Malicious file interception method and system, computer equipment and storage medium

Abstract

The invention relates to a malicious file interception method, which comprises the following steps of: responding to a file downloading request initiated by a user, and temporarily intercepting a downloading data stream corresponding to the request; obtaining content data of a file from the intercepted downloading data stream; calculating and generating a unique file feature value according to the content data; establishing a dynamic mapping relationship between a target URL (Uniform Resource Locator) carried in the file downloading request and the file characteristic value, and storing the mapping relationship in a dynamic mapping table; and querying the dynamic mapping table, judging the property of the file according to an association comparison result between the historical file feature information corresponding to the target URL and the currently calculated file feature value, and executing an interception or release operation according to the property of the file. By converting the security criterion from a static feature library into a dynamic mapping relationship, real-time dynamic interception of malicious files is realized, and the problem of security window period caused by feature library updating lag in a traditional scheme is solved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to methods, apparatus, computer devices, and storage media for intercepting malicious files. Background Technology

[0002] With the rapid development of internet technology, cybersecurity threats are becoming increasingly severe. Among these threats, the spread of malicious software (such as viruses, Trojans, and ransomware) through file downloads is one of the most common attack methods. Therefore, real-time and efficient security detection and interception of downloaded files has become a core task in the field of cybersecurity.

[0003] Currently, mainstream malicious file interception technologies in the industry mainly rely on feature-based static matching methods. This method typically involves pre-establishing a large malicious signature database containing known malicious file hash values ​​(such as MD5, SHA-1, etc.). When a user initiates a file download, the security system calculates the file's hash value and compares it with records in the signature database. If a match is found, the file is identified as malicious and interception is performed.

[0004] However, this traditional static feature library matching mechanism has several inherent drawbacks: First, it is severely outdated and unable to cope with zero-day attacks and unknown threats. This mechanism is essentially a "post-incident" strategy; it can only be intercepted after a malicious file is discovered, analyzed, and its signature is entered into a database. For newly appearing malicious files or "one-day malware," the mechanism cannot identify them, resulting in a significant security gap.

[0005] Secondly, maintenance costs are high and the system burden is heavy. To maintain the effectiveness of protection, the signature database needs to be continuously updated from security vendors, which consumes a large amount of network bandwidth and storage space. At the same time, in scenarios involving massive file downloads, each download requires a full hash calculation and database comparison, putting enormous pressure on computing resources and response time, and affecting user experience.

[0006] Third, it is extremely easy to bypass, and the protection is weak. Attackers can generate countless variants of malicious files through simple obfuscation, packing, and repackaging. The hash values ​​of these variants will change, thus easily bypassing the blacklist mechanism based on static hash values, resulting in a persistently high false negative rate.

[0007] Therefore, there is an urgent need in this field for a new technical solution that can overcome the above-mentioned defects and achieve real-time dynamic interception of file variants with low consumption, high efficiency and effective response without relying on a large pre-built feature library. Summary of the Invention

[0008] The purpose of this invention is to provide a method for intercepting malicious files, so as to solve the problem of malicious file interception.

[0009] The first aspect of the present invention provides a method for intercepting malicious files, comprising: Respond to a user's file download request and temporarily intercept the download data stream corresponding to that request; Obtain the file content data from the intercepted download data stream; Based on the content data, a unique file feature value is calculated and generated; Establish a dynamic mapping relationship between the target URL carried in the file download request and the file feature value, and store this mapping relationship in a dynamic mapping table; The dynamic mapping table is queried, and the nature of the file is determined based on the correlation comparison between the historical file feature information corresponding to the target URL and the currently calculated file feature value. Based on this, the interception or release operation is performed.

[0010] In one possible implementation, calculating and generating a unique file feature value based on the content data includes: A hash algorithm is applied to the content data to generate a fixed-length hash code; The hash algorithm includes any one of MD5, SHA-1, and SHA-256.

[0011] In one possible implementation, establishing a dynamic mapping relationship between the target URL carried in the file download request and the file feature value includes: A key-value pair record is constructed using the target URL as the key and the file feature value and its first or last update timestamp as the value. The key-value pairs are stored in an in-memory database or a high-performance key-value storage system to enable fast querying and updating.

