Risk detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a risk detection method and device, a storage medium and electronic equipment. The method relates to the technical field of artificial intelligence and the field of financial science and technology, and comprises the following steps: scanning target equipment, and determining a plurality of executable files to be detected in the target equipment; according to the attribute information corresponding to the multiple executable files and a preset authorized executable file table, a target executable file is determined from the multiple executable files, and the risk probability of the target executable file is larger than a preset threshold value; and risk detection is carried out according to the historical operation data of the target executable file to obtain a detection result, and the detection result is used for representing whether the target executable file is a risk file or not. Through the method and the device, the problem of relatively low risk detection accuracy caused by performing risk detection on the executable file on the office computer in a manual mode in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the fields of artificial intelligence technology and financial technology, and specifically, to a risk detection method and device, a storage medium, and an electronic device. Background Art

[0002] With the rapid development of information technology, the reliance of corporate employees on computers and office software in their daily office activities is increasing. But at the same time, a significant security risk has gradually surfaced - the problem of office information security has become increasingly prominent. In particular, the management level of office software that handles confidential and sensitive information is directly related to the information security of the enterprise. As the core tool for information processing, the strictness of the management of office software directly determines the security factor of corporate information. Therefore, strengthening the management of confidential and sensitive office software has become a top priority in corporate information security work. At present, there is a risk of information leakage when manually detecting the software installed on employees' office computers.

[0003] Currently, no effective solution has been proposed to address the problem that risk detection of executable files on office computers is performed manually in related technologies, resulting in relatively low accuracy of risk detection. Summary of the invention

[0004] The main purpose of this application is to provide a risk detection method and device, a storage medium and an electronic device to solve the problem in the related art that risk detection of executable files on office computers is performed manually, resulting in relatively low accuracy of risk detection.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a risk detection method is provided. The method comprises: scanning a target device to determine a plurality of executable files to be detected in the target device; determining a target executable file from the plurality of executable files according to the attribute information corresponding to the plurality of executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; performing risk detection according to the historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file.

[0006] Furthermore, based on the attribute information corresponding to the multiple executable files and a preset authorized executable file table, determining the target executable file from the multiple executable files includes: calculating based on the attribute information corresponding to the multiple executable files to obtain a first key-value pair corresponding to each executable file; obtaining a second key-value pair corresponding to the executable file in the authorized executable file table; and determining the target executable file from the multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file.

[0007] Furthermore, calculating according to the attribute information corresponding to the multiple executable files to obtain the first key-value pair corresponding to each executable file includes: calculating according to the attribute information corresponding to the multiple executable files to obtain a hash value corresponding to each executable file; determining the key corresponding to each executable file according to the hash value, and determining the value corresponding to each executable file according to the file names corresponding to the multiple executable files; determining the first key-value pair according to the key corresponding to each executable file and the value corresponding to each executable file.

[0008] Furthermore, based on the first key-value pair and the second key-value pair corresponding to each executable file, determining the target executable file from the multiple executable files includes: matching the first key-value pair and the second key-value pair to obtain a matching result; if the matching result indicates that there is a target key-value pair in the second key-value pair that matches the first key-value pair, determining that the executable file corresponding to the first key-value pair is not risky; if the matching result indicates that there is no target key-value pair in the second key-value pair that matches the first key-value pair, determining that the executable file corresponding to the first key-value pair is the target executable file.

[0009] Furthermore, risk detection is performed based on the historical operation data of the target executable file to obtain the detection result, including: obtaining code information corresponding to the target executable file; determining, based on the historical operation data, operation parameter information of the target device during the operation of the target executable file; and risk detection is performed based on the code information, the historical operation data and the operation parameter information to obtain the detection result.

[0010] Furthermore, after performing risk detection based on the historical operation data of the target executable file and obtaining the detection result, the method also includes: if the detection result characterizes that the target executable file is a risky file, triggering a target instruction to the target device, wherein the target executable file is deleted from the target device according to the target instruction.

