Malicious file interception method, system and equipment based on dynamic mapping relation and storage medium

Abstract

The invention provides a malicious file interception method, system and device based on a dynamic mapping relation and a storage medium, and the method comprises the steps: monitoring a downloading request for a target resource in real time, and carrying out temporary interception processing on the downloading request; analyzing the downloading request to obtain a resource identifier for identifying the target resource, and judging whether the downloading request is a first downloading request of the target resource or not based on the resource identifier; when the downloading request is the first downloading request, obtaining a target file corresponding to the downloading request, and generating file feature data for representing file content features based on the target file; establishing and storing a dynamic mapping relationship between the resource identifier and the file feature data; and performing malicious judgment on the target file based on the dynamic mapping relationship, and executing downloading interception or downloading permission processing according to a judgment result. According to the method and the device, automatic identification of unknown and variant malicious files is realized, repeated feature calculation is reduced, resource consumption is reduced, and timeliness and security of interception are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular relates to a malicious file interception method and system based on a dynamic mapping relationship, a device and a storage medium. BACKGROUND

[0002] With the continuous expansion of Internet business scale, various types of malicious software, malicious scripts and files carrying malicious payloads are increasingly spread through the network. File download channels have become one of the important ways for malicious programs to penetrate and spread. In order to protect the safety of terminal devices and network environment, how to identify and block potential malicious files in a timely and accurate manner in the file download link has become a key research direction in the field.

[0003] Current malicious file detection technologies mainly include static feature matching, behavior analysis detection, and malicious file identification based on machine learning. Among them, static feature matching usually relies on a pre-set malicious file hash library, and determines whether a file is a known malicious file by comparing the hash value (such as MD5, SHA-1, etc.) of the file. This method has certain advantages in terms of detection speed, but it can only identify samples that have been collected. For variant malicious files generated by inserting invalid bytes, slightly modifying the content, etc., their hash values usually change, so that static matching is difficult to play a role.

[0004] Behavior analysis detection usually runs the file to be detected in a controlled environment, and determines whether the file has malicious features by monitoring system calls, file access, process behavior, network activity, etc. during its running process. Although behavior analysis can identify unknown malicious files, such methods usually rely on a sandbox environment, the detection process is time-consuming and resource-intensive, and it is difficult to meet the requirements of real-time interception.

[0005] With the development of machine learning technology, some malicious file detection schemes begin to use trained models to identify the static and dynamic features of malicious files. Such schemes have good identification ability under certain conditions, but model construction usually relies on a large number of labeled samples, and the training cost is high. The generalization ability of the model is easily affected by the change of sample distribution, and it may still misjudge or miss judge when facing unknown samples or new variants.

[0006] In summary, the existing malicious file detection technologies still have obvious deficiencies in dealing with variant malicious files, reducing detection resource consumption, and meeting real-time requirements. Especially in the file download scenario, how to quickly and accurately identify potential malicious files without significantly increasing system load is a technical problem to be solved in the field. SUMMARY

[0007] In view of the deficiencies of the prior art, the application provides a malicious file interception method and system based on a dynamic mapping relationship, equipment and a storage medium, at least to solve the problem that it is difficult to identify and intercept variant or unknown malicious files in a timely and low-resource manner in the prior art.

[0008] To achieve the above object and other advantages, some embodiments of the application provide the following aspects:

[0009] In a first aspect, some embodiments of the application provide a malicious file interception method based on a dynamic mapping relationship, comprising:

[0010] Real-time monitoring of download requests for target resources, and performing temporary interception processing on the download requests;

[0011] Parsing the download request to obtain a resource identifier for identifying the target resource, and determining whether the download request is a first download request for the target resource based on the resource identifier;

[0012] When the download request is a first download request, obtaining a target file corresponding to the download request, and generating file feature data for representing file content characteristics based on the target file;

[0013] Establishing and storing a dynamic mapping relationship between the resource identifier and the file feature data;

[0014] Based on the dynamic mapping relationship, the target file is maliciously determined, and the download interception or download permission processing is performed according to the determination result.

[0015] In a second aspect, some embodiments of the application provide a malicious file interception system based on a dynamic mapping relationship, comprising:

[0016] A download request monitoring module for real-time monitoring of download requests for target resources, and passing the download requests to a file download interception module;

[0017] A request analysis module for analyzing the download request to obtain a resource identifier for identifying the target resource, and determining whether the download request is a first download request for the target resource based on the resource identifier;

[0018] A file feature generation module for obtaining a target file corresponding to the download request when the download request is a first download request, and generating file feature data for representing file content characteristics based on the target file;

[0019] A dynamic mapping management module for establishing and storing a dynamic mapping relationship between the resource identifier and the file feature data;

[0020] The malicious file determination module is configured to determine whether the target file is malicious based on the dynamic mapping relationship, and output a corresponding determination result.

[0021] The file download interception module is configured to perform temporary interception processing on the download request, and control interception or allow download of the download request according to the determination result.

