Homologous determination method and device for the malicious files

Abstract

The invention discloses a homologous determination method and device for malicious files. The method and device are used for solving the problem of the lower accuracy of the homologous determination result in the prior art. The method comprises the steps that based on the characteristic behavior data information of each malicious file in the first class specified dimension, the category of each malicious file is obtained, and whether the malicious file in the corresponding category is the homologous malicious file or not is determined based on the characteristic behavior data information of each malicious file of each category in the second class specified dimension. Through the fusion analysis of the characteristic behavior data information in the multiple dimensions, the homologous malicious file is accurately judged and the accuracy of the homologous determination result is effectively improved. Moreover, after the determination of the category of the various malicious files, the homologous determination of the category of the various malicious files is conducted, so that the calculated amount of the homologous determination is decreased and the accuracy of the homologous determination result is further improved.

Description

Technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for judging malicious files from the same origin. Background technique [0002] With the continuous development of network information technology, hidden dangers of network security also follow. Among them, malicious files have become a major factor that endangers network security. Obviously, the analysis of malicious files has become an important basis for detecting and preventing malicious files. . Through analyzing a large number of malicious files, it is found that many new malicious files are variants of existing malicious files. Based on this, the prior art mainly analyzes the bit sequence of the malicious file to determine the homologous malicious file, that is, first analyzes the bit sequence of a large number of malicious file samples to obtain the bit sequence characteristics of the homologous malicious file , And then use this as a basis to de...

AI Technical Summary

Problems solved by technology

[0004] The embodiment of the present invention provides a method and device for judging the homology of malicious files, which is used to solve the problem of poor accuracy of judging results of homology of malicious files existing in the prior art

Images