[0011] Furthermore, scanning the target device to determine the multiple executable files to be detected in the target device includes: determining the drive letter information of the target device; scanning the target area of ​​the target device according to the drive letter information and preset file suffix information to determine the multiple executable files.

[0012] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a risk detection device is provided. The device comprises: a scanning unit, used to scan a target device and determine a plurality of executable files to be detected in the target device; a determination unit, used to determine a target executable file from the plurality of executable files according to the attribute information corresponding to the plurality of executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; a detection unit, used to perform risk detection according to the historical operation data of the target executable file and obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file.

[0013] Furthermore, the determination unit includes: a calculation module, used to calculate according to the attribute information corresponding to the multiple executable files to obtain a first key-value pair corresponding to each executable file; a first acquisition module, used to obtain a second key-value pair corresponding to the executable file in the authorized executable file table; a first determination module, used to determine the target executable file from the multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file.

[0014] Furthermore, the calculation module includes: a calculation submodule, used to perform calculations based on the attribute information corresponding to the multiple executable files to obtain a hash value corresponding to each executable file; a first determination submodule, used to determine the key corresponding to each executable file based on the hash value, and determine the value corresponding to each executable file based on the file names corresponding to the multiple executable files; a second determination submodule, used to determine the first key-value pair based on the key corresponding to each executable file and the value corresponding to each executable file.

[0015] Furthermore, the first determination module includes: a matching submodule, used to match the first key-value pair and the second key-value pair to obtain a matching result; a third determination submodule, used to determine that the executable file corresponding to the first key-value pair is not risky if the matching result indicates that there is a target key-value pair in the second key-value pair that matches the first key-value pair; and a fourth determination submodule, used to determine that the executable file corresponding to the first key-value pair is the target executable file if the matching result indicates that there is no target key-value pair in the second key-value pair that matches the first key-value pair.

[0016] Furthermore, the detection unit includes: a second acquisition module, used to obtain code information corresponding to the target executable file; a second determination module, used to determine the operating parameter information of the target device during the operation of the target executable file based on the historical operation data; a detection module, used to perform risk detection based on the code information, the historical operation data and the operating parameter information to obtain the detection result.

[0017] Furthermore, the device also includes: a trigger unit, which is used to perform risk detection based on the historical operation data of the target executable file, and after obtaining the detection result, if the detection result characterizes that the target executable file is a risky file, trigger a target instruction to the target device, wherein the target executable file is deleted from the target device according to the target instruction.

[0018] Furthermore, the scanning unit includes: a third determination module, used to determine the drive letter information of the target device; and a fourth determination module, used to scan the target area of ​​the target device according to the drive letter information and preset file suffix information to determine the multiple executable files.

[0019] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the risk detection methods described above.

[0020] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is further provided, the electronic device includes one or more processors and a memory, and the memory is used to store the risk detection method described in any one of the above-mentioned one or more processors.

[0021] In an embodiment of the present application, the following steps are adopted: scanning a target device to determine multiple executable files to be detected in the target device; determining a target executable file from multiple executable files based on attribute information corresponding to the multiple executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; performing risk detection based on historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file, thereby solving the technical problem in the related art of manually performing risk detection on executable files on office computers, resulting in relatively low accuracy of risk detection. In this solution, the target device is scanned to determine the multiple executable files to be detected that are installed in the target device. Then, a preliminary risk judgment is made based on the attribute information corresponding to the executable file and the preset authorized executable file table to obtain the target executable file. Finally, risk detection is performed based on the historical operation data of the target executable file to determine whether the target executable file is a risky file. By scanning and analyzing the executable files in the target device, dangerous executable files can be discovered in a timely manner, avoiding manual risk detection of executable files on office computers, improving the accuracy of risk detection, and thereby achieving the effect of improving information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a risk detection method provided in an embodiment of the present application;

