Script file confusion detection method and device, equipment and storage medium

Abstract

The invention discloses a script file confusion detection method and device, equipment and a storage medium. The method comprises the steps of obtaining M different confusion detection models and a to-be-detected script file; detecting the script file by using each confusion detection model in the M different confusion detection models to obtain M detection results; and when the M detection results are consistent, determining whether the script file is a confused script file based on the detection results. Therefore, the script file is detected by using the M confusion detection models to obtain M detection results, and when the M detection results are consistent, whether the script file is a confusion script file or a non-confusion script file is determined according to the detection results. The confusion detection model can be repeatedly trained subsequently by using the script file with the consistent detection result, so that the script file to be detected can be accurately detected as a confusion script file or a non-confusion script file, and the problem that only the category of a specific script file can be determined in the prior art; that is, the problem of overfitting of the confusion detection model is solved.

Description

technical field [0001] The present application relates to computer security technology, in particular to a script file confusion detection method, device, equipment and storage medium. Background technique [0002] In order to evade detection and killing by firewalls and anti-virus systems, hackers often use obfuscation techniques to deform malicious script files. From the perspective of security attack and defense, the anti-virus system needs to be able to judge whether a given script file has been processed by obfuscation technology. [0003] The target industry proposes an obfuscated script file identification method for JavaScript script files, that is, use obfuscated tools (such as JaveScript Obfuscator) or through manual labeling to obtain samples of JavaScript script files with obfuscated labels and non-obfuscated labels, and train the scripts The file obfuscation detection model, and then use the trained script file obfuscation detection model to detect whether the ...

AI Technical Summary

Problems solved by technology

However, the labeled samples generated by the obfuscation tool in the above scheme easily lead to overfitting of the script file obfuscation detection model, that is, only specific JavaScript script files can be identified

Images