A malicious script detection method, device and storage medium

Abstract

The embodiment of the present invention discloses a malicious script detection method, device and storage medium, comprising: obtaining a file to be detected; performing text recognition on the file to be detected to obtain a text to be detected; detecting whether there is at least one Specific behavioral features; if it exists, carry out association rule mining processing on the at least one specific behavioral feature, and determine an associated behavioral feature combination that satisfies a preset condition. The preset condition is the minimum support and sum of the behavioral feature combination. minimum credibility; obtaining the scoring result corresponding to the associated behavior feature combination; and judging whether the file to be detected is a malicious script based on the scoring result. Through the text recognition of the files to be detected, the behavior of malicious scripts forging suffixes is eliminated. Through the correlation analysis of the behavior characteristics of the files to be detected, the judgment of malicious scripts has better interpretation and reduces the technical effect of false positives.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious script detection method, device and storage medium. Background technique [0002] With the maturity of current anti-virus technology, traditional PE viruses are more and more difficult to penetrate into the host network, and are often blocked by gateway security devices such as AF and WAF. Therefore, more and more network attacks begin to use malicious scripts to avoid killing (bypass), because most security products do not have the ability to detect plain text files, and often adopt a release strategy to make it possible to invade user hosts. Effect. [0003] The existing technology mainly adopts the following methods to prevent such attacks: [0004] 1. Deploy firewalls, virus gateways, sandboxes and other equipment at the network exit to monitor and kill incoming traffic. [0005] 2. Install anti-virus software on the terminal machine for overall monito...

AI Technical Summary

Problems solved by technology

[0008] 2. Most malicious scripts have forged suffixes, which makes it difficult to identify file formats, and sandboxes and other devices cannot effectively identify them

[0009] 3. Most downloader malicious scripts will pull Internet viruses and execute them in memory, and the virus parent will not be saved on the victim's disk, so even if anti-virus software is installed, it cannot be detected and killed correctly (that is, a typical fileless attack)

Images