[0024] Figure 2 The process of the risk detection method provided in the embodiment of the present application is Figure 1 ;

[0025] Figure 3 The process of the risk detection method provided in the embodiment of the present application is Figure 2 ;

[0026] Figure 4 is a schematic diagram of a risk detection device provided according to an embodiment of the present application;

[0027] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0031] Example 1

[0032] According to an embodiment of the present application, a method embodiment of risk detection is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a risk detection method. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0034] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the risk detection method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, to implement the above-mentioned risk detection method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0036] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0037] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0038] Under the above operating environment, this application provides Figure 2 The risk detection method shown. Figure 2 This is the process of the risk detection method according to the first embodiment of the present application. Figure 1 The risk detection method includes:

[0039] Step S201, scanning the target device to determine a plurality of executable files to be detected in the target device.

[0040] Optionally, a target device that needs to be tested for executable file risks is determined. It should be noted that the target device may be an employee's office device. In an optional embodiment, a search tool (security_service.exe) may be set in the target device, and the target device may be scanned by the search tool to determine multiple executable files to be tested in the target device. For example, the search tool may scan all drive letters under the user's computer in turn and traverse all executable files of the .exe and .scr types.

[0041] Step S202, determining a target executable file from the plurality of executable files according to the attribute information corresponding to the plurality of executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold.

[0042] Optionally, after determining multiple executable files to be detected, obtain attribute information corresponding to the executable files, such as file name, file size (bytes), file full path, file creation time, and file last modification time, and determine the target executable file from the multiple executable files based on the attribute information corresponding to the multiple executable files and a preset authorized executable file table.

[0043] It should be noted that the preset authorized executable file table can be a data table that records executable files that are not risky. By comparing the attribute information corresponding to the executable file and the relevant information of the executable files that are not risky in the preset authorized executable file table, if the executable file to be detected exists in the authorized executable file table, it is considered that the executable file is not risky. If the executable file to be detected does not exist in the authorized executable file table, the executable file to be detected is determined as the target executable file. It should be noted that the probability that the target executable file is risky is greater than the preset threshold.

[0044] In an optional embodiment, the remote_legal_software_list.txt file (ie, the authorized executable file list mentioned above) can be used to record and store the compliant executable file information recognized within the enterprise; and the local_illegal_software_list.txt file, which contains the complete set of unauthorized executable files, can be used to record the target executable files mentioned above.

[0045] After obtaining the above-mentioned target executable file, the local_illegal_software_list.txt file, which is a complete set of unauthorized executable files, may be sent to the backend server for processing.

[0046] Step S203, performing risk detection based on the historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file.

[0047] In an optional embodiment, risk detection is performed on historical operation data of the target executable file through a back-end server to obtain a detection result. It should be noted that the detection result is used to characterize whether the target executable file is a risky file.

[0048] To summarize, by scanning the target device, multiple executable files to be detected that are installed in the target device are determined. Then, a preliminary risk judgment is made through the attribute information corresponding to the executable file and the preset authorized executable file table to obtain the target executable file. Finally, risk detection is performed through the historical operation data of the target executable file to determine whether the target executable file is a risky file. By scanning and analyzing the executable files in the target device, dangerous executable files can be discovered in time, avoiding manual risk detection of executable files on office computers, improving the accuracy of risk detection, and thus achieving the effect of improving information security.

[0049] Optionally, in the risk detection method provided in the embodiment of the present application, determining a target executable file from multiple executable files based on attribute information corresponding to multiple executable files and a preset authorized executable file table includes: calculating based on the attribute information corresponding to the multiple executable files to obtain a first key-value pair corresponding to each executable file; obtaining a second key-value pair corresponding to the executable file in the authorized executable file table; and determining the target executable file from multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file.