[0012] In one possible implementation, the records in the dynamic mapping table are set to have an expiration time; When the duration of a record exceeds its corresponding expiration time, the record is automatically removed from the dynamic mapping table.

[0013] In one possible implementation, determining the nature of the document includes: Search the dynamic mapping table to see if a record exists with the target URL as the key; If it does not exist, it is determined to be the first access, the download data stream is allowed to continue, and the step of establishing a dynamic mapping relationship is executed; If it exists, compare the currently calculated file feature value with the historical file feature value stored in the retrieved record; If both match, the file is determined to be unchanged and download is permitted. If the two are inconsistent, it is determined that the file content has been changed, triggering an interception action.

[0014] In one possible implementation, after the interception action is triggered, the following is also included: The currently calculated file signature value is sent to a remote malicious file signature database for deep verification. If the remote malicious file signature database confirms that the current file's signature value is malicious, then interception is performed and a security log is generated; If the malicious intent is not confirmed, then based on the pre-configured security policy, one of the following actions will be taken: allow access, conduct a secondary sandbox inspection, or prompt the user for a decision.

[0015] In one possible implementation, responding to a user-initiated file download request and temporarily intercepting the download data stream corresponding to the request includes: The file feature values ​​are calculated while receiving data using a streaming processing method; When the amount of received data reaches a preset threshold and some of the calculated feature values ​​can initially match malicious features, the interception is triggered in advance without waiting for the file to be fully downloaded.

[0016] A second aspect of the present invention provides a malicious file interception system, comprising: The URL listening module is used to monitor network activity and identify and capture file download requests initiated by users. The file download interception module is used to temporarily intercept the download data stream corresponding to the captured download request in response to the captured download request; The feature value calculation module is used to process the file content data received from the file download interception module and calculate and generate the corresponding file feature value; The dynamic mapping generation module is used to establish a dynamic mapping relationship between the target URL carried in the file download request and the file feature value, and to store this mapping relationship in a dynamic mapping table; The malicious file determination module is used to query the dynamic mapping table, determine the nature of the file based on the correlation comparison results between the historical file feature information corresponding to the target URL and the currently calculated file feature value, and perform interception or release operations accordingly.

[0017] A third aspect of the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the malicious file interception method as described in the first aspect of the present invention.

[0018] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the malicious file interception method as described in the first aspect of the present invention.

[0019] Compared with the prior art, the beneficial effects of the present invention are: 1. By converting security criteria from a static feature library to a dynamic mapping relationship, real-time dynamic interception of malicious files is achieved, solving the security window problem caused by the lag in feature library updates in traditional solutions. 2. By transforming computationally intensive file scanning into lightweight mapping table queries, the system's computational and storage resource consumption is significantly reduced, interception efficiency is improved, and it is easy to deploy in resource-constrained environments. 3. By monitoring abnormal changes in file characteristic values ​​under the same URL to trigger interception, it effectively responds to variant attacks of malicious files and solves the problems of traditional hash blacklist mechanisms being easily bypassed and having a high rate of missed detection. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the malicious file interception method of the present invention; Figure 2 This is a schematic diagram of the architecture of the malicious file interception system of the present invention; Figure 3 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, those skilled in the art will understand... All other embodiments obtained through creative labor are within the scope of protection of this invention.

[0022] It should be noted that the serial numbers assigned to the components in the embodiments of the present invention, such as "first" and "second", are only used to distinguish the described objects and have no sequential or technical meaning.

[0023] The following is combined with Figure 1 This invention describes a method for intercepting malicious files.

[0024] A method for intercepting malicious files includes: S1. Respond to the file download request initiated by the user and temporarily intercept the download data stream corresponding to the request; Among these methods, streaming processing can be used to calculate the file feature values ​​while receiving data; When the amount of received data reaches a preset threshold and some of the calculated feature values ​​can initially match malicious features, the interception is triggered in advance without waiting for the file to be fully downloaded.

[0025] Traditional security software requires the file to be completely downloaded to the hard drive before scanning ("land-based scanning"), leaving opportunities for malicious code to execute. This invention, however, employs streaming processing, where a 100MB suspicious file is downloaded in memory during the download process. The system is configured to calculate a streaming hash when 1MB of data is downloaded and compare it with a pre-stored "common malware header signature hash library." When the download reaches 5MB, a portion of the calculated hash sequence perfectly matches known ransomware header signatures. The system does not need to wait for the remaining 95MB to download; it can immediately terminate the network connection and notify the user that "ransomware detected, download has been aborted," effectively preventing the spread and execution of malicious files. By setting a preset threshold, a preliminary judgment can be made before the file is fully downloaded, achieving "in-process inspection and interception," significantly shortening the time to risk exposure.

