Malicious software detection method and device

Abstract

The invention provides a malicious software detection method and device, relates to the field of computer system security and solves the problems that a dynamic detecting method is insufficient in expandability, and the detection result is short of accuracy. The method comprises the steps of calculating a unique digital signature of malicious software to be detected; calculating a target content fingerprint vector quantity of the malicious software to be detected; constituting a nearest neighbor set of the target content fingerprint vector quantity and generating a query set of the content fingerprint vector quantity; getting access to a preset location-sensitive hash table data structure according to the query set of the content fingerprint vector quantity and obtaining a candidate result set; selecting variant software of the malicious software to be detected in the candidate result set. According to the technical scheme of the malicious software detection method and device, the method and device are applicable to protection against variants of the malicious software, and the malicious software detection based on a location-sensitive hash table is achieved.

Description

technical field [0001] The invention relates to the field of computer system security, in particular to a malware detection method and device capable of detecting malware variants. Background technique [0002] With the rapid development of computer technology and Internet applications, information security has become more and more important, and information security has also become an important research field that has attracted much attention. In the face of endless security problems and explosive growth of malware and its variants, it is necessary to continuously improve and improve the detection technology to achieve timely and accurate detection and killing. [0003] Malicious software is a piece of computer instruction, which is implanted by the attacker into the attacked computer through system security holes or other methods, so that the attacked computer performs tasks according to the attacker's wishes, and any threat to the information security of the computer syst...

AI Technical Summary

Problems solved by technology

[0006] The invention provides a malware detection method and device, which solves the problems of insufficient scalability of the dynamic detection method and inaccurate detection results

Images