[0050] In an optional embodiment, the target executable file can be determined from multiple executable files by the following steps: the first key-value pair corresponding to each executable file is obtained by calculating the attribute information corresponding to the multiple executable files. For example, the corresponding hash value can be obtained by performing a hash calculation on attribute information such as the file size (bytes), the full path of the file, the file creation time, and the last modification time of the file, and then the first key-value pair corresponding to each executable file is determined based on the calculated hash value and the file name.

[0051] After obtaining the first key-value pair, the second key-value pair of the authorized executable file can be calculated in the same manner, and finally the target executable file is determined from multiple executable files by comparing the first key-value pair and the second key-value pair corresponding to each executable file. For example, if the executable file to be detected exists in the authorized executable file table, it is considered that the executable file does not have a risk. If the executable file to be detected does not exist in the authorized executable file table, the executable file to be detected is determined as the target executable file.

[0052] By performing preliminary risk screening on multiple executable files through the preset authorized executable file table, executable files with relatively low risks can be screened out, thereby improving the efficiency of subsequent risk detection.

[0053] Optionally, in the risk detection method provided in the embodiment of the present application, calculation is performed based on the attribute information corresponding to multiple executable files to obtain the first key-value pair corresponding to each executable file, including: calculation is performed based on the attribute information corresponding to multiple executable files to obtain a hash value corresponding to each executable file; determining the key corresponding to each executable file based on the hash value, and determining the value corresponding to each executable file based on the file names corresponding to the multiple executable files; determining the first key-value pair based on the key corresponding to each executable file and the value corresponding to each executable file.

[0054] In an optional implementation, the attribute information corresponding to multiple executable files is calculated through the following steps to obtain a first key-value pair corresponding to each executable file: a hash value corresponding to each executable file is calculated based on the attribute information corresponding to the multiple executable files, for example, the MD5 value of the executable file (i.e., the above-mentioned hash value) is calculated through the attribute information corresponding to the executable file, such as the file name, file size (bytes), file full path, file creation time, and file last modification time.

[0055] Then, the key corresponding to each executable file is determined according to the hash value, and the value corresponding to each executable file is determined according to the file names corresponding to the multiple executable files, thereby obtaining a first key-value pair. In an optional embodiment, the MD5 value + file size of the executable file can be used as the key, and the file name can be used as the value to obtain the above-mentioned first key-value pair.

[0056] By calculating the key-value pairs of the executable files, a quick match between the executable files and the authorized executable files can be achieved.

[0057] Optionally, in the risk detection method provided in the embodiment of the present application, determining the target executable file from multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file includes: matching the first key-value pair and the second key-value pair to obtain a matching result; if the matching result indicates that there is a match between the target key-value pair and the first key-value pair in the second key-value pair, then determining that the executable file corresponding to the first key-value pair is not risky; if the matching result indicates that there is no match between the target key-value pair and the first key-value pair in the second key-value pair, then determining that the executable file corresponding to the first key-value pair is the target executable file.

[0058] In an optional implementation, according to the first key-value pair and the second key-value pair corresponding to each executable file, determining the target executable file from multiple executable files includes the following steps: matching the first key-value pair and the second key-value pair to obtain corresponding matching results, if the matching result indicates that the target key-value pair matches the first key-value pair in the second key-value pair, then determining that the executable file corresponding to the first key-value pair is not risky, if the matching result indicates that the target key-value pair does not match the first key-value pair in the second key-value pair, then determining that the executable file corresponding to the first key-value pair is the target executable file. For example, the first key-value pair and the second key-value pair can be calculated for similarity to obtain a similarity value, if there is a similarity value higher than a preset threshold, it can be considered that there is a target key-value pair in the second key-value pair that matches the first key-value pair, if there is no similarity value higher than the preset threshold, it can be considered that there is no target key-value pair in the second key-value pair that matches the first key-value pair.

[0059] By matching key-value pairs, we can quickly complete the preliminary risk screening of executable files and improve the efficiency of subsequent executable file risk detection.

