Software detection method and device, equipment and medium
Through the combined detection of natural language processing model and processor usage and file directory operation change information, the detection problem of unknown malware is solved and higher detection accuracy is achieved.
Patent Information
- Application Number
- CN202510682100.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-26
- Publication Date
- 2025-08-19
AI Technical Summary
The prior art cannot effectively detect unknown malware, especially in the case of zero-day attacks.
The natural language processing model is used to classify the target files created by the target software, and the detection results of the target software are determined based on the processor usage rate and file directory operation change information.
It improves the accuracy of detection of unknown malware, can better fit the actual situation of the malware running time, and covers the detection of unknown software.
Smart Images
Figure CN120509032A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a software detection method, apparatus, device, and medium. Background Art
[0002] Currently, malware, often referred to as ransomware, poses a significant threat to computer security. Currently, it's possible to detect malicious software using a library of known malware signatures. However, this approach relies on signatures that only cover known malware and cannot detect zero-day attacks.
[0003] Therefore, how to detect unknown malware is a problem that those skilled in the art need to solve. Summary of the Invention
[0004] In view of this, the purpose of this application is to provide a software detection method, apparatus, device and medium to detect unknown malware. The specific solution is as follows:
[0005] In a first aspect, the present application provides a software detection method, comprising:
[0006] If the target software is determined to be non-malicious using the malicious signature library, the target files created by the target software are classified using the natural language processing model to obtain a file classification result and determine the creation time of the target file;
[0007] Determine fluctuation information of processor usage in a period of time before the creation time point, and operation change information of the file directory to which the target file belongs;
[0008] Based on the file classification results, fluctuation information and operation change information, the detection results of the target software are determined.
[0009] In a second aspect, the present application provides a software detection device, comprising:
[0010] An analysis module is configured to classify target files created by the target software using a natural language processing model if the target software is determined to be non-malicious using a malicious signature library, obtain a file classification result, and determine the creation time of the target file;
[0011] A determination module, configured to determine fluctuation information of a processor usage rate within a period of time before a creation time point, and operation change information of a file directory to which a target file belongs;
[0012] The detection module is used to determine the detection result of the target software based on the file classification result, fluctuation information and operation change information.
[0013] In a third aspect, the present application provides an electronic device, comprising:
[0014] memory for storing computer programs;
[0015] A processor is used to execute the computer program to implement the software detection method disclosed above.
[0016] In a fourth aspect, the present application provides a non-volatile storage medium for storing a computer program, wherein the computer program implements the aforementioned disclosed software detection method when executed by a processor.
[0017] In a fifth aspect, the present application provides a computer program product, comprising a computer program / instruction, which implements the steps of the aforementioned software detection method when executed by a processor.
[0018] From the above scheme, it can be seen that the present application provides a software detection method, including: if the target software is determined to be non-malicious using a malicious feature library, then the target files created by the target software are classified using a natural language processing model to obtain file classification results, and determine the creation time point of the target file; determine the fluctuation information of the processor usage rate in a period of time before the creation time point, and the operation change information of the file directory to which the target file belongs; based on the file classification results, fluctuation information and operation change information, determine the detection result of the target software.
[0019] It can be seen that for unknown software (i.e., software determined to be non-malicious using a malicious feature library), this application further uses a natural language processing model to classify the target files created by the target software, obtains file classification results, and determines the creation time of the target file; then determines the fluctuation information of the processor usage rate in a period of time before the creation time point, as well as the operation change information of the file directory to which the target file belongs; thus, on the basis of the static detection of the malicious feature library, further detects the file content, directory and processor usage rate in the same period, so that it can comprehensively determine whether the software is malicious. The detection of file content, directory and processor usage rate in the same period is more in line with the actual situation when the malware is running, so the detection accuracy is relatively high, and it also covers the detection of unknown software.
[0020] Correspondingly, the software detection device, equipment and medium provided by this application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.
[0022] Figure 1 A flow chart of a software detection method disclosed in this application;
[0023] Figure 2 A schematic diagram of a detection system disclosed in this application;
[0024] Figure 3 This is a flow chart of another software detection method disclosed in this application;
[0025] Figure 4 This is a schematic diagram of a software detection device disclosed in this application;
[0026] Figure 5 A schematic diagram of an electronic device disclosed in this application;
[0027] Figure 6 A server structure diagram provided for this application;
[0028] Figure 7 This is a terminal structure diagram provided for this application. DETAILED DESCRIPTION
[0029] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other examples obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.
