Automatic malicious sample detection method and device, electronic equipment and storage medium

Abstract

The invention provides an automatic malicious sample detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a target network flow, restoring a target executable file contained in the target network flow from the target network flow, and carrying out the detection of the target executable file according to a preset anomaly detection rule, under the condition that the detection result indicates that the target executable file meets the preset abnormal condition, determining that the target executable file is a malicious sample, and extracting preset information contained in target network traffic corresponding to the target executable file to obtain an increment anomaly detection rule, according to the method, the increment anomaly detection rule is obtained, and the preset anomaly detection rule is updated by using the increment anomaly detection rule, so that the preset anomaly detection rule is dynamically updated based on the actual network flow, the timeliness of updating the anomaly detection rule is improved, and the detection rate and accuracy of malicious samples detected based on the anomaly detection rule are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of attack behavior detection, and in particular to an automated malicious sample detection method, device, electronic device, and storage medium. Background Art

[0002] Malicious sample detection and analysis is one of the most pressing issues in network security. Faced with the increasingly mature network environment of office network protection, hackers are focusing more on social engineering attacks on users, especially by constructing malicious Trojan samples to trick users into downloading and executing them in order to invade office systems.

[0003] Malicious samples utilize techniques such as obfuscation, encryption, anti-debugging, and anti-sandbox detection, challenging traditional signature-based detection methods. However, malicious samples often spread in a family-like manner. Hackers continuously update malicious samples, creating numerous variants that are bundled and intermingled with legitimately transmitted files, significantly impacting detection time and efficiency. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an automated malicious sample detection method, apparatus, electronic device, and storage medium to improve the malicious sample detection rate.

[0005] According to one aspect of the present invention, a method for automatically detecting malicious samples is provided, the method comprising: Obtain target network traffic according to preset rules; extracting a target executable file from the target network traffic; Detecting the target executable file according to preset anomaly detection rules, wherein the preset anomaly detection rules include malicious file signature detection rules, file change behavior detection rules, network communication request detection rules, anti-debugging and anti-sandbox behavior detection rules; Based on the detection result of the target executable file, determining whether the target executable file meets a preset abnormal condition; wherein the preset abnormal condition includes a single behavior or a behavior group consisting of multiple behaviors; When the target executable file meets the preset abnormality condition, extracting the information of the target network traffic according to the preset information to form an incremental abnormality detection rule corresponding to the target executable file; The incremental anomaly detection rule is used to update the preset anomaly detection rule, and subsequent target network traffic is detected according to the updated preset anomaly detection rule.

[0006] In a possible embodiment, the detecting the target executable file according to a preset anomaly detection rule includes: Detecting whether a malicious file signature exists in the target executable file using the malicious file signature detection rule; Utilizing the file change behavior detection rules to detect whether the target executable file contains any file creation, modification, or deletion behaviors, any behavior of modifying key registry values, any process creation behaviors, or any behavior of adding startup items; Detecting whether the target executable file has an abnormal network communication request using the network communication request detection rule; The anti-debugging and anti-sandbox behavior detection rules are used to detect whether the target executable file contains anti-debugging and anti-sandbox detection behaviors.

[0007] In a possible embodiment, determining whether the target executable file meets a preset abnormality condition based on the detection result of the target executable file includes: In the case where the target executable file contains one or more of a malicious file signature, a network communication request of a malicious domain name, anti-debugging, and anti-sandbox detection behavior, determining that the target executable file meets the preset abnormal condition; or The target executable file contains behaviors of creating, modifying, deleting files, creating processes, and adding startup items, and it is determined that the target executable file meets the preset abnormal condition.

[0008] In a possible embodiment, the preset abnormal condition is obtained in advance by the following steps: Obtain historical behavior data corresponding to multiple historical malicious samples; The historical behavior data are counted, and a preset number of historical behavior data or historical behavior data groups with the highest number of occurrences are used as preset abnormal conditions.