[0060] Optionally, in the risk detection method provided in the embodiment of the present application, risk detection is performed based on the historical operation data of the target executable file, and the detection result obtained includes: obtaining the code information corresponding to the target executable file; determining the operation parameter information of the target device during the operation of the target executable file based on the historical operation data; performing risk detection based on the code information, historical operation data and operation parameter information to obtain the detection result.

[0061] In an optional implementation, performing risk detection on the historical running data of the target executable file to obtain the detection result includes the following steps: after determining the target executable file, in order to accurately detect whether the target executable file is risky, obtaining the code information corresponding to the target executable file and the running parameter information of the target device during the running of the target executable file. It should be noted that the running parameter information of the target device can be information such as the CPU occupancy ratio.

[0062] After obtaining the above information, the code information corresponding to the target executable file can be converted into a code syntax tree, and then the target executable file can be subjected to risk detection according to the code syntax tree, historical operation data and operation parameter information to obtain the detection result.

[0063] In an optional embodiment, a deep learning model can be pre-trained to perform risk detection on the target executable file based on the code syntax tree, historical operation data and operation parameter information to obtain a detection result.

[0064] The target executable file is subjected to secondary risk detection through code information, historical operation data and operation parameter information to improve the accuracy of executable file risk detection.

[0065] Optionally, in the risk detection method provided in the embodiment of the present application, after performing risk detection based on the historical operation data of the target executable file and obtaining the detection result, the method also includes: if the detection result characterizes that the target executable file is a risky file, triggering a target instruction to the target device, wherein the target executable file is deleted from the target device according to the target instruction.

[0066] In an optional implementation, after performing risk detection on the target executable file and obtaining the detection result, if the detection result indicates that the target executable file is a risky file, a target instruction is directly triggered to the target device, and the target executable file is deleted from the target device according to the target instruction.

[0067] After determining that the executable file is risky, the target instruction is directly triggered to the target device to delete the executable file, thereby improving the security of the target device.

[0068] Optionally, in the risk detection method provided in the embodiment of the present application, scanning the target device to determine multiple executable files to be detected in the target device includes: determining the drive letter information of the target device; scanning the target area of ​​the target device based on the drive letter information and preset file suffix information to determine multiple executable files.

[0069] In an optional implementation, the following steps may be used to determine the multiple executable files to be detected: clarify the drive letter information of the target device, that is, which disks are included in the target device. After determining which disks are included in the target device, scan the target area corresponding to the drive letter information, and determine the files in the target area that are the same as the preset file suffix information as multiple executable files. For example, traverse all executable files of the .exe and .scr types.

[0070] By traversing the target device, the executable file to be detected in the target device can be quickly and accurately determined.

[0071] In an optional embodiment, the Figure 3 The flowchart shown implements risk detection for executable files, which specifically includes the following steps: install a self-developed search tool (security_service.exe) on the employee's office computer. The self-developed search tool will scan all drive letters under the user's computer in turn, traverse all .exe and .scr executable files, obtain their file name, file size (bytes), file full path, file creation time and file last modification time, and calculate its MD5 value, and use the executable file's MD5 value + file size as the key and the file name as the value to obtain the executable file's key-value pair.

[0072] By comparing the key-value pairs of the executable file, it is determined whether the executable file is an authorized file. If not, the executable file is recorded in the unauthorized executable file set file local_illegal_software_list.txt. It should be noted that the above execution process will be recorded in the log.txt log file for subsequent tracking.

[0073] The self-developed search tool establishes a Socket TCP / IP protocol with the server and sends the detected unauthorized executable file information to the server. It should be noted that the server is written in Java, with the main framework SpringBoot, the database framework MyBatis, and the network connection framework Netty. It is generally divided into three modules: information reception, information processing, and data storage, which realizes the functions of recording, analyzing, and storing the information sent by the client on the employee's computer for retrieving executable files.

[0074] Receive the unauthorized feasible file information sent by the client through the Socket TCP / IP network protocol, parse the received unauthorized feasible file information, perform risk detection, obtain the detection results, and store the detection results in the database through the MyBatis database framework.