[0022] In a third aspect, some embodiments of the present application further provide an electronic device, which comprises:

[0023] one or more processors; and a memory storing computer program instructions which, when executed, cause the processor to perform the malicious file interception method based on the dynamic mapping relationship according to any one of the above.

[0024] In a fourth aspect, some embodiments of the present application further provide a computer readable storage medium having stored thereon computer programs and / or instructions which, when executed by a processor, implement the malicious file interception method based on the dynamic mapping relationship according to any one of the above.

[0025] Compared with the prior art, in the scheme provided by the embodiments of the present application, the dynamic mapping relationship between the resource identifier and the file feature data is dynamically constructed in the first download phase, and the dynamic mapping relationship is used as the basis for determining all subsequent download requests, so that the system no longer relies on the pre-constructed static malicious feature library, but continuously accumulates and updates the determination basis during operation, thereby effectively making up for the problem of insufficient recognition ability of unknown files and their variants in the traditional scheme. The established dynamic mapping relationship can be repeatedly reused, so that the determination of subsequent download requests for the same resource does not need to perform complete file content analysis and feature calculation again, thereby reducing the system overhead caused by repeated processing, significantly reducing the computing burden and resource consumption under the premise of ensuring the determination accuracy, and realizing fast response under low resource conditions. Moreover, by performing temporary interception in the initial stage of the download request, and deciding whether to release after completing the file feature generation and malicious determination, the file is prevented from being directly landed or executed before its safety is confirmed, thereby ensuring the timeliness and safety of interception from the source. Therefore, the present scheme realizes dynamic recognition and intelligent interception of malicious files, balances real-time performance, safety and system resource utilization, and has good engineering applicability. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other embodiments can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0027] Figure 1 This is one of the flowcharts illustrating the malicious file interception method based on dynamic mapping relationships provided in the embodiments of this application;

[0028] Figure 2 This is the second flowchart illustrating the malicious file interception method based on dynamic mapping relationships provided in the embodiments of this application;

[0029] Figure 3 This is a schematic diagram of the structure of the malicious file interception system based on dynamic mapping relationship provided in the embodiments of this application;

[0030] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] First Embodiment

[0033] The first embodiment of this application relates to a method for intercepting malicious files based on dynamic mapping relationships, referring to... Figure 1 , Figure 2 As shown, the method may include the following steps:

[0034] Step S1: Monitor download requests for the target resource in real time and perform temporary interception processing on the download requests.

[0035] In one specific embodiment, monitoring download requests for a target resource can be achieved through a gateway device deployed on the network egress side. This gateway device has a built-in traffic monitoring module, used to access a mirror port or connect between the internal and external networks to capture passing network packets in real time. The gateway performs session reassembly on the passing packets at the link layer or network layer, identifying HTTP / HTTPS download requests. For example, it identifies HTTP methods such as GET and POST, and fields like "Content-Type" and "Content-Disposition" in the response headers. Combined with information such as the URL suffix and file length in the response headers, it determines that the current session corresponds to a download request for a specific target resource. Once a download request is identified, the gateway marks it as a request to be monitored and switches the session state to "temporarily blocked."

[0036] In the "temporary interception" state, download requests can be intercepted by controlling the data forwarding path. For example, the gateway can initially only allow request packets to be sent from the client to the server in the forwarding direction to ensure that the server returns the file data normally. However, the file content data returned by the server is not immediately forwarded to the client. Instead, the data is cached in the local cache, or only the minimum data segment required to maintain the connection is returned to the client without sending the complete file content. For proxy-based implementations, application-layer download requests can also be intercepted in the proxy process, added to the analysis queue, and the delivery of file data to downstream applications or browsers can be suspended. Only after subsequent steps complete the feature extraction and malicious determination of the target file will the control logic decide whether to continue sending the remaining data, replay the cached data to the client all at once, or directly discard the cached data and return an error code or connection termination command to the client, thus completing the temporary interception of the download request and subsequent controlled release. The above implementation is only an example. For different deployment scenarios, similar real-time monitoring and temporary interception of download requests can also be performed through terminal proxies, kernel hooks, etc.

[0037] Step S2: Parse the download request to obtain the resource identifier used to identify the target resource, and determine whether the download request is the first download request for the target resource based on the resource identifier.

[0038] In this embodiment, step S2 specifically includes:

[0039] Step S201: Standardize the resource access information in the download request and construct a multi-dimensional combined feature vector based on the standardized resource access information.

[0040] After parsing the download request, access information related to the target resource is extracted from the request message, such as the target server's domain name or IP address, URL path, query parameters, request method, port number, protocol type, and optional fields like User-Agent and Referer. These fields are first uniformly formatted, for example, converting domain names to lowercase, removing redundant " / " and "." from the URL, sorting and concatenating query parameters by key name, and filtering or normalizing parameters irrelevant to the business or prone to change (such as timestamps and random numbers). Subsequently, the standardized fields are combined into multi-dimensional features in a preset order, forming a multi-dimensional combined feature vector characterizing the resource access features of the download request. Each dimension can correspond to different access attributes, such as "host + path," "path + key parameters," "protocol + port," etc., allowing the same target resource to be mapped to the same or highly consistent feature representation in different sessions.