[0030] Currently, malware is commonly referred to as ransomware, which poses a significant threat to computer security. Currently, known malicious signature libraries can be used to detect whether software is malicious. However, this approach relies on malicious signature libraries and can only cover known malware, failing to detect zero-day attacks. Therefore, the present application provides a software detection solution that, based on static detection of malicious signature libraries, further detects file content, directories, and processor usage over the same period, thereby enabling a comprehensive determination of whether the software is malicious. The detection of file content, directories, and processor usage over the same period is more consistent with the actual situation when malware is running, resulting in relatively high detection accuracy and also covering the detection of unknown software.
[0031] See also Figure 1 As shown, the embodiment of the present application discloses a software detection method, including:
[0032] S101. If the target software is determined to be non-malicious using the malicious feature library, the target files created by the target software are classified using a natural language processing model to obtain a file classification result and determine a creation time of the target file.
[0033] In this embodiment, the target software is first detected using a malicious feature library. If the name, hash value, or other relevant information of the target software is recorded in the malicious feature library, the target software is determined to be malicious; otherwise, the target software is determined to be non-malicious. If the target software is determined to be malicious using the malicious feature library, then it can be considered that the target software is ransomware or software with other malicious purposes. Therefore, the target software is directly stopped from running and the target files are isolated to prevent the threat from expanding. If the target software is determined to be non-malicious using the malicious feature library, in order to further detect the target software, this embodiment uses a natural language processing model to detect the target files created by the target software, that is: the target files created by the target software are classified using the natural language processing model to obtain file classification results, and then the creation time point of the target file is determined to facilitate the execution of subsequent detection steps.
[0034] In one embodiment, a natural language processing model is used to classify target files created by target software to obtain a file classification result. The method includes: tracking the target software in kernel mode to capture the target files created by the target software; performing word segmentation on the target file content using the natural language processing model, extracting statistically weighted features from the word segmentation results, and classifying the statistically weighted features (e.g., performing chi-square feature selection) to obtain a file classification result. The file content is thereby analyzed to determine whether malicious information is present. The word segmentation results require the removal of meaningless words and punctuation. The file classification result may specifically indicate the probability that the target file content is malicious or non-malicious. The natural language processing model can be constructed based on any structure, and the statistically weighted features may be TF-IDF (Term Frequency–Inverse Document Frequency) features. TF-IDF is a weighting technique used in information retrieval and text mining to assess the importance of a word to a document set or a document in a corpus. The importance of a word increases proportionally with the number of times it appears in a document, but decreases inversely with its frequency of appearance in the corpus.
[0035] S102: Determine fluctuation information of the processor usage rate within a period of time before the creation time point, and operation change information of the file directory to which the target file belongs.
[0036] This embodiment takes into account that malware often creates or encrypts numerous files in a short period of time. In this case, processor usage increases dramatically, and operations such as adding, deleting, modifying, and checking files also occur frequently. Therefore, the embodiment determines the fluctuation of processor usage in the period before the creation time, as well as the operation change information of the file directory to which the target file belongs, to determine whether the processor usage and the file directory are abnormal. Operation change information can also be obtained and detected for directories associated with user data, such as the / home / * directory, the / root directory, the database storage path / var / lib / *, and / tmp.
[0037] In one embodiment, determining the fluctuation information of the processor usage rate within a period of time before the creation time point includes: obtaining the processor usage rate within a period of time before the creation time point; constructing a usage rate fluctuation curve based on the obtained processor usage rate; and using the usage rate fluctuation curve as the fluctuation information. Accordingly, in another embodiment, determining the fluctuation information of the processor usage rate within a period of time before the creation time point includes: obtaining the processor usage rate within a period of time before the creation time point; calculating the usage rate mutation rate and mutation duration based on the obtained processor usage rate; and using the usage rate mutation rate and mutation duration as the fluctuation information. Accordingly, when the usage rate mutation rate is greater than a first set value and the mutation duration is greater than a second set value, it can be considered that there is an abnormality in the processor usage; otherwise, it is considered that there is no abnormality in the processor usage.