[0009] In a possible embodiment, extracting the target network traffic information according to preset information to form an incremental anomaly detection rule corresponding to the target executable file includes: Byte sequences, character strings, behavioral features, and file signatures contained in the target network traffic are extracted as incremental anomaly detection rules.

[0010] According to another aspect of the present invention, an automated malicious sample detection device is provided, the device comprising: The acquisition module is used to obtain target network traffic according to preset rules; A restoration module, configured to restore a target executable file from the target network traffic; a detection module, configured to detect the target executable file according to preset anomaly detection rules, wherein the preset anomaly detection rules include malicious file signature detection rules, file change behavior detection rules, network communication request detection rules, and anti-debugging and anti-sandbox behavior detection rules; a determination module, configured to determine whether the target executable file satisfies a preset abnormality condition based on the detection result of the target executable file; wherein the preset abnormality condition includes a single behavior or a behavior group consisting of multiple behaviors; An extraction module is used to extract information of the target network traffic according to preset information when the target executable file meets the preset abnormality condition, and form an incremental abnormality detection rule corresponding to the target executable file; An updating module is used to update the preset anomaly detection rule using the incremental anomaly detection rule, and detect subsequent target network traffic according to the updated preset anomaly detection rule.

[0011] In a possible embodiment, the detecting the target executable file according to a preset anomaly detection rule includes: Detecting whether a malicious file signature exists in the target executable file using the malicious file signature detection rule; Utilizing the file change behavior detection rules to detect whether the target executable file contains any file creation, modification, or deletion behaviors, any behavior of modifying key registry values, any process creation behaviors, or any behavior of adding startup items; Detecting whether the target executable file has an abnormal network communication request using the network communication request detection rule; The anti-debugging and anti-sandbox behavior detection rules are used to detect whether the target executable file contains anti-debugging and anti-sandbox detection behaviors.

[0012] In a possible embodiment, determining whether the target executable file meets a preset abnormality condition based on the detection result of the target executable file includes: In the case where the target executable file contains one or more of a malicious file signature, a network communication request of a malicious domain name, anti-debugging, and anti-sandbox detection behavior, determining that the target executable file meets the preset abnormal condition; or The target executable file contains a behavior of creating, modifying, deleting a file, creating a process, or adding a startup item, and determines that the target executable file meets the preset abnormal condition; The preset abnormal condition is obtained in advance by the following steps: Obtain historical behavior data corresponding to multiple historical malicious samples; Counting each of the historical behavior data, and taking a preset number of historical behavior data or historical behavior data groups with the highest number of occurrences as preset abnormal conditions; The step of extracting the target network traffic information according to preset information to form an incremental anomaly detection rule corresponding to the target executable file includes: Byte sequences, character strings, behavioral features, and file signatures contained in the target network traffic are extracted as incremental anomaly detection rules.

[0013] According to another aspect of the present invention, there is provided an electronic device, comprising: processor; and Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to execute any of the above-mentioned automated malicious sample detection methods.

[0014] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute any of the above-mentioned automated malicious sample detection methods.

[0015] One or more technical solutions provided in the embodiments of the present invention obtain the target network traffic, restore the target executable file contained in the target network traffic from the target network traffic, and detect the target executable file according to the preset anomaly detection rule. When the detection result indicates that the target executable file meets the preset anomaly condition, it is determined that the target executable file is a malicious sample, and the preset information contained in the target network traffic corresponding to the target executable sample is extracted to obtain an incremental anomaly detection rule, and the preset anomaly detection rule is updated using the incremental anomaly detection rule, thereby realizing dynamic updating of the preset anomaly detection rule based on actual network traffic, improving the timeliness of the anomaly detection rule update, and thereby improving the detection rate and accuracy of malicious samples detected based on the anomaly detection rule. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Further details, features and advantages of the present invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A schematic diagram of a process flow of an automated malicious sample detection method provided by an embodiment of the present invention; Figure 2 A schematic diagram of another process of the automated malicious sample detection method provided by an embodiment of the present invention; Figure 3 A schematic diagram of the structure of an automated malicious sample detection device provided by an embodiment of the present invention; Figure 4A block diagram of an exemplary electronic device capable of implementing the embodiments of the present invention is shown. DETAILED DESCRIPTION

[0017] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0018] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0019] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0020] It should be noted that the modifications of "one" and "multiple" mentioned in the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0021] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0022] The three most widely used malicious sample detection methods in related technologies include the following: (1) Static engine-based detection method: Static engine detection mainly analyzes the content and structure of sample files, constructs a set of feature library rules such as parameter names and special bytes, and then detects malicious sample file signatures, string features and malicious code fragments after associating and integrating these feature keywords.