[0041] Step S202: Perform summary encoding on the multidimensional combined feature vector to generate the corresponding resource access fingerprint.

[0042] Multi-dimensional combined feature vectors can be encoded using preset digest algorithms. For example, features of each dimension can be concatenated with a specific delimiter and then input into a hash digest algorithm (such as MD5, SHA-256, or a custom lightweight digest algorithm) to generate a fixed-length digest value; alternatively, local digests can be calculated for some key dimensions, and then multiple local digests can be combined to form the final fingerprint. Through digest encoding, complex resource access information can be compressed into a resource access fingerprint that is easy to index and compare, and used to uniquely identify the access characteristics of a target resource.

[0043] Step S203: Write the resource access fingerprint into a preset index structure and perform a matching search based on the index structure to determine whether there is a historical access record corresponding to the resource access fingerprint.

[0044] In practical implementation, an index storage based on data structures such as hash tables and B+ trees can be constructed to maintain the recorded set of resource access fingerprints. For the resource access fingerprint generated by the current download request, a query operation is first performed in the index structure using the fingerprint as the search key to determine if a matching fingerprint entry exists. If the index does not contain the fingerprint, the fingerprint, along with optional access time, access count, and other information, can be written into the index structure after the query to serve as a historical record for subsequent accesses. If a matching fingerprint already exists in the index, the corresponding historical record information can be read directly without needing to be written again.

[0045] Step S204: If no corresponding historical access record is found, the download request is determined to be the first download request; if a corresponding historical access record is found, the download request is determined to be a non-first download request.

[0046] Specifically, if the index matching result in step S203 is "miss", it means that no download request with the same resource access fingerprint has appeared in the system. Therefore, the current download request is marked as the first download request, and the subsequent target file feature generation and dynamic mapping relationship establishment process is triggered. If the index matching result is "hit", it means that there has been an access record for the same target resource before. The current download request can be marked as a non-first download request, and file feature data can be directly obtained based on the established dynamic mapping relationship for malicious file determination.

[0047] Through steps S201 to S204, the multidimensional feature vector is summarized and encoded to generate a resource access fingerprint. This compresses complex access features into an easily stored and comparable identifier, improving index retrieval efficiency. Matching the resource access fingerprint based on a preset index structure allows the system to quickly determine whether the current download request is the first access to the target resource, providing a reliable basis for establishing and reusing subsequent dynamic mapping relationships. Therefore, this embodiment, while ensuring the accuracy of resource identification, reduces the probability of redundant calculations and processing, achieving stable, accurate, and reusable identification and differentiation of target resources in download requests.

[0048] Step S3: When the download request is the first download request, obtain the target file corresponding to the download request, and generate file feature data to characterize the file content based on the target file.

[0049] like Figure 2 As shown, after determining whether the current download request is the first download request, different processing flows are initiated based on the determination result. When it is determined to be the first download request, the HTTP data stream is further processed to restore the file content and reconstruct the complete target file. When it is determined to be a non-first download request, the established dynamic mapping relationship is directly queried to obtain the corresponding file feature data, and malicious file determination processing is performed based on the file feature data to decide whether to block or allow the current download request.

[0050] In this embodiment, step S3 specifically includes:

[0051] Step S301: Read the file content of the target file in segments and distribute each segment of data to multiple processing nodes.

[0052] In one specific embodiment, the multiple processing nodes are multiple computing nodes deployed in a distributed computing cluster. Upon confirming that the current download request is the first download request, the system, while keeping the download request in a temporarily blocked state, restores the complete content of the target file from the cache or data stream. To avoid the memory and computational pressure caused by loading large files at once, this embodiment can segment the target file according to a preset segmentation strategy, such as sequential segmentation by fixed size (e.g., 1MB, 4MB), or dividing it into several logical segments based on file type and content structure. For each segment of data obtained from the segmentation, the task scheduling module encapsulates it as an independent processing task and distributes it to multiple processing nodes for parallel processing using round-robin, hash modulo, or load balancing strategies, thereby breaking down the file content feature extraction process into parallel executable subtasks. Processing nodes can be multiple processing threads or processes within the same server, or multiple remote computing nodes in a distributed computing cluster. In a distributed scenario, the task scheduling module can distribute segmented tasks to each computing node through a distributed task queue, remote procedure call, or microservice interface, and perform unified aggregation and status management after receiving the processing results returned by each computing node.

[0053] Step S302: Each processing node performs standardization processing on the received segmented data and extracts content feature information based on the standardized segmented data.

[0054] Upon receiving the corresponding segmented data, each processing node first preprocesses the raw byte stream. This includes removing meaningless padding bytes, standardizing newline character formatting, normalizing character encoding for text files, and expanding the key header or metadata areas of compressed files and executable files according to preset rules. Subsequently, based on file type or a unified feature extraction strategy, content feature information is extracted from the standardized segmented data. This includes byte distribution histograms, key field values ​​at fixed offsets, instruction sequence fragments, string feature fragments, and entropy statistics. Through this processing, the data content of each segment is transformed into a structured or semi-structured feature representation.