[0026] For example, a user attempts to download a 50MB malware archive.

[0027] Traditional methods require waiting for the entire 50MB file to be downloaded to the hard drive before the security software begins scanning. This not only wastes bandwidth and time, but more critically, the file is already stored on the hard drive, posing a risk of automatic execution or accidental execution by the user.

[0028] The solution of this invention employs streaming processing: Second 1: Download begins; the system receives the first 512KB of data.

[0029] 3 seconds: The downloaded data reaches the preset threshold of 1MB. The system immediately calculates a portion of the MD5 value of this 1MB of data and queries the header feature database.

[0030] At 3.1 seconds: The MD5 hash of this portion of the file was found to match the signature of a known ransomware family. The system immediately took action, forcibly interrupting the download when only 1 / 50 (2%) of the file had been downloaded.

[0031] The transmission of the remaining 49MB of malicious data was successfully blocked, saving 97% of bandwidth and completely eliminating the security risks associated with file storage.

[0032] S2. Obtain the file content data from the intercepted download data stream; For an HTTP file download, the proxy server parses the HTTP response headers, identifies the Content-Type and Content-Length, and then reassembles the subsequent TCP packets in sequence to obtain a complete binary file data block.

[0033] S3. Calculate and generate a unique file feature value based on the content data; Specifically, a hash algorithm is applied to the content data to generate a fixed-length hash code; this hash code is a characteristic value of the file.

[0034] The hash algorithm includes any one of MD5, SHA-1, and SHA-256.

[0035] Administrators dynamically select hash algorithms based on actual scenarios (such as terminal performance, network bandwidth, and security level). For example, SHA-256 can be used by default on personal terminals, while MD5 can be selected for initial filtering on high-throughput gateways. In some advanced implementations, multiple algorithms can be combined to balance security and efficiency. For instance, a fast MD5 algorithm can be used to calculate a preliminary feature value for initial screening and mapping table lookup; if an MD5 mismatch is found (indicating file modification), a more time-consuming SHA-256 calculation is triggered for deep verification, and the SHA-256 value is used as the final criterion. This layered processing mechanism further optimizes the use of system resources.

[0036] S4. Establish a dynamic mapping relationship between the target URL carried in the file download request and the file feature value, and store this mapping relationship in a dynamic mapping table; Specifically, a key-value pair record is formed using the target URL as the key and the file feature value and its first or last update timestamp as the value. The key-value pairs are stored in an in-memory database or a high-performance key-value storage system to enable fast querying and updating.

[0037] For example: during a normal software update 1. User A downloads http: / / software.com / update.exe (version 1.0). The system calculates its MD5 hash as AAA... and establishes a mapping record.

[0038] 2. User B downloads from the same URL. The system calculates the MD5 hash, which is still AAA..., consistent with historical records. This is determined to be a normal update, and the download is quickly allowed.

[0039] Malicious file replacement 1. User A downloads http: / / software.com / update.exe (normal version 1.0, MD5: AAA...), and the system establishes a mapping.

[0040] 2. The attacker replaces files on the server with a Trojan version (MD5 changes to BBB...).

[0041] 3. User C downloads from the same URL. The system calculates the current MD5 hash to be BBB..., and a query of the mapping table reveals a historical record of AAA....

[0042] The system detects abnormal changes in the file fingerprint corresponding to the same URL, immediately triggers interception, prevents the download of the Trojan, and can perform cloud verification or issue an alert according to the policy.

[0043] Furthermore, the records in the dynamic mapping table are set to have an expiration time; When the duration of a record exceeds its corresponding expiration time, the record is automatically removed from the dynamic mapping table.

[0044] Network resources are dynamic, and it's normal for a file corresponding to a URL to be legitimately updated (such as a software version upgrade). If mapping records are permanently valid, the system might mistakenly identify legitimate file updates as malicious tampering. By setting an expiration time (TTL), the system can automatically forget "old" mapping relationships and only remain sensitive to changes in the "recent" period, which greatly reduces the false alarm rate. At the same time, this mechanism can effectively control the size of the mapping table, preventing it from growing indefinitely and exhausting memory.