[0023] (2) Detection method based on dynamic sandbox: Dynamic sandbox detection collects features by running malicious samples and monitoring their behavior. It needs to be run in an isolated sandbox environment to prevent contamination. This method mainly monitors network behavior and process behavior. This method is a great improvement over the previous method.

[0024] (3) Detection method based on threat intelligence: Threat intelligence detection obtains the hash value of the malicious sample and performs hash collision with the threat intelligence database. This method greatly improves the detection efficiency of public malicious samples, but it cannot detect newly released samples and sample variants.

[0025] Although many of the above methods exist for detecting covert tunnel attacks, they all have varying degrees of flaws in practical applications: (1) The detection method based on static engine and the detection method of constructing characteristic keywords cannot detect the encryption obfuscation technology of malicious samples.

[0026] (2) The detection method based on dynamic sandbox ignores the fact that in today's complex network environment, the amount of files transmitted over the network is very large, and malicious samples only account for a very small part of the huge amount of file transmission. This will pose a high challenge to the detection efficiency and greatly increase the detection cost.

[0027] (3) Detection methods based on threat intelligence can only detect published malicious samples and cannot detect newly released samples or sample variants.

[0028] Based on this, the present invention provides an automated malicious sample detection method, apparatus, electronic device, and storage medium. The automated malicious sample detection method provided by the present invention can be applied to any electronic device with an automated malicious sample detection function, such as a server, computer, or mobile terminal. The following describes the solution of the present invention with reference to the accompanying drawings: Figure 1 A flowchart of an automated malicious sample detection method provided by an embodiment of the present invention may include the following steps: S101, obtaining target network traffic according to preset rules; S102, extracting a target executable file from the target network traffic; S103, detecting the target executable file according to preset anomaly detection rules, wherein the preset anomaly detection rules include malicious file signature detection rules, file change behavior detection rules, network communication request detection rules, anti-debugging and anti-sandbox behavior detection rules; S104: Determine whether the target executable file satisfies a preset abnormality condition based on the detection result of the target executable file; wherein the preset abnormality condition includes a single behavior or a behavior group consisting of multiple behaviors; S105. When the target executable file meets a preset abnormality condition, extract information of the target network traffic according to preset information to form an incremental abnormality detection rule corresponding to the target executable file; S106: Use the incremental anomaly detection rule to update the preset anomaly detection rule, and detect subsequent target network traffic according to the updated preset anomaly detection rule.

[0029] By applying the embodiment of the present invention, after obtaining the target network traffic, the target executable file contained therein is restored from the target network traffic, and the target executable file is detected according to the preset anomaly detection rule. When the detection result indicates that the target executable file meets the preset anomaly condition, the target executable file is determined to be a malicious sample, and the preset information contained in the target network traffic corresponding to the target executable sample is extracted to obtain an incremental anomaly detection rule, and the preset anomaly detection rule is updated using the incremental anomaly detection rule, thereby realizing dynamic updating of the preset anomaly detection rule based on actual network traffic, improving the timeliness of the anomaly detection rule update, and further improving the detection rate and accuracy of malicious samples detected based on the anomaly detection rule.