[0055] Step S303: Summarize the content feature information to generate corresponding segmented feature values.

[0056] After extracting the content features of the segmented data, each processing node can concatenate multiple feature fields into a feature sequence in a fixed order according to preset encoding rules, or construct a multi-dimensional feature vector, and then input the feature sequence or feature vector into a digest algorithm for encoding processing. For example, hash algorithms such as MD5 and SHA-256, or lightweight unencrypted hash functions, can be used to generate a fixed-length digest value, which serves as the segment feature value for the corresponding segment.

[0057] Step S304: The segmented feature values ​​generated by each processing node are aggregated to the central control node, and the segmented feature values ​​are combined and calculated to generate file feature data that uniquely represents the target file.

[0058] After receiving the segmented feature values ​​returned from each processing node, the central control node merges all segmented feature values ​​based on the segment order information or segment identifiers. One approach is to concatenate the segmented feature values ​​according to the file segment order and then input them back into the digest algorithm to generate full-file-level digest feature values. Another approach is to perform bitwise operations, weighted summation, or multi-dimensional vector aggregation on the segmented feature values ​​to obtain an aggregated feature vector that reflects the overall content characteristics. The final global feature representation is used as file feature data to uniquely identify the content characteristics of the target file.

[0059] Through steps S301 to S304, the target file is segmented and read, and then distributed to multiple processing nodes for parallel processing. This breaks down the originally centralized file feature calculation process into multiple parallel subtasks. By performing standardized preprocessing and content feature extraction on each segment, different file types have a unified analyzable structure at the byte level, which helps eliminate the interference of format differences on feature recognition. Each processing node performs summary encoding on the segment features and generates segment feature values, which not only compresses the data size but also retains key differences in the file content, enhancing the stability and comparability of feature expression. Finally, by combining and calculating the segment feature values ​​at the central control node, file feature data that can uniquely represent the characteristics of the entire target file content is formed. Thus, this embodiment achieves efficient and refined feature extraction and unified representation of the target file content, effectively reducing the pressure of single-point computation and improving overall processing efficiency.

[0060] Step S4: Establish and store the dynamic mapping relationship between resource identifiers and file characteristic data.

[0061] Step S401: Construct a mapping record based on the resource identifier and the corresponding file feature data, and write the mapping record into the preset mapping storage structure.

[0062] After generating the target file feature data, the "resource identifier" and its corresponding "file feature data" are organized into a mapping record. This mapping record can be stored using a key-value pair structure, where the resource identifier is the key and the file feature data is the value. The preset mapping storage structure can be an in-memory hash table, a key-value database (such as an implementation based on Redis or RocksDB), or a persistent storage structure that supports fast queries and updates. During writing, the mapping record is registered in the mapping storage structure by calling the insert or update interface provided by the mapping management module. Preferably, a hash table is used as the underlying data storage structure. When initializing the hash table, a storage capacity of an equivalent order of magnitude is pre-configured based on the system's estimated download request scale to meet the storage requirements of typical download request scenarios. Simultaneously, a scaling strategy can be configured in conjunction with a preset load factor. When the number of mapping records reaches the threshold corresponding to the initial capacity, the hash table is automatically scaled up and storage space is reallocated, thereby ensuring the stability of mapping query and write efficiency.

[0063] Step S402: Associate a time attribute and a status identifier with the mapping record to identify the validity period and current validity status of the mapping record.

[0064] When constructing mapping records, in addition to storing resource identifiers and file characteristic data, time-related fields such as record creation time, last access time, and version number can be added. A status identifier can also be set for each mapping record, such as "valid," "pending update," or "expired." The creation time can be used to determine validity based on absolute time, the last access time can be used to implement eviction policies based on access frequency and activity, and the status identifier is used to mark the record as logically invalid or pending update without immediate deletion, so that upper-level decision-making logic can determine whether to continue using the mapping record.

[0065] Step S403: When the content of the target resource changes or the file feature data is updated, the mapping record is updated to maintain the validity of the dynamic mapping relationship.

[0066] Changes to target resource content can be detected in various ways. For example, newly downloaded files under the same resource identifier can have their file feature data recalculated and compared with the original features. If the difference exceeds a preset threshold, it can be determined that the target resource content has changed. Alternatively, auxiliary information such as version number, ETag, and file checksum provided by the upstream business system can be used to determine whether the file has been updated. Once a content change is detected, the mapping management module will perform an update operation on the mapping record based on the latest file feature data. This includes replacing the old file feature data, resetting the creation time or last update time, and adjusting the status flag to "valid" or "updated" as appropriate, thereby ensuring that the resource identifier maps to the feature data of the current version of the file.

[0067] Step S404: When a mapping record exceeds the preset validity period or is marked as invalid, perform invalidation processing or deletion operation on the corresponding mapping record.

