Virus feature code processing method and device

Abstract

The invention discloses a virus feature code processing method and device. The method comprises the following steps that: carrying out disassembling processing on a malicious sample which carries viruses, carrying out segmentation on an obtained disassembling code to obtain a plurality of code blocks of the malicious sample; calculating the features of code blocks in each malicious sample, and onthe basis of the sequence of the code blocks in the malicious sample, constructing a feature sequence formed by the features of the code blocks in the malicious sample; comparing the feature sequenceof the malicious sample, and determining the common subsequence of the feature sequences of at least two malicious samples; and according to the common subsequence, judging the corresponding code is the code of the virus, and connecting the features in the common subsequence to obtain the feature code of the virus. When the method is implemented, the feature codes of the virus can be automaticallyand accurately extracted so as to improve virus detection accuracy and instantaneity.

Description

Technical field [0001] The present invention relates to security technology, in particular to a method and device for processing virus signature codes. Background technique [0002] Computer viruses, also called viruses, are malicious codes that are implanted in devices (smartphones, tablet computers, laptops, desktop computers, servers and other computing devices) that destroy the functions or data of the device. [0003] Viruses are usually used as independent applications (such as packers) in devices to trick users into running for malicious purposes, or they are embedded in secondary encapsulated conventional applications to achieve malicious purposes during the running of the conventional applications. [0004] Related technologies mainly rely on manually extracting virus signatures, scanning the device's characteristics of samples to be detected and comparing them with virus signatures, using recognition rules to compare and processing the results to determine whether there are...

AI Technical Summary

Problems solved by technology

[0006] 1) A large number of experienced personnel are required to analyze malicious samples to extract signatures, so as to meet the needs of updating signatures in real time according to emerging viruses, and the efficiency is low

[0007] 2) As the growth rate of viruses continues to increase, manual methods are difficult to meet the real-time requirements of malicious code detection; and the efficiency of manual analysis and extraction of signatures is relatively low, and the generation cycle of signatures is longer, resulting in the detection of malicious codes has a certain hysteresis

[0008] To sum up, there is no effective solution for the automatic and accurate extraction of virus signatures, which can improve the accuracy and real-time performance of virus detection.

Images