[0038] In one embodiment, determining operation change information for the target file's directory within a period of time prior to the creation time point includes: obtaining file operation events within the target file's directory within a period of time prior to the creation time point; calculating the operation change rate and change duration of the file operation events; and using the operation change rate and change duration as the operation change information. Accordingly, if the operation change rate is greater than a third set value and the change duration is greater than a fourth set value, it can be determined that an abnormality exists in the target file's directory; otherwise, it can be determined that no abnormality exists in the target file's directory.
[0039] It should be noted that the period before the creation time point can be flexibly set according to actual conditions. Specifically, the period before the creation time point can be 1 minute, 300 seconds, or 600 milliseconds. For example, the period is set to T time units before the creation time point. Both T and the time unit can be flexibly set, such as T=3, where the time unit is minutes; or T=180, where the time unit is seconds.
[0040] S103: Determine the detection result of the target software based on the file classification result, the fluctuation information, and the operation change information.
[0041] In one embodiment, the detection result of the target software is determined based on the file classification result, the fluctuation information, and the operation change information, including: if it is determined based on the file classification result that the target software has an abnormality, based on the fluctuation information that the processor usage has an abnormality, and based on the operation change information that the file directory to which the target file belongs has an abnormality, then the detection result is determined to be: the target software is ransomware; or, if it is determined based on the file classification result that the target software has an abnormality, based on the fluctuation information that the processor usage has an abnormality, or based on the operation change information that the file directory to which the target file belongs has an abnormality, then the detection result is determined to be: the target software is ransomware.
[0042] Of course, a comprehensive value can also be calculated based on the file classification result and its corresponding first weight value, the fluctuation information and its corresponding second weight value, and the operation change information and its corresponding third weight value; based on the comprehensive value, whether the target software is ransomware is determined. In one example, let the file classification result be X, its corresponding first weight value be X; the fluctuation information be Y, its corresponding second weight value be Y; and the operation change information be Z, its corresponding third weight value be Z. Then, the comprehensive value S = X×X+Y×Y+Z×Z, where X, Y, and Z are normalized to X+Y+Z=1. If the comprehensive value is greater than the corresponding threshold, the detection result can be considered: the target software is ransomware; otherwise, the detection result is considered: the target software is not ransomware. If the target software is determined to be malicious using the malicious signature library, or if the target software is determined to be ransomware based on the detection result, the target software is stopped and the target file is quarantined. If the target software is not malicious or is not ransomware, the detection process ends.
[0043] It can be seen that, for unknown software (i.e., software determined to be non-malicious using a malicious feature library), this embodiment further utilizes a natural language processing model to classify target files created by the target software, obtains file classification results, and determines the creation time of the target file; then, the fluctuation information of the processor usage rate in a period of time before the creation time point and the operation change information of the file directory to which the target file belongs are determined; thus, on the basis of the static detection of the malicious feature library, the file content, directory, and processor usage rate in the same period are further detected, so that it is possible to comprehensively determine whether the software is malicious. The detection of file content, directory, and processor usage rate in the same period is more in line with the actual situation when the malware is running, so the detection accuracy is relatively high, and it also covers the detection of unknown software.
[0044] See Figure 2 A detection system may include: a dynamic data acquisition module, an NLP (Natural Language Processing) model training module, a dynamic detection module, a static detection module and a disposal response module.
[0045] The dynamic data collection module tracks file directory operations and processor usage. Specifically, it monitors file creation, modification, renaming, and deletion operations within key directories, such as the / home / * directory, the / root directory, the database storage path / var / lib / *, and / tmp, which are associated with user data. Data is collected every half minute and recorded in the database. CPU usage is collected every second and recorded in the database.
[0046] The NLP model training module is used to train the NLP model using normal files and files created by known ransomware.
[0047] To accurately identify ransomware content, NLP is used to extract and transform file content features, perform classification and recognition, and ultimately apply them to the dynamic detection module. The model's training data (i.e., normal files and files created by known ransomware) can be dynamically updated, and the updated training data can be used to train the already deployed NLP application.
[0048] Training data construction: A certain number of ransomware and benign files (i.e., normal files) are selected. The ransomware is selected from publicly available and real ransomware and the corresponding ransom letters or notes; benign files can include technical documents, code scripts, news, and other content from various fields.
[0049] Preprocessing and Feature Extraction: Text preprocessing begins with word segmentation, punctuation and stop word removal, and lemmatization. Word segmentation breaks text into words or phrases, for example, "Pay 1000" → ["Pay", "1000"]. Punctuation and stop word removal removes punctuation and common meaningless words, such as "the" and "is," while retaining threatening keywords, such as "decrypt" and "bitcoin." Lemmatization restores words to their root form, for example, "encrypting" → "encrypt," to prevent word form variations from interfering with semantic analysis.