[0068] Periodic cleanup tasks can be set in the mapping management module to traverse the mapping storage structure at preset time intervals, checking the creation time, last access time, and status flag of each mapping record. When it is detected that the validity period of a mapping record has exceeded the preset period, or its status flag has been set to "expired" or "pending deletion," the corresponding expiration handling strategy is executed. For example, the record may be physically deleted from the mapping storage structure, or its status flag may simply be updated to "expired" to prevent it from being used for malicious judgment. For implementations using a multi-level storage structure, infrequently accessed or soon-to-expire records can also be migrated to a low-priority storage area to free up high-performance storage space.

[0069] Through steps S401 to S404, resource identifiers and corresponding file feature data are written into a preset mapping storage structure in the form of structured mapping records. This enables the system to quickly locate the corresponding file feature data based on the resource identifier during subsequent accesses, forming an efficient and reusable feature query mechanism. Furthermore, by introducing time attributes and status identifiers into the mapping records, each mapping data entry has traceable lifecycle management capabilities, thereby accurately distinguishing between valid and invalid mappings and avoiding misjudgments caused by historical residual data. Simultaneously, when changes in resource content or file feature updates are detected, the mapping records are dynamically refreshed, and expired or invalid records are updated or cleaned up using a validity period and status control mechanism, ensuring that the mapping relationship always reflects the current true state of the target resource. Therefore, this not only improves the accuracy and timeliness of mapping data during malicious detection but also avoids the problem of invalid mappings occupying storage space and participating in judgment calculations for extended periods, effectively improving the system's stability, data consistency, and resource utilization efficiency during long-term operation.

[0070] Step S5: Determine if the target file is malicious based on the dynamic mapping relationship, and perform download blocking or download permission processing according to the determination result.

[0071] In this embodiment, step S5 specifically includes:

[0072] Step S501: Obtain the file feature data corresponding to the target file based on the dynamic mapping relationship.

[0073] After completing step S2, regardless of whether the current download request is the first download request, the system enters a unified malicious file determination entry point. For the first download request, after generating file feature data and establishing a dynamic mapping relationship in steps S3 and S4, the system obtains the file feature data corresponding to the target file based on the newly established dynamic mapping relationship; for subsequent download requests, the system directly queries and obtains the file feature data corresponding to the target file based on the existing dynamic mapping relationship.

[0074] Step S502: Based on the file feature data, match the file feature data with a preset set of malicious file features to determine whether the target file is a malicious file.

[0075] In this embodiment, the file feature data includes a digest feature value generated by a hash digest algorithm; step S502 specifically includes:

[0076] Step S5021: Perform multi-level matching analysis on the target file based on the summary feature values ​​according to the pre-set matching strategy. The multi-level matching analysis includes at least:

[0077] Step S5022: In the first matching stage, when the digest feature value of the target file matches the digest feature value in the malicious file feature set, the target file is determined to be a malicious file;

[0078] Step S5023: In the second matching stage, for target files that are not identified as malicious files, the similarity between the digest feature value and the malicious file feature set is calculated, and the risk level of the target file is determined according to the similarity. When the risk level is high, the target file is identified as a malicious file.

[0079] In one specific embodiment, the digest feature value can be a fixed-length feature value calculated from the content of the target file using MD5, SHA-1, SHA-256, or other hash digest algorithms. During step S502, the digest feature value corresponding to the target file is first read from the dynamic mapping relationship and sent to the malicious file determination module. This module pre-maintains a malicious file feature set, which stores the digest feature values ​​of multiple known malicious files and their corresponding risk label information.

[0080] In the first matching stage, the malicious file determination module searches and compares the digest feature value of the target file with the digest feature value in the malicious file feature set. If a completely consistent feature value is found, the malicious determination result is directly output without entering the subsequent calculation process, thereby realizing the rapid identification and interception of known malicious files.

[0081] In the second matching phase, for target files that did not find a complete match in the first phase, the system performs similarity calculations between the target digest feature value and multiple feature values ​​in the malicious file feature set. For example, it calculates the difference bits, edit distance, or feature similarity scoring model to obtain the similarity value between the target file and each known malicious file. Based on the distribution of similarity values, the target file is classified into risk levels, such as low risk, medium risk, and high risk. When a target file is assessed as high-risk, it is identified as a malicious file and blocked; when its risk level is below a preset threshold, it is determined to be a non-malicious file and downloading is allowed to continue.

[0082] Furthermore, a differentiated processing strategy can be implemented for the target file based on the risk level, including: when the risk level reaches a preset high-risk threshold, the target file is directly identified as a malicious file and its download is blocked; when the risk level is in the medium-risk range, the target file is subject to delayed release or enhanced detection processing to further confirm its security; when the risk level is below a preset security threshold, the target file is identified as a non-malicious file, allowing it to continue downloading and recording relevant access behavior information.

[0083] Step S503: When the target file is determined to be a malicious file, the download request is blocked; when the target file is determined to be a non-malicious file, the temporary blocking of the download request is lifted and the file download is allowed.