[0075] The risk detection method provided in the embodiment of the present application determines multiple executable files to be detected in the target device by scanning the target device; determines the target executable file from the multiple executable files based on the attribute information corresponding to the multiple executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; performs risk detection based on the historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file, thereby solving the technical problem in the related art of manually performing risk detection on executable files on office computers, resulting in relatively low accuracy of risk detection. In this solution, the target device is scanned to determine the multiple executable files to be detected that are installed in the target device. Then, a preliminary risk judgment is made based on the attribute information corresponding to the executable file and the preset authorized executable file table to obtain the target executable file. Finally, risk detection is performed based on the historical operation data of the target executable file to determine whether the target executable file is a risky file. By scanning and analyzing the executable files in the target device, dangerous executable files can be discovered in a timely manner, avoiding manual risk detection of executable files on office computers, improving the accuracy of risk detection, and thereby achieving the effect of improving information security.

[0076] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0077] Example 2

[0078] The embodiment of the present application also provides a risk detection device. It should be noted that the risk detection device of the embodiment of the present application can be used to execute the risk detection method provided by the embodiment of the present application. The risk detection device provided by the embodiment of the present application is introduced below.

[0079] According to an embodiment of the present application, a device for implementing the above risk detection method is also provided, such as Figure 4 As shown, the device includes: a scanning unit 401, a determining unit 402 and a detecting unit 403.

[0080] The scanning unit 401 is used to scan the target device and determine a plurality of executable files to be detected in the target device;

[0081] A determination unit 402 is used to determine a target executable file from a plurality of executable files according to the attribute information corresponding to the plurality of executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold;

[0082] The detection unit 403 is used to perform risk detection based on the historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to indicate whether the target executable file is a risky file.

[0083] The risk detection device provided in the embodiment of the present application scans the target device through the scanning unit 401 to determine multiple executable files to be detected in the target device; the determination unit 402 determines the target executable file from the multiple executable files based on the attribute information corresponding to the multiple executable files and the preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; the detection unit 403 performs risk detection based on the historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file, thereby solving the technical problem in the related art that risk detection of executable files on office computers is performed manually, resulting in relatively low accuracy of risk detection. In this solution, the target device is scanned to determine the multiple executable files to be detected that are installed in the target device. Then, a preliminary risk judgment is made based on the attribute information corresponding to the executable file and the preset authorized executable file table to obtain the target executable file. Finally, risk detection is performed based on the historical operation data of the target executable file to determine whether the target executable file is a risky file. By scanning and analyzing the executable files in the target device, dangerous executable files can be discovered in a timely manner, avoiding manual risk detection of executable files on office computers, improving the accuracy of risk detection, and thereby achieving the effect of improving information security.

[0084] Optionally, in the risk detection device provided in the embodiment of the present application, a calculation module is used to perform calculations based on the attribute information corresponding to multiple executable files to obtain a first key-value pair corresponding to each executable file; a first acquisition module is used to obtain a second key-value pair corresponding to the executable file in the authorized executable file table; and a first determination module is used to determine a target executable file from multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file.

[0085] Optionally, in the risk detection device provided in the embodiment of the present application, the calculation module includes: a calculation sub-module, used to perform calculations based on the attribute information corresponding to multiple executable files to obtain a hash value corresponding to each executable file; a first determination sub-module, used to determine the key corresponding to each executable file based on the hash value, and determine the value corresponding to each executable file based on the file names corresponding to the multiple executable files; a second determination sub-module, used to determine the first key-value pair based on the key corresponding to each executable file and the value corresponding to each executable file.

