CN110554961A - abnormal software detection method and device, computer equipment and storage medium - Google Patents

Abstract

The invention provides an abnormal software detection method, device, computer equipment and storage medium. The method includes: respectively constructing corresponding classifiers according to various attribute information detected by the software, and cascading the classifiers to form an abnormal recognition model; The target attribute information of the software, input the target attribute information into the abnormal recognition model and perform multi-level recognition through classifiers at all levels in sequence; read the output results of the classifiers at all levels of the abnormal recognition model in sequence, and call the abnormal operation function to calculate the abnormal detection value ; When the anomaly detection value calculated by any classifier reaches the set anomaly threshold, stop the detection and determine that the software to be detected is abnormal software. The various attribute information of the software to be detected is detected in sequence. When any attribute is detected to be abnormal, the detection can be stopped and the software to be detected is judged to be abnormal software, and the detection efficiency is higher; the detection of various target attribute information of the software, The detection is more comprehensive and the accuracy is higher.

Description

Abnormal software detection method, device, computer equipment and storage medium

technical field

The present invention relates to the field of computer technology, in particular, the present invention relates to a method for detecting abnormal software, a device for detecting abnormal software, computer equipment and a storage medium.

Background technique

With the rapid development of Internet technology and communication technology, operating systems have rapidly spread from the field of personal computers to the field of mobile terminals. In the operating system, some application software is very aggressive and intrusive, and may destroy the operating system or steal the user's private information. Therefore, it is necessary to detect abnormal software in the operating system.

At present, the detection method based on static features is usually used for detection, that is, to determine whether the application software is abnormal software according to the combination of abnormal authorization of the application software. It is necessary to detect all the permissions of the software. , the detection accuracy of this scheme is not high enough, and the efficiency is relatively low.

Contents of the invention

The purpose of the present invention is to at least solve one of the above-mentioned technical defects, especially the technical defects that the detection accuracy of abnormal software is not high enough and the efficiency is relatively low.

The present invention provides a method for detecting abnormal software, comprising the following steps:

Construct corresponding classifiers respectively according to the attribute information detected by the software, and cascade the classifiers to form an abnormality recognition model;

extracting the target attribute information of the software to be detected, inputting the target attribute information into the abnormality recognition model and sequentially performing multi-level recognition through classifiers at all levels;

Read the output results of the classifiers at all levels of the abnormal recognition model in sequence, and call the abnormal operation function to calculate the abnormal detection value;

When the abnormality detection value calculated correspondingly by any one-level classifier reaches the set abnormality threshold, the detection is stopped and the software to be detected is determined to be abnormal software.

In one embodiment, the step of constructing corresponding classifiers according to the attribute information detected by the software includes:

Obtaining a first set of attributes detected by a plurality of normal sample software, and obtaining a second set of attributes detected by a plurality of abnormal sample software;

selecting valid attributes from the first attribute set and the second attribute set;

The corresponding classifiers are generated according to the attribute information of each effective attribute.

In one embodiment, the selecting valid attributes from the first attribute set and the second attribute set includes:

Calculating the first support degree between each attribute and the first attribute set in the first attribute set and the second attribute set, and the second support degree between each attribute and the second attribute set ;

calculating the difference between the first support degree and the second support degree to obtain a support degree difference;

When the support difference is greater than a preset difference, the corresponding attribute is used as the effective attribute.

In one embodiment, the step of cascading the classifiers to form an abnormality recognition model includes:

Sorting the corresponding classifiers according to the size of the support difference;

The sorted classifiers are cascaded to form the abnormality recognition model.

In one embodiment, the step of extracting target attribute information of the software to be detected includes:

Obtain initial attribute information of the software to be detected;

Searching for the target attribute information corresponding to the effective attribute from the initial attribute information.

In one embodiment, the step of calling the abnormal operation function to calculate the abnormal detection value includes:

Querying the abnormal operation functions corresponding to each of the classifiers;

Each of the abnormal operation functions is called in turn to perform operations on the corresponding output results to obtain each of the abnormal detection values.

In one embodiment, before the step of stopping the detection and determining that the software to be detected is abnormal software when the abnormality detection value calculated by any one-level classifier reaches the set abnormality threshold, it further includes:

A set abnormality threshold corresponding to each of the classifiers is acquired.

The present invention also provides a computer device, including a memory and a processor, where computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the processor executes any one of the implementations. The steps of the abnormal software detection method described in the example.

The present invention also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, one or more processors execute the abnormal software detection method described in any embodiment. A step of.

In the above abnormal software detection method, device, computer equipment and storage medium, corresponding classifiers are respectively constructed according to the attribute information detected by the software, and the classifiers are cascaded to form an abnormal recognition model; the target of the software to be detected is extracted Attribute information, input the target attribute information into the abnormality recognition model and perform multi-level recognition sequentially through classifiers at all levels; sequentially read the output results of the classifiers at all levels in the abnormality recognition model, and call the abnormal operation function to calculate Abnormality detection value; when the abnormality detection value calculated correspondingly by any one-level classifier reaches a set abnormality threshold, stop detection and determine that the software to be detected is abnormal software. The various attribute information of the software to be detected is detected in sequence. When any attribute is detected to be abnormal, the detection can be stopped and the software to be detected is judged to be abnormal software, and the detection efficiency is higher; the detection of various target attribute information of the software, The detection is more comprehensive and the accuracy is higher.

Additional aspects and advantages of the invention will be set forth in part in the description which follows, and will become apparent from the description, or may be learned by practice of the invention.