[0084] When the determination result indicates that the target file is a malicious file, the temporary blocking status of the download request is maintained, and the file transfer process is immediately terminated. At the same time, an alarm message can be output to the user or the upper-level management module to indicate the existence of security risks. When the determination result indicates that the target file is a non-malicious file, the temporary blocking status of the current download request is lifted, allowing the file to continue to be downloaded and written to local storage or a specified directory, thereby completing the normal file acquisition process.

[0085] Through steps S501 to S503, on the one hand, regardless of whether it's the first download or not, the system extracts and reuses file feature data uniformly for the target file, ensuring a consistent data foundation for the judgment logic across different download scenarios and avoiding instability in judgment results due to differences in processing paths. On the other hand, by introducing a hierarchical evaluation and multi-dimensional feature comparison mechanism, the system can not only quickly identify known malicious files but also conduct risk assessments on potential variants or unknown files, thereby expanding the coverage of malicious file identification. This allows for security judgment and corresponding interception or allowance control to be performed before the file is actually downloaded, effectively blocking the path of malicious files into the terminal environment and improving the timeliness and reliability of overall protection.

[0086] In one specific embodiment, the malicious file interception method operates in a distributed deployment manner, including:

[0087] The tasks of extracting file feature data, maintaining dynamic mapping relationships, and identifying malicious files are configured to be executed on multiple distributed processing nodes.

[0088] The received download requests are scheduled based on the load balancing strategy, and different download requests are distributed to the corresponding processing nodes for processing.

[0089] A task queue mechanism is established among the processing nodes to queue and forward download requests. When a change in the load status of a processing node is detected, the distribution path of download requests among the processing nodes is dynamically adjusted to achieve distributed parallel processing.

[0090] Specifically, in this embodiment, the malicious file interception system is deployed using a distributed cluster architecture, including a scheduling control node and multiple distributed processing nodes. These processing nodes are interconnected via an internal network to form a collaborative processing network. The scheduling control node uniformly receives download requests from terminals or network boundary devices, parses and classifies the download requests according to a preset load balancing strategy, encapsulates them into tasks to be processed, and writes them into a task queue. The load balancing strategy can comprehensively consider indicators such as the current CPU utilization, memory usage, task processing latency, and historical load change trends of each processing node to dynamically select target processing nodes, ensuring the balanced distribution of tasks among nodes.

[0091] During the task execution phase, file feature data extraction, dynamic mapping relationship maintenance, and malicious file identification tasks are deployed on processing nodes of different functional types. For example, some processing nodes are dedicated to performing file content segmentation and feature extraction operations, others are used to maintain the dynamic mapping relationship between resource identifiers and file feature data, and still others are used to execute malicious file matching and identification logic. Each processing node pulls the corresponding type of task from the queue through a task queue mechanism and executes it. The processing results are then sent back to the scheduling control node or downstream nodes via message passing or remote invocation.

[0092] Meanwhile, the load status of each processing node is monitored in real time. When a processing node is found to be overloaded or has abnormal response delay, the scheduling control node automatically adjusts the task allocation strategy and reallocates new download requests or pending tasks to processing nodes with lower loads. If necessary, task migration or node expansion operations can also be triggered to maintain the stability of the overall system processing capacity.

[0093] Through the aforementioned distributed deployment method, this embodiment forms a parallel processing system with multiple nodes working collaboratively during the malicious file interception and processing. This allows various processing tasks to be decoupled spatially and executed in parallel in time, thereby effectively improving the system's processing capabilities in high-concurrency download scenarios. Since file feature data extraction, dynamic mapping relationship maintenance, and malicious file determination tasks are undertaken by different processing nodes, the performance bottleneck caused by centralized processing on a single node is avoided, enabling the system to maintain efficient and continuous operation even in high-concurrency download scenarios.

[0094] The steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this application.

[0095] Second Embodiment

[0096] The second embodiment of this application relates to a malicious file interception system based on dynamic mapping relationships, referring to... Figure 3 As shown, the system includes:

[0097] The download request listening module is used to listen for download requests for the target resource in real time and pass the download requests to the file download interception module;

[0098] The request parsing module is used to parse the download request to obtain a resource identifier for identifying the target resource, and to determine whether the download request is the first download request for the target resource based on the resource identifier;

[0099] The file feature generation module is used to obtain the target file corresponding to the download request when the download request is the first download request, and generate file feature data to characterize the file content characteristics based on the target file;

[0100] The dynamic mapping management module is used to establish and store the dynamic mapping relationship between the resource identifier and the file feature data;

[0101] The malicious file determination module is used to determine the malice of the target file based on the dynamic mapping relationship and output the corresponding determination result.

[0102] The file download interception module is used to perform temporary interception processing on the download request, and control the interception or permission of the download request based on the determination result.