[0030] The following is an exemplary description of S101-S106: The automated malicious sample detection method provided by the present invention can be applied to a network service system. Therefore, the target traffic data obtained in S101 can be traffic data received or sent by the network service. In a possible embodiment, in order to ensure the quality of the acquired target traffic data, the target traffic data in the system can be collected when the data stream is in a stable and reliable transmission state and there is no large traffic delay and fluctuation. As a possible implementation method, a traffic delay threshold can be preset, and the traffic processing detection engine can be used to collect target traffic data when the traffic delay in the system network is lower than the traffic delay threshold. The collection can be performed in units of data packets, that is, one data packet corresponds to one target traffic data, or multiple data packets within a preset time window can constitute one target traffic data. The present invention does not make specific limitations on this.

[0031] The target traffic data typically contains a variety of information, such as the protocol version, source IP address, destination IP address, HTTP header, application layer data, payload data, etc., where the payload data (i.e., executable file) is the instructions and data actually executed by the computer. Therefore, in order to analyze whether the executable file actually contained in the target traffic data is a malicious sample, it is necessary to restore the executable file from the target traffic data. In one possible embodiment, the target executable file contained in the target traffic data can be restored using a restoration tool such as Wireshark or Cpxtract, or the target executable file contained in the target traffic data can be restored using an IDS (Intrusion Detection System), which is not specifically limited in the present invention.

[0032] After obtaining the target executable file, the target executable file can be detected according to the preset detection rules. The preset detection rules can be set according to the actual application scenario to detect whether the target executable file has a preset behavior. As a possible implementation method, the target executable file can be detected by the following steps: S21, using the malicious file signature detection rule to detect whether there is a malicious file signature in the target executable file; S22, using the file change behavior detection rule to detect whether the target executable file has any behavior of creating, modifying, or deleting files, modifying key registry values, creating processes, or adding startup items; S23, using the network communication request detection rule to detect whether the target executable file has an abnormal network communication request; S24: Detect whether the target executable file has anti-debugging and anti-sandbox detection behaviors by using the anti-debugging and anti-sandbox behavior detection rules.

[0033] Malicious file signatures refer to files whose hash values, digital signatures, or metadata match known malware signatures, or exhibit unusual signature characteristics. File creation, modification, or deletion refers to unauthorized additions, deletions, or alterations to system files, user data, or critical directories, potentially used to implant malicious components or eliminate traces. Adding startup items refers to programs modifying the registry or system configuration to automatically run at system startup, achieving persistent control. Modifying critical registry values ​​refers to tampering with key registry entries that control security policies, service operations, or user permissions, potentially disabling security tools, hiding the program, or elevating privileges. Suspicious network communication requests refer to programs establishing connections to unusual IP addresses, domain names, or ports, or transmitting content containing encrypted malicious commands, potentially communicating with hacker-controlled servers. Process creation refers to programs creating new processes or invoking system tools to execute commands, potentially used to spread attacks or conceal malicious activity. Anti-debugging / anti-sandbox detection refers to programs actively detecting whether they are in a security analysis environment (such as a debugger or sandbox) and modifying their behavior accordingly to evade detection.

[0034] In the embodiment of the present invention, the detection order of the above items is not specifically limited. The above items can be detected in any order. The specific detection strategy of each item can also be selected according to the actual application scenario. The present invention only provides a simple example for explanation: To detect malicious file signatures, hash comparison, file header feature analysis, and digital signature verification can be used to detect the presence of malicious file signatures in the target executable file. For example, the MD5 / SHA-256 hash value of the target executable file can be calculated and compared with a known malicious file repository (such as VirusTotal or NSRL). If the comparison is successful, the target executable file is determined to contain a malicious file signature. It is also possible to check whether the PE file header (such as the MZ or PE tag) has been tampered with or contains suspicious section names (such as .malware). Alternatively, the digital signature of the Windows executable file can be checked to see if it is valid and issued by a trusted vendor. If the PE file header has been tampered with, contains suspicious section names, the digital signature is invalid, or the source is untrusted, the target executable file can be determined to contain a malicious file signature.

[0035] For file operations, file system monitoring and sandbox execution can be used to determine whether the target executable file creates, modifies, or deletes files. For example, API hooks (such as Windows' NtCreateFile and NtDeleteFile) or file system filter drivers can be used to monitor file operations. Alternatively, files can be run in an isolated environment (such as Cuckoo Sandbox) to record all file system changes and determine whether the target executable file creates, modifies, or deletes files.

