configured to determine a target sample file corresponding to a target identifier of a target file suspected to be a malicious file in a terminal from pre-acquired sample files, wherein the sample file includes a historical malicious file; The second attack trace information determination module is used to determine the simulated attack trace information corresponding to the target sample file according to the target sample file as the second attack trace information, and feed back the second attack trace information to the terminal, so that the terminal determines the detection result of the target file according to the second attack trace information and the first attack trace information corresponding to the target file in the terminal, and the detection result is used to characterize whether the target file is a malicious file.

9. A computer device, characterized in that: The computer device comprises: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 4, or the method according to any one of claims 5 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 4, or any one of claims 5 to 6.

Images