[0103] In this embodiment, the malicious file interception system based on dynamic mapping is deployed modularly on the network egress side or in a security gateway device. Each functional module collaborates via an internal bus or message queue to perform real-time interception, parsing, feature generation, dynamic mapping maintenance, and malicious detection of download requests. Through the coordinated efforts of these modules, the system can dynamically analyze and determine the security of files in the early stages of a download request. Based on the dynamic mapping between resource identifiers and file characteristics, it can quickly process repeatedly accessed resources, thus forming a continuously updated, efficient, and reliable malicious file interception system architecture suitable for file security protection scenarios in network environments of varying sizes.

[0104] In a preferred embodiment, the malicious file interception system based on dynamic mapping can be implemented using a distributed deployment architecture. The overall system is deployed in a modular manner on the network egress side or in a security gateway cluster. Each functional module runs on a different computing node and works collaboratively through an internal communication bus or message queue to complete the real-time interception, parsing, feature generation, dynamic mapping maintenance, and malicious judgment processing of download requests.

[0105] The content of the above embodiments of the malicious file interception method based on dynamic mapping is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above embodiments of the malicious file interception method based on dynamic mapping, and the beneficial effects achieved are also the same as those achieved in the above embodiments of the malicious file interception method based on dynamic mapping. To avoid repetition, it will not be described again here.

[0106] Furthermore, some embodiments of this application also provide an electronic device. The electronic device can be various forms of digital computer, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, etc. The electronic device can also be various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices.

[0107] The electronic device includes: one or more processors; and a memory storing computer program instructions, which, when executed, cause the processor to perform a malicious file interception method based on dynamic mapping relationships as provided in any one or more of the above embodiments. Figure 4An exemplary structural diagram of the electronic device is disclosed. The electronic device includes one or more processors 1101, a memory 1102, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components are interconnected via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations. The components, their connections and relationships, and their functions shown herein are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0108] The electronic device may further include an input device 1103 and an output device 1104. The processor 1101, memory 1102, input device 1103, and output device 1104 may be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.

[0109] Input device 1103 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the electronic device, such as a touch screen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 1104 may include a display device, auxiliary lighting device (e.g., LED), and haptic feedback device (e.g., vibration motor). The display device may include, but is not limited to, a liquid crystal display, a light-emitting diode display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0110] To provide interaction with the user, the electronic device can be a computer. The computer has: a display device (e.g., a cathode ray tube or LCD monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback); and input from the user can be received in any form (e.g., voice input or tactile input).

[0111] In this embodiment, a computer-readable medium stores a computer program / instruction, which, when executed by a processor, implements a malicious file interception method based on dynamic mapping relationships provided in any one or more of the above embodiments. The computer-readable medium may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more computer-readable instructions.

[0112] The memory 1102 can serve as a non-transitory computer-readable storage medium, used to store non-transitory software programs, non-transitory computer-executable programs, and modules. The processor 1101 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions, and modules stored in the memory 1102, thereby implementing the program instructions / modules corresponding to the methods provided in any one or more of the embodiments described above in this application.

[0113] The memory 1102 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 1102 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1102 may optionally include memory remotely located relative to the processor 1101, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0114] It should be noted that the computer-readable medium described in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections having one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0115] Computer-readable media include permanent and non-permanent, removable and non-removable media, which can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory, static random access memory, dynamic random access memory, other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technologies, read-only optical discs, digital versatile optical discs or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0116] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0117] In the above embodiments, all or part of the implementation can be achieved through software, hardware, firmware, or any combination thereof. For example, it can be implemented using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In some embodiments, the software program of this application can be executed by a processor to implement the above steps or functions. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, magnetic or optical drives, floppy disks, and similar devices. In addition, some steps or functions of this application can be implemented in hardware, for example, as circuitry that cooperates with a processor to perform the various steps or functions.

[0118] The computer program product provided in this application includes one or more computer programs / instructions. When executed by a processor, these computer programs / instructions generate, in whole or in part, the processes or functions described in this application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0119] The flowcharts or block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-specific system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0120] The scope of this application is defined by the appended claims rather than the foregoing description, and is therefore intended to encompass all variations falling within the meaning and scope of equivalents of the claims. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a device claim may also be implemented by a single unit or device in software or hardware. Terms such as "first," "second," etc., are used only for distinguishing descriptions and do not indicate any particular order, nor should they be construed as indicating or implying relative importance.

[0121] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily made by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims, and the above embodiments should be regarded as exemplary and non-limiting.

Claims

1. A method for intercepting malicious files based on dynamic mapping relationships, characterized in that, include: Real-time monitoring of download requests for the target resource, and temporary interception processing of the download requests; The download request is parsed to obtain a resource identifier for identifying the target resource, and the download request is determined based on the resource identifier to determine whether the download request is the first download request for the target resource; When the download request is the first download request, the target file corresponding to the download request is obtained, and file feature data for characterizing the file content characteristics is generated based on the target file; Establish and store a dynamic mapping relationship between the resource identifier and the file feature data; The target file is maliciously determined based on the dynamic mapping relationship, and download blocking or download permission is executed according to the determination result.