[0036] To add a startup item, you can run the target executable file in an isolated environment and determine whether there is a new item in the startup item registry path, or scan the startup item directory to determine whether there is a new startup item.

[0037] For critical registry modification behavior, you can run the target executable file in a sandbox environment and monitor the preset critical registry path to determine whether there is any operation behavior, or compare the differences in the critical registry before and after the target executable file is run. If there are differences, it can be determined that the target executable file has critical registry modification behavior.

[0038] For suspicious network communication requests, network traffic monitoring, domain name resolution checks, and TLS fingerprint analysis can be used to determine whether suspicious communication requests exist in the target executable file. For example, network traffic monitoring can include capturing and analyzing network connections established by the program (IP, port, and transmission content), and domain name resolution checks can include monitoring DNS requests to identify communications with malicious domains. TLS fingerprint analysis can include identifying suspicious encrypted communications through JA3 / JA3S fingerprinting.

[0039] Regarding process creation behavior, tree monitoring and abnormal process analysis can be used to determine whether the target executable file has created a process. For example, the target executable file can be run in a sandbox and the process tree can be used to record all child processes and command line parameters created by the target executable file to determine whether process creation has occurred. Alternatively, the target executable file can be tested for indirect execution through system tools such as rundll32.exe and powershell.exe to determine whether the target executable file has created a process.

[0040] To detect anti-debugging and anti-sandbox behavior, the target executable can be tested for anti-debugging and anti-sandbox behavior through methods such as API call analysis, environmental detection, and behavioral pattern analysis. For example, the target executable can be tested to see if it calls anti-debugging APIs (such as IsDebuggerPresent and CheckRemoteDebuggerPresent). If so, the target executable is determined to have anti-debugging behavior. The target executable can also be monitored to see if it attempts to detect virtual machine features (such as VMware Tools drivers) or sandbox timestamps. The target executable can also be tested for its differentiated behavior in different environments (such as hibernation in a sandbox and activation in a live environment). If any of the above behaviors are present, the target executable can be determined to have anti-debugging and anti-sandbox behavior.

[0041] After performing the above-mentioned detection on the target executable file, it can be determined based on the detection results whether the target executable file meets the preset abnormality conditions. The preset abnormality conditions can be obtained based on historical malicious samples. As a possible implementation method, the behavioral data of malicious samples appearing in the system can be recorded and the behavioral data of each historical malicious sample can be statistically analyzed to generate the preset abnormality conditions. For example, the behavioral data with the highest number of occurrences can be used as the preset abnormality conditions. The preset abnormality conditions can include a single behavior or a behavior group consisting of multiple behaviors. For example, the behavioral data with the highest number of occurrences in historical malicious samples include malicious file signatures, network communication requests with malicious domain names, anti-debugging and anti-sandbox detection behaviors, the simultaneous addition of startup items and modification of key registry values, or the simultaneous creation / modification / deletion of files and creation of processes. These behaviors can be used as the preset abnormality conditions. The number of behaviors included in the behavior group of the preset abnormality conditions can be set according to the actual application scenario. For example, if the missed detection rate needs to be reduced, the number of behaviors included in the behavior group can be set to a smaller number, such as 2. If the detection accuracy needs to be improved, the number of behaviors included in the behavior group can be set to a larger number, such as 4. By controlling the granularity of abnormal conditions, more diverse business needs can be met, thereby improving the application efficiency of the automated malicious sample detection method provided by the embodiment of the present invention.

[0042] In a possible embodiment, when the target executable file contains one or more of a malicious file signature, a network communication request of a malicious domain name, an anti-debugging behavior, and an anti-sandbox detection behavior, it is determined that the target executable file meets the preset abnormal condition; or The target executable file contains behaviors of creating, modifying, deleting files, creating processes, and adding startup items, and it is determined that the target executable file meets the preset abnormal condition.