[0045] S5. Query the dynamic mapping table, determine the nature of the file based on the correlation comparison result between the historical file feature information corresponding to the target URL and the currently calculated file feature value, and perform interception or release operations accordingly.

[0046] The following methods can be used to determine the nature of a file: Search the dynamic mapping table to see if a record exists with the target URL as the key; If it does not exist, it is determined to be the first access, the download data stream is allowed to continue, and the step of establishing a dynamic mapping relationship is executed; If it exists, compare the currently calculated file feature value with the historical file feature value stored in the retrieved record; If both match, the file is determined to be unchanged and download is permitted. If the two are inconsistent, it is determined that the file content has been changed, triggering an interception action.

[0047] The system found a URL record in the mapping table, but the currently calculated MD5 value z9y8x7w6... does not match the stored value a1b2c3d4... At this point, the system will not immediately determine it as malicious, but will be highly suspicious. The system then triggers an interception action to prevent the potential threat from being implemented.

[0048] After interception, suspected malicious files can be processed in the following ways: The currently calculated file signature value is sent to a remote malicious file signature database for deep verification. If the remote malicious file signature database confirms that the current file's signature value is malicious, then interception is performed and a security log is generated; If the malicious intent is not confirmed, then based on the pre-configured security policy, one of the following actions will be taken: allow access, conduct a secondary sandbox inspection, or prompt the user for a decision.

[0049] When the system triggers an interception, it sends the MD5 value of the suspicious file to a cloud-based malware scanning service such as VirusTotal. If the cloud scanning service returns results showing that more than 10 engines report the file as malicious, the system confirms the interception and records the security event. If the cloud scanning service also has no record (which may indicate a completely new and unknown piece of malware), the system can act according to preset policies. In a strict corporate intranet, the policy might be set to "block by default if there is no cloud reputation"; on a personal computer, the policy might be set to "pop up a warning box, allowing the user to decide whether to risk downloading it."

[0050] This invention is based on anomaly detection using the "source-content" correlation. It assumes that under normal circumstances, the content of a file pointed to by a specific URL (source) should be stable and consistent over a short period. When this correlation is broken (i.e., the content of the file under the same URL changes abruptly), a security alert is triggered. This method does not directly determine "what" the file is, but rather indirectly discovers potential threats by monitoring "what changes have occurred," making it a dynamic and intelligent detection strategy.

[0051] Taking a corporate network environment as an example. When an employee downloads a legitimate software installation package from http: / / update.example.com / soft_v1.2.exe for the first time, the system calculates its MD5 value (e.g., a1b2c3d4...) and establishes a mapping with that URL. The next day, an attacker compromises the server and replaces the file under the same URL with a version containing a Trojan horse. When another employee downloads the same URL again, the new MD5 value calculated by the system (e.g., z9y8x7w6...) will not match the historical value a1b2c3d4... recorded in the mapping table. This "abnormal change" immediately indicates that the file hosted by that URL has been tampered with, most likely due to a malicious attack, and the system immediately triggers an interception action.

[0052] like Figure 2 As shown, the present invention also provides a malicious file interception system, comprising: URL listening module 10 is used to monitor network activity and identify and capture file download requests initiated by users; The file download interception module 20 is used to temporarily intercept the download data stream corresponding to the captured download request in response to the captured download request; The feature value calculation module 30 is used to process the file content data received from the file download interception module and calculate and generate the corresponding file feature value; The dynamic mapping generation module 40 is used to establish a dynamic mapping relationship between the target URL carried in the file download request and the file feature value, and store this mapping relationship in a dynamic mapping table; The malicious file determination module 50 is used to query the dynamic mapping table, determine the nature of the file based on the correlation comparison result between the historical file feature information corresponding to the target URL and the currently calculated file feature value, and perform interception or release operations accordingly.