2. The malicious file interception method based on dynamic mapping relationship according to claim 1, characterized in that, The step of parsing the download request to obtain a resource identifier for identifying the target resource, and determining whether the download request is the first download request for the target resource based on the resource identifier, includes: The resource access information in the download request is standardized, and a multi-dimensional combined feature vector is constructed based on the standardized resource access information. The multidimensional combined feature vector is digested and encoded to generate the corresponding resource access fingerprint; The resource access fingerprint is written into a preset index structure, and a matching search is performed based on the index structure to determine whether there is a historical access record corresponding to the resource access fingerprint. If no corresponding historical access record is found, the download request is determined to be the first download request; if a corresponding historical access record is found, the download request is determined to be a non-first download request.

3. The malicious file interception method based on dynamic mapping relationship according to claim 1, characterized in that, The step of obtaining the target file corresponding to the download request and generating file feature data to characterize the file content based on the target file when the download request is the first download request includes: The file content of the target file is read in segments, and each segment is distributed to multiple processing nodes; Each of the processing nodes performs standardization processing on the received segmented data and extracts content feature information based on the standardized segmented data. The content feature information is summarized and encoded to generate corresponding segmented feature values; The segmented feature values ​​generated by each processing node are aggregated to the central control node, and the segmented feature values ​​are combined and calculated to generate file feature data that uniquely represents the target file.

4. The malicious file interception method based on dynamic mapping relationship according to claim 1, characterized in that, The step of establishing and storing the dynamic mapping relationship between the resource identifier and the file feature data includes: A mapping record is constructed based on the resource identifier and the corresponding file feature data, and the mapping record is written into a preset mapping storage structure; Associate time attributes and status identifiers with the mapping records to identify the validity period and current validity status of the mapping records; When a change in the content of the target resource or an update to the file feature data is detected, the mapping record is updated to maintain the validity of the dynamic mapping relationship. When the mapping record exceeds the preset validity period or is marked as invalid, the corresponding mapping record is invalidated or deleted.

5. The malicious file interception method based on dynamic mapping relationship according to claim 1, characterized in that, The step of determining the target file as malicious based on the dynamic mapping relationship, and executing download blocking or download permission based on the determination result, includes: Based on the dynamic mapping relationship, obtain the file feature data corresponding to the target file; Based on the file feature data, the file feature data is matched with a preset set of malicious file features to determine whether the target file is a malicious file; When the target file is determined to be a malicious file, the download request is blocked; when the target file is determined to be a non-malicious file, the temporary blockade of the download request is lifted and the file download is allowed.

6. The malicious file interception method based on dynamic mapping relationship according to claim 5, characterized in that, The file feature data includes a digest feature value generated by a hash digest algorithm; The step of matching the file feature data with a preset set of malicious file features to determine whether the target file is a malicious file includes: According to a pre-defined matching strategy, a multi-level matching analysis is performed on the target file based on the summary feature values. The multi-level matching analysis includes at least: In the first matching stage, when the digest feature value of the target file matches the digest feature value in the malicious file feature set, the target file is determined to be a malicious file. In the second matching stage, for the target file that is not determined to be a malicious file, the similarity between the digest feature value and the malicious file feature set is calculated, and the risk level of the target file is determined according to the similarity. When the risk level is high risk, the target file is determined to be a malicious file.

7. The malicious file interception method based on dynamic mapping relationship according to claim 1, characterized in that, The malicious file interception method operates in a distributed deployment manner, including: The tasks of extracting file feature data, maintaining dynamic mapping relationships, and identifying malicious files are configured to be executed on multiple distributed processing nodes. The received download requests are scheduled based on the load balancing strategy, and different download requests are distributed to the corresponding processing nodes for processing. A task queue mechanism is established among the processing nodes to queue and forward download requests. When a change in the load status of a processing node is detected, the distribution path of download requests among the processing nodes is dynamically adjusted to achieve distributed parallel processing.

8. A malicious file interception system based on dynamic mapping relationships, characterized in that, include: The download request listening module is used to listen for download requests for the target resource in real time and pass the download requests to the file download interception module; The request parsing module is used to parse the download request to obtain a resource identifier for identifying the target resource, and to determine whether the download request is the first download request for the target resource based on the resource identifier; The file feature generation module is used to obtain the target file corresponding to the download request when the download request is the first download request, and generate file feature data to characterize the file content characteristics based on the target file; The dynamic mapping management module is used to establish and store the dynamic mapping relationship between the resource identifier and the file feature data; The malicious file determination module is used to determine the malice of the target file based on the dynamic mapping relationship and output the corresponding determination result; The file download interception module is used to perform temporary interception processing on the download request, and control the interception or permission of the download request based on the determination result.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; and a memory storing computer program instructions, which, when executed, cause the processors to perform the malicious file interception method based on dynamic mapping as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program and / or instructions stored thereon, characterized in that, When the computer program and / or instructions are executed by the processor, they implement the malicious file interception method based on dynamic mapping relationships as described in any one of claims 1-7.

Images