[0043] When the target executable file meets the preset anomaly conditions, preset information in the target traffic data can be extracted to form incremental anomaly detection rules. This preset information can be set according to the actual application scenario. As a possible implementation, this preset information can include byte sequences, character strings, content, protocols, behavioral characteristics, and file signatures. Accordingly, the corresponding fields in the target traffic data can be matched and the field values ​​obtained to extract the byte sequences, character strings, behavioral characteristics, and file signatures contained in the target network traffic as incremental anomaly detection rules.

[0044] By adding the incremental anomaly detection rule to the preset anomaly detection rule, an updated anomaly detection rule can be obtained, and the updated anomaly detection rule can be used to detect network traffic in the system later.

[0045] like Figure 2 As stated, Figure 2 Another flowchart of the automated malicious sample detection method provided by an embodiment of the present invention may include the following process: After acquiring network traffic, the executable files in the network traffic are restored. There can be multiple executable files, and each executable file can be detected and analyzed separately. Specifically, the system can mark whether the file signature is malicious, whether there is any behavior of creating, modifying, or deleting files, whether there is any addition of startup items, whether there is any modification of key registry values, whether there is any network request communication, whether there is any process creation behavior, and whether there is any anti-call or anti-sandbox detection behavior.

[0046] After performing the above-mentioned detection on each executable file, it can be determined based on the detection results whether the executable file meets the preset abnormal conditions. Specifically, it is determined whether there is a file signature marking maliciousness in the executable file. If so, it is determined that the executable file meets the preset abnormal conditions. If not, it is determined whether there are creation / modification / deletion behaviors and process creation behaviors in the executable file. If so, it is determined that the executable file meets the preset abnormal conditions. If not, it is determined whether the executable file has the behavior of adding startup items and the behavior of modifying key registry values. If so, it is determined that the executable file meets the preset abnormal conditions. If not, it is determined whether the executable file has network communication requests with malicious domain names. If so, it is determined that the executable file meets the preset abnormal conditions. If not, it is determined whether the executable file has anti-debugging and anti-sandbox detection behaviors. If so, it is determined that the executable file meets the preset abnormal conditions. If not, the traffic is terminated.

[0047] For executable files that meet preset anomaly conditions, the byte sequence, string, content, protocol, behavioral characteristics and file signature in the executable file can be automatically extracted to generate incremental anomaly detection rules.

[0048] By applying the embodiments of the present invention, statistical analysis is effectively combined with automated rule compilation to construct an analysis model, enabling feature extraction and detection rule implementation for malicious samples. Specifically, the present invention aggregates the behavioral characteristics of malicious samples and automatically compiles them into specific detection rules. This allows malicious sample files that match the feature rules to be mined from a large number of transmitted files, significantly improving detection efficiency and accuracy in actual business scenarios.

[0049] Based on the same inventive concept, an embodiment of the present invention further provides an automated malicious sample detection device, such as Figure 3 As shown, the apparatus 300 may include: Acquisition module 301, used to acquire target network traffic according to preset rules; Restoring module 302, used to restore the target executable file from the target network traffic; A detection module 303 is configured to detect the target executable file according to preset anomaly detection rules, wherein the preset anomaly detection rules include malicious file signature detection rules, file change behavior detection rules, network communication request detection rules, and anti-debugging and anti-sandbox behavior detection rules; A determination module 304 is configured to determine whether the target executable file satisfies a preset abnormality condition based on the detection result of the target executable file; wherein the preset abnormality condition includes a single behavior or a behavior group consisting of multiple behaviors; An extraction module 305 is configured to extract information about the target network traffic according to preset information when the target executable file meets a preset abnormality condition, and form an incremental abnormality detection rule corresponding to the target executable file; The updating module 306 is configured to update the preset anomaly detection rule using the incremental anomaly detection rule, and detect subsequent target network traffic according to the updated preset anomaly detection rule.

