Method and device for judging same origin of malicious files

Abstract

The invention discloses a homologous determination method and device for malicious files. The method and device are used for solving the problem of the lower accuracy of the homologous determination result in the prior art. The method comprises the steps that based on the characteristic behavior data information of each malicious file in the first class specified dimension, the category of each malicious file is obtained, and whether the malicious file in the corresponding category is the homologous malicious file or not is determined based on the characteristic behavior data information of each malicious file of each category in the second class specified dimension. Through the fusion analysis of the characteristic behavior data information in the multiple dimensions, the homologous malicious file is accurately judged and the accuracy of the homologous determination result is effectively improved. Moreover, after the determination of the category of the various malicious files, the homologous determination of the category of the various malicious files is conducted, so that the calculated amount of the homologous determination is decreased and the accuracy of the homologous determination result is further improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for judging the same origin of malicious files. Background technique [0002] With the continuous development of network information technology, hidden dangers of network security also follow. Among them, malicious files have become a major factor that endangers network security. Obviously, the analysis of malicious files has become an important basis for detecting and preventing malicious files. . By analyzing a large number of malicious files, it is found that many newly emerging malicious files are variants of existing malicious files. Based on this, in the prior art, the malicious file of the same source is mainly analyzed by analyzing the bit sequence of the malicious file, that is, the bit sequence of a large number of malicious file samples is first analyzed to obtain the bit sequence characteristics of the malicious file of the same source ,...

AI Technical Summary

Problems solved by technology

[0004] The embodiment of the present invention provides a method and device for judging the homology of malicious files, which is used to solve the problem of poor accuracy of judging results of homology of malicious files existing in the prior art

Images