[0050] Feature extraction: Use term frequency-inverse document frequency (TF-IDF) vectorization and perform chi-square feature selection.
[0051] Specifically, the TF-IDF matrix is generated based on word segmentation, which is expressed as TF-IDF(t,d)=TF(t,d)×log(N / DF(t)), where N is the total number of documents and DF(t) is the number of documents containing word t.
[0052] Chi-square feature selection is used to select the most informative feature from the TF-IDF matrix, which has the greatest dependency on the target class (ransomware or benign). This feature is expressed as: x²(t,c)=(AD-BC)² / (A+B)(C+D)(A+C)(B+D), where A is the number of times word t appears in the ransomware class, B is the number of times it appears in the benign class, and C and D are the number of times it does not appear.
[0053] In NLP, a multinomial naive Bayes classifier can be used for classification tasks. This classifier is particularly well-suited for processing high-dimensional, sparse text data, boasts high computational efficiency, and makes reasonable assumptions about independent features. Based on this, and using Bayes' theorem, it can calculate the probability that a file is a ransom note or ransomware. Specifically, this classifier includes the TF-IDF vectorizer, chi-square feature selector, and multinomial naive Bayes classifier. These components are serialized into files for direct loading by the dynamic detection module. When the model needs to be updated, training continues using the new files to generate a new TF-IDF vectorizer, chi-square feature selector, and multinomial naive Bayes classifier, which are then updated to the dynamic detection module.
[0054] The static detection module is used to hook the Linux kernel's exec function through eBPF (Extended Berkeley Packet Filter) to capture process execution events. Specifically, it obtains the startup information of the initiator, including the process ID, process name, and executable file path. This information is passed to the user-mode program. The user-mode program calculates the SHA-256 hash value of the process file and compares it with the malware signature library. If a match is found, the process is immediately terminated. The response module is then notified to perform actions such as killing the process and isolating the file. If a match is found, the process ends.
[0055] The dynamic detection module uses the sys_enter_openat function to capture process file creation events. It parses the flags parameter (such as the O_CREAT flag) to identify new file creation operations and then records relevant metadata, including the file path, process ID (PID), and timestamp. The userspace program retrieves the file metadata sent from the kernel state and reads the contents of the newly created file in real time. The NLP model parses the created file content in real time, ultimately outputting a ransomware probability value. If the ransomware probability value exceeds a preset threshold, the file is considered a ransomware letter or bill; otherwise, it is not considered a ransomware letter or bill.
[0056] The dynamic detection module initiates a multimodal assessment. Specifically, the following steps are performed: Based on data collected by the dynamic data collection module, the module extracts data from the period T minutes before file creation (i.e., the period preceding file creation) and calculates the half-minute change rate and duration (t) of operations within the file's directory and / or other directories. If the mutation rate and duration (t) exceed a set threshold, the file directory is deemed to have abnormal activity. Similarly, the module extracts CPU usage data from the period T minutes before file creation and calculates the CPU mutation rate and duration. If the mutation rate and duration (t) exceed a set threshold, the module determines that the CPU usage is abnormal. The module then comprehensively determines whether the software is ransomware based on the NLP model output, the determination of whether the file directory is abnormal, and the determination of whether the CPU usage is abnormal. For example, if all three are abnormal, the software is considered ransomware; or, if only one of the three is abnormal, the software is considered ransomware. Once the software is confirmed to be ransomware, the module is notified to perform actions such as process termination and file quarantine to prevent further execution of the program. Information such as the software's name and signature value (such as the SHA-256 hash value) can also be stored in a malicious signature database.
[0057] See Figure 3 Static detection is initiated for the exec system call: a user-mode program calculates the SHA-256 hash value of the program file corresponding to the process and compares it with a pre-set malware signature library. If a match is found, the process is immediately terminated; otherwise, dynamic detection continues. Dynamic detection of the process: calls to the sys_enter_openat system function are tracked, file creation events are captured, and text content is classified in real time using natural language processing (NLP). If the probability given by NLP exceeds the preset threshold, a comprehensive judgment is made based on user directory file operations and changes in CPU usage. If the comprehensive judgment is that it is ransomware, the response model kills the process to prevent the software from further encrypting and damaging system files.