[0050] In a possible embodiment, the detecting the target executable file according to a preset anomaly detection rule includes: Detecting whether a malicious file signature exists in the target executable file using the malicious file signature detection rule; Utilizing the file change behavior detection rules to detect whether the target executable file contains any file creation, modification, or deletion behaviors, any behavior of modifying key registry values, any process creation behaviors, or any behavior of adding startup items; Detecting whether the target executable file has an abnormal network communication request using the network communication request detection rule; The anti-debugging and anti-sandbox behavior detection rules are used to detect whether the target executable file contains anti-debugging and anti-sandbox detection behaviors.

[0051] In a possible embodiment, determining whether the target executable file meets a preset abnormality condition based on the detection result of the target executable file includes: In the case where the target executable file contains one or more of a malicious file signature, a network communication request of a malicious domain name, anti-debugging, and anti-sandbox detection behavior, determining that the target executable file meets the preset abnormal condition; or The target executable file contains a behavior of creating, modifying, deleting a file, creating a process, or adding a startup item, and determines that the target executable file meets the preset abnormal condition; The preset abnormal condition is obtained in advance by the following steps: Obtain historical behavior data corresponding to multiple historical malicious samples; Counting each of the historical behavior data, and taking a preset number of historical behavior data or historical behavior data groups with the highest number of occurrences as preset abnormal conditions; The step of extracting the target network traffic information according to preset information to form an incremental anomaly detection rule corresponding to the target executable file includes: Byte sequences, character strings, behavioral features, and file signatures contained in the target network traffic are extracted as incremental anomaly detection rules.

[0052] Among them, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0053] An exemplary embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, wherein the computer program, when executed by the at least one processor, causes the electronic device to perform a method according to an embodiment of the present invention.

[0054] Exemplary embodiments of the present invention further provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0055] An exemplary embodiment of the present invention further provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor of a computer, the computer is configured to cause the computer to perform a method according to an embodiment of the present invention.

[0056] refer to Figure 4 , a block diagram of an electronic device 400 that can serve as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0057] like Figure 4 As shown, electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. Various programs and data required for the operation of electronic device 400 may also be stored in RAM 403. Computing unit 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to bus 404.

[0058] Multiple components within electronic device 400 are connected to I / O interface 405, including an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. Input unit 406 can be any type of device capable of inputting information into electronic device 400. Input unit 406 can receive input numeric or character information and generate key input signals related to user settings and / or function control of the electronic device. Output unit 407 can be any type of device capable of presenting information and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. Storage unit 408 may include, but is not limited to, a magnetic disk or an optical disk. Communication unit 409 allows electronic device 400 to exchange information / data with other devices via computer networks such as the Internet and / or various telecommunication networks and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0059] Computing unit 401 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Computing unit 401 performs the various methods and processes described above. For example, in some embodiments, any of the automated malicious sample detection methods described above may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed onto electronic device 400 via ROM 402 and / or communication unit 409. In some embodiments, computing unit 401 may be configured to perform any of the automated malicious sample detection methods described above via any other suitable means (e.g., via firmware).

[0060] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0061] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0062] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., a magnetic disk, an optical disk, a memory, a programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0063] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0064] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0065] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

Claims

1. An automated malicious sample detection method, characterized in that: The method comprises: Obtain target network traffic according to preset rules; extracting a target executable file from the target network traffic; Detecting the target executable file according to preset anomaly detection rules, wherein the preset anomaly detection rules include malicious file signature detection rules, file change behavior detection rules, network communication request detection rules, anti-debugging and anti-sandbox behavior detection rules; Based on the detection result of the target executable file, determining whether the target executable file meets a preset abnormal condition; wherein the preset abnormal condition includes a single behavior or a behavior group consisting of multiple behaviors; When the target executable file meets the preset abnormality condition, extracting the information of the target network traffic according to the preset information to form an incremental abnormality detection rule corresponding to the target executable file; The incremental anomaly detection rule is used to update the preset anomaly detection rule, and subsequent target network traffic is detected according to the updated preset anomaly detection rule.

