Method and device for safety judgment based on consistency of expanded name and file format

Abstract

The invention discloses a method and device for safety judgment based on the consistency of an expanded name and a file format. The method for safety judgment based on the consistency of the expanded name and the file format comprises the following steps that a format of an expanded name of an object file to be detected is obtained; the characteristics of the object file to be detected are extracted, matching is conducted on the characteristics of the object file to be detected and characteristics in a file format base, and if matching is successful, an actual format of the object file to be detected is recorded; comparison is conducted on the actual format of the object file to be detected and executable formats of an overflowing knowledge base, if comparison is successful, whether the actual format and the format of the expanded name are consistent is judged, and if the actual format and the format of the expanded name are not consistent, it is determined that a threat to the object file to be detected exists. By the adoption of the method and device for safety judgment based on the consistency of the expanded name and the file format, the defect that traditional anti-virus software cannot cope with the situation that detection is eluded through change of an expanded name is overcome, the method for safety judgment based on the consistency of the expanded name and the file format is put forward innovatively, the problem of a safety threat caused by change of the expanded name is effectively solved, and the detection rate of the anti-virus software is improved.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a method and a device for judging file security by using the consistency of file extension and file format. Background technique [0002] At present, malware is showing a trend of large-scale growth. Malware uses various means with high technical complexity to avoid the detection of anti-virus software, resulting in a decline in the detection rate of anti-virus software for malware. Among them, there are a large number of technical means to evade the detection of anti-virus software by modifying file extensions. The following examples are used to illustrate. [0003] Example 1: A virus downloads a file with the extension DAT, but it is actually in VBS executable format. After the virus is downloaded, it will be loaded and executed, but the anti-virus software does not judge the file format, and will consider it safe to download DAT format files. To avoid detection by a...

AI Technical Summary

Problems solved by technology

[0004] Example 2: The MVB file format is a format that can be overflowed, and WMV is a format that cannot be overflowed. If an MVB file uses the WMV extension, the user will think that the file with the WMV extension is safe, but it will trigger when the file is actually used. Vulnerabilities, causing losses to users

Images