[0058] As can be seen in this embodiment, static detection primarily involves capturing new executing processes and then performing feature comparison and confirmation. Dynamic detection primarily involves using a trained model to read and analyze the content of a new file when it is created, distinguishing between genuine ransomware and benign files. This system then performs a multimodal comprehensive assessment based on file directory operation events and CPU usage. This allows the system to disrupt ransomware operations before file encryption and ransom demands are fulfilled. Immediate action can be taken against ransomware, including terminating the ransomware process, deleting the executable ransomware program, and isolating program files to prevent further system damage. This allows for rapid detection and defense against zero-day ransomware.
[0059] The following introduces a software detection device provided in an embodiment of the present application. The software detection device described below can be referenced with other embodiments described in this document.
[0060] See also Figure 4 As shown, the embodiment of the present application discloses a software detection device, including:
[0061] An analysis module is configured to classify target files created by the target software using a natural language processing model if the target software is determined to be non-malicious using a malicious signature library, obtain a file classification result, and determine the creation time of the target file;
[0062] A determination module, configured to determine fluctuation information of a processor usage rate within a period of time before a creation time point, and operation change information of a file directory to which a target file belongs;
[0063] The detection module is used to determine the detection result of the target software based on the file classification result, fluctuation information and operation change information.
[0064] In one embodiment, the analysis module is used to:
[0065] Track the target software in kernel mode to capture the target files created by the target software;
[0066] The natural language processing model is used to perform word segmentation on the file content of the target file, statistical weighted features are extracted from the word segmentation results, and the statistical weighted features are classified to obtain the file classification results.
[0067] In one embodiment, the determination module is configured to:
[0068] Get the processor usage rate for a period of time before the creation time point;
[0069] Construct a usage fluctuation curve based on the obtained processor usage;
[0070] The usage rate fluctuation curve is used as the fluctuation information.
[0071] In one embodiment, the determination module is configured to:
[0072] Get the processor usage rate for a period of time before the creation time point;
[0073] Calculate the usage mutation rate and mutation duration based on the obtained processor usage;
[0074] The usage mutation rate and mutation duration are used as fluctuation information.
[0075] In one embodiment, the determination module is configured to:
[0076] Get the file operation events in the file directory where the target file belongs within a period of time before the creation time point;
[0077] Calculate the operation change rate and change duration of file operation events;
[0078] The operation change rate and change duration are used as the operation change information.
[0079] In one embodiment, the detection module is used to:
[0080] If the target software is determined to be abnormal based on the file classification result, the processor usage is determined to be abnormal based on the fluctuation information, and the file directory to which the target file belongs is determined to be abnormal based on the operation change information, then the detection result is determined to be ransomware; or, a comprehensive value is calculated based on the file classification result and its corresponding first weight value, the fluctuation information and its corresponding second weight value, and the operation change information and its corresponding third weight value; and whether the target software is ransomware is determined based on the comprehensive value.
[0081] In one embodiment, it further includes:
[0082] The protection module is configured to stop the target software and isolate the target file if the target software is determined to be malicious using the malicious signature library or is determined to be ransomware based on the detection results. After stopping the target software and isolating the target file, the module further includes recording the name and / or signature value of the target software in the malicious signature library.
[0083] In one embodiment, the detection module is used to: if it is determined based on the file classification result that the target software has an abnormality, based on the fluctuation information that the processor usage has an abnormality, or based on the operation change information that the file directory to which the target file belongs has an abnormality, then determine that the detection result is that the target software is ransomware.
[0084] In one embodiment, the detection module is used to: if it is determined based on the file classification result that the target software has no abnormalities, based on the fluctuation information that the processor usage has no abnormalities, and based on the operation change information that the file directory to which the target file belongs has no abnormalities, then determine that the detection result is that the target software is not ransomware.
[0085] In one embodiment, the detection module is used to: calculate a comprehensive value based on the file classification result and its corresponding first weight value, the fluctuation information and its corresponding second weight value, and the operation change information and its corresponding third weight value; and determine whether the target software is ransomware based on the comprehensive value.
[0086] In one embodiment, the detection module is used to calculate a comprehensive value according to the formula S=X×a+Y×b+Z×c, where S represents the comprehensive value, X represents the file classification result, a represents the first weight value corresponding to the file classification result, Y represents the fluctuation information, b represents the second weight value corresponding to the fluctuation information, Z represents the operation change information, and c represents the third weight value corresponding to the operation change information.