2. The method according to claim 1, characterized in that The detecting the target executable file according to the preset anomaly detection rules includes: Detecting whether a malicious file signature exists in the target executable file using the malicious file signature detection rule; Utilizing the file change behavior detection rules to detect whether the target executable file contains any file creation, modification, or deletion behaviors, any behavior of modifying key registry values, any process creation behaviors, or any behavior of adding startup items; Detecting whether the target executable file has an abnormal network communication request using the network communication request detection rule; The anti-debugging and anti-sandbox behavior detection rules are used to detect whether the target executable file contains anti-debugging and anti-sandbox detection behaviors.

3. The method according to claim 2, wherein The determining, based on the detection result of the target executable file, whether the target executable file meets a preset abnormality condition includes: In the case where the target executable file contains one or more of a malicious file signature, a network communication request of a malicious domain name, anti-debugging, and anti-sandbox detection behavior, determining that the target executable file meets the preset abnormal condition; or The target executable file contains behaviors of creating, modifying, deleting files, creating processes, and adding startup items, and it is determined that the target executable file meets the preset abnormal condition.

4. The method according to claim 3, characterized in that The preset abnormal condition is obtained in advance by the following steps: Obtain historical behavior data corresponding to multiple historical malicious samples; The historical behavior data are counted, and a preset number of historical behavior data or historical behavior data groups with the highest number of occurrences are used as preset abnormal conditions.

5. The method according to claim 1, wherein The step of extracting the target network traffic information according to preset information to form an incremental anomaly detection rule corresponding to the target executable file includes: Byte sequences, character strings, behavioral features, and file signatures contained in the target network traffic are extracted as incremental anomaly detection rules.

6. An automated malicious sample detection device, characterized in that: The device comprises: The acquisition module is used to obtain target network traffic according to preset rules; A restoration module, configured to restore a target executable file from the target network traffic; a detection module, configured to detect the target executable file according to preset anomaly detection rules, wherein the preset anomaly detection rules include malicious file signature detection rules, file change behavior detection rules, network communication request detection rules, and anti-debugging and anti-sandbox behavior detection rules; a determination module, configured to determine whether the target executable file satisfies a preset abnormality condition based on the detection result of the target executable file; wherein the preset abnormality condition includes a single behavior or a behavior group consisting of multiple behaviors; An extraction module is used to extract information of the target network traffic according to preset information when the target executable file meets the preset abnormality condition, and form an incremental abnormality detection rule corresponding to the target executable file; An updating module is used to update the preset anomaly detection rule using the incremental anomaly detection rule, and detect subsequent target network traffic according to the updated preset anomaly detection rule.

7. The device according to claim 6, characterized in that The detecting the target executable file according to the preset anomaly detection rules includes: Detecting whether a malicious file signature exists in the target executable file using the malicious file signature detection rule; Utilizing the file change behavior detection rules to detect whether the target executable file contains any file creation, modification, or deletion behaviors, any behavior of modifying key registry values, any process creation behaviors, or any behavior of adding startup items; Detecting whether the target executable file has an abnormal network communication request using the network communication request detection rule; The anti-debugging and anti-sandbox behavior detection rules are used to detect whether the target executable file contains anti-debugging and anti-sandbox detection behaviors.

8. The device according to claim 7, characterized in that The determining, based on the detection result of the target executable file, whether the target executable file meets a preset abnormality condition includes: In the case where the target executable file contains one or more of a malicious file signature, a network communication request of a malicious domain name, anti-debugging, and anti-sandbox detection behavior, determining that the target executable file meets the preset abnormal condition; or The target executable file contains a behavior of creating, modifying, deleting a file, creating a process, or adding a startup item, and determines that the target executable file meets the preset abnormal condition; The preset abnormal condition is obtained in advance by the following steps: Obtain historical behavior data corresponding to multiple historical malicious samples; Counting each of the historical behavior data, and taking a preset number of historical behavior data or historical behavior data groups with the highest number of occurrences as preset abnormal conditions; The step of extracting the target network traffic information according to preset information to form an incremental anomaly detection rule corresponding to the target executable file includes: Byte sequences, character strings, behavioral features, and file signatures contained in the target network traffic are extracted as incremental anomaly detection rules.

9. An electronic device comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 5.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 5.

Images