[0053] In one embodiment, such as Figure 3 As shown, a computer device 60 is provided, including a memory 62, a processor 61, and a computer program 63 stored in the memory 62 and executable on the processor 61. When the processor 61 executes the computer program 63, it implements the steps in the data processing method of the above embodiments. To avoid repetition, these steps will not be repeated here. Alternatively, when the processor 61 executes the computer program 63, it implements the functions of each module in the above-described malicious file interception system embodiments. To avoid repetition, these steps will not be repeated here.

[0054] In one embodiment, a readable storage medium is provided, which stores a computer program 63. When the computer program 63 is executed by the processor 61, it implements the steps in the data processing method of the above embodiments. To avoid repetition, these steps will not be repeated here. Alternatively, when the processor 61 executes the computer program 63, it implements the functions of each module in the above data processing device embodiments. To avoid repetition, these steps will not be repeated here.

[0055] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM) and programmable ROM. (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0056] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional modules, sub-modules, and units as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intercepting malicious files, characterized in that, include: Respond to a user's file download request and temporarily intercept the download data stream corresponding to that request; Obtain the file content data from the intercepted download data stream; Based on the content data, a unique file feature value is calculated and generated; Establish a dynamic mapping relationship between the target URL carried in the file download request and the file feature value, and store this mapping relationship in a dynamic mapping table; The dynamic mapping table is queried, and the nature of the file is determined based on the correlation comparison between the historical file feature information corresponding to the target URL and the currently calculated file feature value. Based on this, the interception or release operation is performed.

2. The malicious file interception method according to claim 1, characterized in that, The step of calculating and generating a unique file feature value based on the content data includes: A hash algorithm is applied to the content data to generate a fixed-length hash code; The hash algorithm includes any one of MD5, SHA-1, and SHA-256.

3. The malicious file interception method according to claim 1, characterized in that, The process of establishing a dynamic mapping relationship between the target URL carried in the file download request and the file feature value includes: A key-value pair record is constructed using the target URL as the key and the file feature value and its first or last update timestamp as the value. The key-value pairs are stored in an in-memory database or a high-performance key-value storage system to enable fast querying and updating.

4. The malicious file interception method according to claim 3, characterized in that, The records in the dynamic mapping table are set to have an expiration time; When the duration of a record exceeds its corresponding expiration time, the record is automatically removed from the dynamic mapping table.

5. The malicious file interception method according to claim 1, characterized in that, The determination of the nature of the document includes: Search the dynamic mapping table to see if a record exists with the target URL as the key; If it does not exist, it is determined to be the first access, the download data stream is allowed to continue, and the step of establishing a dynamic mapping relationship is executed; If it exists, compare the currently calculated file feature value with the historical file feature value stored in the retrieved record; If both match, the file is determined to be unchanged and download is permitted. If the two are inconsistent, it is determined that the file content has been changed, triggering an interception action.

6. The malicious file interception method according to claim 5, characterized in that, Following the triggering of the interception action, the following is also included: The currently calculated file signature value is sent to a remote malicious file signature database for deep verification. If the remote malicious file signature database confirms that the current file's signature value is malicious, then interception is performed and a security log is generated; If the malicious intent is not confirmed, then based on the pre-configured security policy, one of the following actions will be taken: allow access, conduct a secondary sandbox inspection, or prompt the user for a decision.

7. The malicious file interception method according to claim 1, characterized in that, The step of responding to a user-initiated file download request and temporarily intercepting the download data stream corresponding to that request includes: The file feature values ​​are calculated while receiving data using a streaming processing method; When the amount of received data reaches a preset threshold and some of the calculated feature values ​​can initially match malicious features, the interception is triggered in advance without waiting for the file to be fully downloaded.

8. A malicious file interception system, comprising: The URL listening module is used to monitor network activity and identify and capture file download requests initiated by users. The file download interception module is used to temporarily intercept the download data stream corresponding to the captured download request in response to the captured download request; The feature value calculation module is used to process the file content data received from the file download interception module and calculate and generate the corresponding file feature value; The dynamic mapping generation module is used to establish a dynamic mapping relationship between the target URL carried in the file download request and the file feature value, and to store this mapping relationship in a dynamic mapping table; The malicious file determination module is used to query the dynamic mapping table, determine the nature of the file based on the correlation comparison results between the historical file feature information corresponding to the target URL and the currently calculated file feature value, and perform interception or release operations accordingly.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the malicious file interception method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the malicious file interception method as described in any one of claims 1-7.

Images