[0087] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.
[0088] It can be seen that this embodiment provides a software detection device that can further detect file content, directories and processor usage during the same period on the basis of static detection of the malicious feature library, so as to comprehensively determine whether the software is malicious. The detection of file content, directory and processor usage during the same period is more in line with the actual situation when the malware is running, so the detection accuracy is relatively high, and it also covers the detection of unknown software.
[0089] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below can be referenced with other embodiments described herein.
[0090] See also Figure 5 As shown, the embodiment of the present application discloses an electronic device, including:
[0091] Memory 501, used for storing computer programs;
[0092] The processor 502 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.
[0093] Furthermore, the embodiment of the present application also provides an electronic device. The electronic device can be Figure 6 The server shown can also be Figure 7 The terminal shown. Figure 6 and Figure 7 Each of the diagrams is a structural diagram of an electronic device according to an exemplary embodiment, and the contents in the diagrams cannot be considered as any limitation on the scope of use of the present application.
[0094] Figure 6 This is a schematic diagram of the structure of a server provided in an embodiment of the present application. The server may specifically include: at least one processor, at least one memory, a power supply, a communication interface, an input / output interface, and a communication bus. The memory is used to store a computer program, which is loaded and executed by the processor to implement the relevant steps of the software detection disclosed in any of the aforementioned embodiments.
[0095] In this embodiment, the power supply is used to provide operating voltage for each hardware device on the server; the communication interface can create a data transmission channel between the server and external devices. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface is used to obtain external input data or output data to the outside world. The specific interface type can be selected according to specific application needs and is not specifically limited here.
[0096] In addition, the memory as a carrier for resource storage can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon include operating system, computer programs and data, etc. The storage method can be temporary storage or permanent storage.
[0097] The operating system is used to manage and control the hardware devices and computer programs on the server, enabling the processor to operate and process data in the memory. It can be Windows Server, NetWare, Unix, Linux, etc. In addition to computer programs capable of implementing the software detection method disclosed in any of the aforementioned embodiments, computer programs can also include computer programs capable of performing other specific tasks. Data can include data such as application update information and information about the application developer.
[0098] Figure 7 This is a schematic diagram of the structure of a terminal provided in an embodiment of the present application. The terminal may specifically include but is not limited to a smartphone, tablet computer, laptop computer or desktop computer.
[0099] Generally, the terminal in this embodiment includes: a processor and a memory.
[0100] The processor may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor may be implemented in at least one of the following hardware forms: a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), or a PLA (Programmable Logic Array). The processor may also include a main processor and a coprocessor. The main processor is used to process data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing content required to be displayed on the display. In some embodiments, the processor may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.
[0101] The memory may include one or more computer non-volatile storage media, which may be non-transitory. The memory may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory is used to store at least the following computer program, wherein, after the computer program is loaded and executed by the processor, it can implement the relevant steps in the software detection method performed by the terminal side disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory may also include an operating system and data, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system may include Windows, Unix, Linux, etc. The data may include but is not limited to update information of the application.
[0102] In some embodiments, the terminal may further include a display screen, an input and output interface, a communication interface, a sensor, a power supply, and a communication bus.
[0103] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation to the terminal, and may include more or fewer components than shown in the figure.
[0104] A non-volatile storage medium provided in an embodiment of the present application is introduced below. The non-volatile storage medium described below can be referenced with other embodiments described herein.
[0105] A non-volatile storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the software detection method disclosed in the aforementioned embodiment. The non-volatile storage medium is a computer-readable non-volatile storage medium that, as a carrier for resource storage, may be a read-only memory, random access memory, magnetic disk, or optical disk. The resources stored thereon include an operating system, computer program, and data, and the storage method may be either temporary or permanent.
[0106] A computer program product provided in an embodiment of the present application is introduced below. The computer program product described below can be referenced with other embodiments described herein.
[0107] A computer program product includes a computer program / instruction, which implements the steps of the software detection method disclosed above when the computer program / instruction is executed by a processor.
[0108] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0109] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of non-volatile storage medium known in the art.
[0110] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.