[0086] Optionally, in the risk detection device provided in the embodiment of the present application, the first determination module includes: a matching sub-module, used to match the first key-value pair and the second key-value pair to obtain a matching result; a third determination sub-module, used to determine that the executable file corresponding to the first key-value pair is not risky if the matching result indicates that there is a target key-value pair in the second key-value pair that matches the first key-value pair; and a fourth determination sub-module, used to determine that the executable file corresponding to the first key-value pair is the target executable file if the matching result indicates that there is no target key-value pair in the second key-value pair that matches the first key-value pair.

[0087] Optionally, in the risk detection device provided in the embodiment of the present application, the detection unit includes: a second acquisition module, used to obtain code information corresponding to the target executable file; a second determination module, used to determine the operating parameter information of the target device during the operation of the target executable file based on historical operation data; a detection module, used to perform risk detection based on the code information, historical operation data and operating parameter information to obtain a detection result.

[0088] Optionally, in the risk detection device provided in the embodiment of the present application, the device also includes: a trigger unit, which is used to perform risk detection based on the historical operation data of the target executable file, and after obtaining the detection result, if the detection result characterizes that the target executable file is a risk file, trigger a target instruction to the target device, wherein the target executable file is deleted from the target device according to the target instruction.

[0089] Optionally, in the risk detection device provided in the embodiment of the present application, the scanning unit includes: a third determination module, used to determine the drive letter information of the target device; a fourth determination module, used to scan the target area of ​​the target device based on the drive letter information and preset file suffix information to determine multiple executable files.

[0090] It should be noted that the scanning unit 401, the determination unit 402 and the detection unit 403 described above correspond to steps S201 to S203 in the first embodiment, and the three units and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the first embodiment. It should be noted that the modules or units described above may be hardware components or software components stored in a memory (e.g., the memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the modules described above may also be part of a device and may be run in the computer terminal 10 provided in the first embodiment.

[0091] Example 3

[0092] An embodiment of the present application may provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0093] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0094] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: scan the target device to determine multiple executable files to be detected in the target device; determine the target executable file from the multiple executable files based on the attribute information corresponding to the multiple executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; perform risk detection based on the historical operation data of the target executable file to obtain a detection result, wherein the detection result is used to characterize whether the target executable file is a risky file.

[0095] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determining the target executable file from the multiple executable files based on the attribute information corresponding to the multiple executable files and the preset authorized executable file table, including: calculating based on the attribute information corresponding to the multiple executable files to obtain the first key-value pair corresponding to each executable file; obtaining the second key-value pair corresponding to the executable file in the authorized executable file table; determining the target executable file from the multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file.

[0096] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: calculate according to the attribute information corresponding to multiple executable files to obtain the first key-value pair corresponding to each executable file, including: calculate according to the attribute information corresponding to multiple executable files to obtain the hash value corresponding to each executable file; determine the key corresponding to each executable file according to the hash value, and determine the value corresponding to each executable file according to the file names corresponding to the multiple executable files; determine the first key-value pair according to the key corresponding to each executable file and the value corresponding to each executable file.

[0097] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determining the target executable file from multiple executable files based on the first key-value pair and the second key-value pair corresponding to each executable file includes: matching the first key-value pair and the second key-value pair to obtain a matching result; if the matching result indicates that there is a target key-value pair in the second key-value pair that matches the first key-value pair, then determining that the executable file corresponding to the first key-value pair is not risky; if the matching result indicates that there is no target key-value pair in the second key-value pair that matches the first key-value pair, then determining that the executable file corresponding to the first key-value pair is the target executable file.

[0098] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: perform risk detection based on the historical operation data of the target executable file, and obtain the detection results including: obtaining the code information corresponding to the target executable file; determining the operation parameter information of the target device during the operation of the target executable file based on the historical operation data; perform risk detection based on the code information, historical operation data and operation parameter information to obtain the detection results.

[0099] The processor can call the information and application stored in the memory through the transmission device to execute the following steps: after performing risk detection based on the historical operation data of the target executable file and obtaining the detection result, the method also includes: if the detection result characterizes that the target executable file is a risky file, triggering a target instruction to the target device, wherein the target executable file is deleted from the target device according to the target instruction.

