Virus signature processing method and device

Abstract

The invention discloses a virus feature code processing method and device. The method comprises the following steps that: carrying out disassembling processing on a malicious sample which carries viruses, carrying out segmentation on an obtained disassembling code to obtain a plurality of code blocks of the malicious sample; calculating the features of code blocks in each malicious sample, and onthe basis of the sequence of the code blocks in the malicious sample, constructing a feature sequence formed by the features of the code blocks in the malicious sample; comparing the feature sequenceof the malicious sample, and determining the common subsequence of the feature sequences of at least two malicious samples; and according to the common subsequence, judging the corresponding code is the code of the virus, and connecting the features in the common subsequence to obtain the feature code of the virus. When the method is implemented, the feature codes of the virus can be automaticallyand accurately extracted so as to improve virus detection accuracy and instantaneity.

Description

technical field [0001] The invention relates to security technology, in particular to a method and device for processing virus signature codes. Background technique [0002] Computer viruses, also known as viruses, are malicious purpose codes implanted by compilers in devices (smartphones, tablets, laptops, desktop computers, servers, and other computing devices) to destroy device functions or data. [0003] Viruses are usually used as (for example, packed) independent applications in devices to deceive users into running to achieve malicious purposes, or are embedded in re-encapsulated conventional applications to achieve malicious purposes during the running of conventional applications. [0004] Related technologies mainly rely on manually extracting virus signatures, scanning the characteristics of the samples to be detected in the device and comparing them with the virus signatures, using recognition rules to compare and process the results, and judging whether there is...

AI Technical Summary

Problems solved by technology

[0006] 1) A large number of experienced personnel are required to analyze malicious samples to extract signatures, so as to meet the needs of updating signatures in real time according to emerging viruses, and the efficiency is low

[0007] 2) As the growth rate of viruses continues to increase, manual methods are difficult to meet the real-time requirements of malicious code detection; and the efficiency of manual analysis and extraction of signatures is relatively low, and the generation cycle of signatures is longer, resulting in the detection of malicious codes has a certain hysteresis

[0008] To sum up, there is no effective solution for the automatic and accurate extraction of virus signatures, which can improve the accuracy and real-time performance of virus detection.

Images