Claims
1. A software detection method, characterized in that: include: If the target software is determined to be non-malicious using the malicious signature library, the target files created by the target software are classified using a natural language processing model to obtain a file classification result, and the creation time of the target files is determined; Determining fluctuation information of a processor usage rate within a period of time before the creation time point, and operation change information of a file directory to which the target file belongs; A detection result of the target software is determined based on the file classification result, the fluctuation information, and the operation change information.
2. The method according to claim 1, characterized in that Target files created by the target software are classified using a natural language processing model to obtain file classification results, including: Tracking the target software in kernel mode to capture the target file created by the target software; The file content of the target file is segmented using a natural language processing model, statistical weighted features are extracted from the word segmentation results, and the statistical weighted features are classified to obtain the file classification result.
3. The method according to claim 1, characterized in that Determining fluctuation information of the processor usage rate within a period of time before the creation time point, including: Obtaining the processor usage rate within a period of time before the creation time point; Construct a usage fluctuation curve based on the obtained processor usage; The usage rate fluctuation curve is used as the fluctuation information.
4. The method according to claim 1, wherein Determining fluctuation information of the processor usage rate within a period of time before the creation time point, including: Obtaining the processor usage rate within a period of time before the creation time point; Calculate the usage mutation rate and mutation duration based on the obtained processor usage; The usage rate mutation rate and the mutation duration are used as the fluctuation information.
5. The method according to claim 1, wherein Determining operation change information of the file directory to which the target file belongs within a period of time before the creation time point includes: Acquire file operation events in the file directory to which the target file belongs within a period of time before the creation time point; Calculating the operation change rate and change duration of the file operation event; The operation change rate and the change duration are used as the operation change information.
6. The method according to claim 1, characterized in that Determining a detection result of the target software based on the file classification result, the fluctuation information, and the operation change information includes: If it is determined that the target software is abnormal based on the file classification result, the processor usage is abnormal based on the fluctuation information, and the file directory to which the target file belongs is abnormal based on the operation change information, then the detection result is determined to be ransomware.
7. The method according to claim 1, characterized in that Determining a detection result of the target software based on the file classification result, the fluctuation information, and the operation change information includes: If it is determined that the target software is abnormal based on the file classification result, the processor usage is abnormal based on the fluctuation information, or the file directory to which the target file belongs is abnormal based on the operation change information, the detection result is determined to be ransomware.
8. The method according to claim 1, characterized in that Determining a detection result of the target software based on the file classification result, the fluctuation information, and the operation change information includes: If it is determined that the target software has no abnormalities based on the file classification result, the processor usage has no abnormalities based on the fluctuation information, and the file directory to which the target file belongs has no abnormalities based on the operation change information, then the detection result is determined to be that the target software is not ransomware.
9. The method according to claim 1, characterized in that Determining a detection result of the target software based on the file classification result, the fluctuation information, and the operation change information includes: Calculating a comprehensive value based on the file classification result and its corresponding first weight value, the fluctuation information and its corresponding second weight value, and the operation change information and its corresponding third weight value; Determine whether the target software is ransomware based on the comprehensive value.
10. The method according to claim 9, characterized in that Calculating a comprehensive value based on the file classification result and its corresponding first weight value, the fluctuation information and its corresponding second weight value, and the operation change information and its corresponding third weight value includes: The comprehensive value is calculated according to the formula S=X×a+Y×b+Z×c; S represents the comprehensive value, X represents the file classification result, a represents the first weight value corresponding to the file classification result, Y represents the fluctuation information, b represents the second weight value corresponding to the fluctuation information, Z represents the operation change information, and c represents the third weight value corresponding to the operation change information.
11. The method according to any one of claims 1 to 10, characterized in that Also includes: If the target software is determined to be malicious using the malicious feature library, or if the target software is determined to be ransomware based on the detection result, the target software is stopped from running and the target file is isolated.
12. The method according to claim 11, characterized in that After stopping the target software and isolating the target file, the method further includes: The name and / or feature value of the target software is recorded in the malicious feature library.
13. A software detection device, characterized in that: include: An analysis module is configured to classify target files created by the target software using a natural language processing model if the target software is determined to be non-malicious using a malicious signature library, obtain a file classification result, and determine a creation time of the target file; a determination module, configured to determine fluctuation information of a processor usage rate within a period of time before the creation time point, and operation change information of a file directory to which the target file belongs; A detection module is used to determine a detection result of the target software based on the file classification result, the fluctuation information and the operation change information.
14. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the method according to any one of claims 1 to 12.
15. A non-volatile storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.