[0100] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: scan the target device to determine multiple executable files to be detected in the target device, including: determine the drive letter information of the target device; scan the target area of ​​the target device based on the drive letter information and preset file suffix information to determine multiple executable files.

[0101] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 5 The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations are shown.

[0102] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0103] Example 4

[0104] The embodiment of the present application further provides a computer-readable storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the risk detection method provided in the first embodiment.

[0105] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0106] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the risk detection method.

[0107] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0108] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0109] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0110] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0112] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0113] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A risk detection method, characterized in that: include: Scanning a target device to determine a plurality of executable files to be detected in the target device; Determining a target executable file from the multiple executable files according to the attribute information corresponding to the multiple executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; A risk detection is performed based on the historical running data of the target executable file to obtain a detection result, wherein the detection result is used to indicate whether the target executable file is a risky file.

2. The method according to claim 1, characterized in that Determining a target executable file from the multiple executable files according to the attribute information corresponding to the multiple executable files and a preset authorized executable file table includes: Calculating according to the attribute information corresponding to the multiple executable files to obtain a first key-value pair corresponding to each executable file; Obtaining a second key-value pair corresponding to the executable file in the authorized executable file table; The target executable file is determined from the multiple executable files according to the first key-value pair and the second key-value pair corresponding to each executable file.

3. The method according to claim 2, characterized in that Calculating according to the attribute information corresponding to the multiple executable files, obtaining a first key-value pair corresponding to each executable file includes: Calculating according to the attribute information corresponding to the multiple executable files to obtain a hash value corresponding to each executable file; Determine a key corresponding to each executable file according to the hash value, and determine a value corresponding to each executable file according to the file names corresponding to the multiple executable files; The first key-value pair is determined according to a key corresponding to each executable file and a value corresponding to each executable file.

4. The method according to claim 2, characterized in that: Determining the target executable file from the multiple executable files according to the first key-value pair and the second key-value pair corresponding to each executable file includes: Matching the first key-value pair and the second key-value pair to obtain a matching result; If the matching result indicates that there is a target key-value pair in the second key-value pair that matches the first key-value pair, then determining that the executable file corresponding to the first key-value pair is not risky; If the matching result indicates that there is no target key-value pair in the second key-value pair that matches the first key-value pair, then the executable file corresponding to the first key-value pair is determined to be the target executable file.

5. The method according to claim 1, characterized in that Risk detection is performed based on the historical operation data of the target executable file, and the detection results include: Obtaining code information corresponding to the target executable file; Determining, based on the historical operation data, operation parameter information of the target device during the operation of the target executable file; Risk detection is performed based on the code information, the historical operation data and the operation parameter information to obtain the detection result.

6. The method according to claim 1, characterized in that After performing risk detection based on the historical running data of the target executable file and obtaining the detection result, the method further includes: If the detection result indicates that the target executable file is a risky file, a target instruction is triggered to the target device, wherein the target executable file is deleted from the target device according to the target instruction.

7. The method according to claim 1, characterized in that Scan the target device to determine that the multiple executable files to be detected in the target device include: Determine the drive letter information of the target device; The target area of ​​the target device is scanned according to the drive letter information and the preset file suffix information to determine the multiple executable files.

8. A risk detection device, characterized in that: include: A scanning unit, used to scan a target device and determine a plurality of executable files to be detected in the target device; a determination unit, configured to determine a target executable file from the plurality of executable files according to the attribute information corresponding to the plurality of executable files and a preset authorized executable file table, wherein the probability that the target executable file is risky is greater than a preset threshold; The detection unit is used to perform risk detection based on the historical running data of the target executable file to obtain a detection result, wherein the detection result is used to indicate whether the target executable file is a risky file.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the risk detection method described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory storing an executable program; A processor is used to run the program, wherein the risk detection method described in any one of claims 1 to 7 is executed when the program is run.

Images