A file format identification method and system based on compressed package content

Abstract

The invention discloses a method for identifying a file format based on compressed package content. The method comprises a feature extraction stage and a file identification stage; the feature extraction stage comprises the steps of: obtaining a compressed package type file, extracting all the file names in the compressed package type file, carrying out statistical analysis to obtain a feature identifier of each compressed package format, and forming a feature library; the file identification stage comprises the steps of: obtaining a to-be-identified file, judging whether the to-be-identified file is in a compressed package type, obtaining all the file names contained in the to-be-identified file in the compressed package type, matching the file names with features in the feature library, and finally reporting the file format of the to-be-identified file. The invention also provides a system for identifying the file format based on the compressed package content, which remedies disadvantages of an existing format identifying technology that the specific compressed package format cannot be identified precisely, but only the compressed package file is displayed when the compressed package type is identified.

Description

technical field [0001] The invention relates to the field of network information security, in particular to a file format identification method and system based on compressed package content. Background technique [0002] Format recognition technology is an important basic technology in the field of network information security technology, and format recognition has a great auxiliary effect on follow-up work such as virus killing and vulnerability detection. Currently, there are two commonly used format recognition technologies, one is suffix-based recognition, and the other is file format-based recognition. Based on the file format suffix identification technology, if there is no file suffix or the suffix is ​​modified, it is difficult to accurately identify the format of the file to be recognized. The method based on file format magic recognition is currently the main file format recognition method. This method is helpless for file formats that use compressed packages as ...

AI Technical Summary

Problems solved by technology

[0003] In view of the defect that the existing technology cannot accurately identify the file format with the compressed package as the carrier, the present invention proposes a file format identification method and system based on the content of the compressed package

Images