Description of drawings

The above and/or additional aspects and advantages of the present invention will become apparent and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, wherein:

Fig. 1 is a schematic diagram of an application environment of an abnormal software detection method in an embodiment;

Fig. 2 is a flowchart of an abnormal software detection method in an embodiment;

Fig. 3 is a flowchart of an abnormal software detection method in an embodiment;

Fig. 4 is the flowchart of abnormal software detection method in another embodiment;

FIG. 5 is a schematic flow diagram of an abnormal software detection method in an embodiment;

Fig. 6 is a schematic structural diagram of an abnormal software detection device in an embodiment;

Fig. 7 is a schematic diagram of the internal structure of a computer device in one embodiment.

Detailed ways

Embodiments of the present invention are described in detail below, examples of which are shown in the drawings, wherein the same or similar reference numerals designate the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the figures are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

Those skilled in the art will understand that unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the word "comprising" used in the description of the present invention refers to the presence of said features, integers, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, Integers, steps, operations, elements, components, and/or groups thereof.

Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this invention belongs. It should also be understood that terms, such as those defined in commonly used dictionaries, should be understood to have meanings consistent with their meaning in the context of the prior art, and unless specifically defined as herein, are not intended to be idealized or overly Formal meaning to explain.

The abnormal software detection method provided in this application can be applied to the application environment shown in FIG. 1 . As shown in Figure 1, the server 104 builds corresponding classifiers according to the various attribute information detected by the software, and the classifiers are cascaded to form an abnormality recognition model; the server 104 extracts the target attribute information of the software to be detected from the terminal 102 , input the target attribute information into the abnormal recognition model and perform multi-level recognition sequentially through classifiers at all levels; the server 104 sequentially reads the output results of the classifiers at all levels of the abnormal recognition model, and calls the abnormal operation function to calculate Abnormality detection value: when the abnormality detection value calculated correspondingly by any classifier reaches the set abnormality threshold, the server 104 stops identifying and determines that the software to be detected in the terminal 102 is abnormal software.

Those skilled in the art can understand that the terminal used here can be mobile phone, tablet computer, PDA (Personal Digital Assistant, personal digital assistant), MID (Mobile Internet Device, mobile Internet device) etc.; Server can use independent server or It is implemented by a server cluster composed of multiple servers.

In one embodiment, as shown in FIG. 2 , a method for detecting abnormal software is provided. The method is applied to the server in FIG. 1 as an example for illustration, including the following steps:

In step S201, corresponding classifiers are respectively constructed according to various attribute information detected by the software, and the classifiers are cascaded to form an abnormality recognition model.

The attributes detected by the software may include attributes such as identity verification, authorization, confidentiality, availability, and integrity; or they may simply refer to various permissions in the application permissions.

In the specific implementation process, the classifiers corresponding to each attribute information are respectively constructed, and then the classifiers are cascaded according to the preset order to form an abnormality recognition model, and the abnormality detection is performed on each attribute according to the abnormality recognition model; The target attribute information is detected, the detection is more comprehensive, and the accuracy is higher.

Taking the three attributes of authentication, authorization, and confidentiality as examples, three classifiers are constructed respectively, corresponding to authentication, authorization, and confidentiality, to obtain the target authentication, target authorization, and target confidentiality of the software to be tested. Input to the corresponding classifier in turn for anomaly detection.

In one embodiment, step S201 constructs corresponding classifiers according to the attribute information detected by the software, including:

A1. Obtain a first attribute set detected by multiple normal sample software, and acquire a second attribute set detected by multiple abnormal sample software.

Wherein, the normal sample software refers to the software whose various attributes are normal after testing, and the abnormal sample software refers to the sample software which has been detected as abnormal software.

A2. Select valid attributes from the first attribute set and the second attribute set.

The specific steps for selecting valid attributes are as follows:

(1) Calculate the first support between each attribute and the first attribute set in the first attribute set and the second attribute set, and the first support degree between each attribute and the second attribute set Second degree of support;

Specifically, the first support degree represents the degree of correlation between the attribute and the first attribute set, and the second support degree represents the degree of correlation between the attribute and the second attribute set.

(2) calculating the difference between the first degree of support and the second degree of support to obtain a difference in support degree;

(3) When the support difference is greater than a preset difference, use the corresponding attribute as the effective attribute.

It can be understood that the larger the support difference, the more obvious the distinction between the normal sample software and the abnormal sample software, indicating that the attribute has more judgment value. Therefore, when the support difference is greater than the preset difference , the attribute is determined to be a valid attribute.

A3. Generate corresponding classifiers according to attribute information of each effective attribute.

In this embodiment, by judging the degree of difference between each attribute for normal sample software and abnormal sample software, effective attributes are obtained from the software detection attributes, and a corresponding classifier is constructed according to the attribute information of the effective attributes, so that the software to be detected Detecting target attribute information corresponding to valid attributes among all attribute information can effectively improve detection efficiency.

In one embodiment, the step S201 of cascading the classifiers to form an abnormality recognition model includes:

B1. Sorting the corresponding classifiers according to the magnitudes of the support differences.

Since the greater the support difference, it means that this attribute is more obvious for the distinction between normal sample software and abnormal sample software, indicating that this attribute has more judgment value, and the relative importance will be higher. Therefore, according to each effective The support difference of attributes sorts the corresponding classifiers, and the classifiers corresponding to important effective attributes will be ranked higher, so as to detect software anomalies more quickly.

B2, cascading the sorted classifiers to form the abnormality recognition model.

In this embodiment, the corresponding classifiers are sorted according to the support difference of each effective attribute, and then the sorted classifiers are cascaded to form an abnormality recognition model, which can detect whether the software is abnormal more quickly ;; Detect various target attribute information of the software, the detection is more comprehensive and the accuracy is higher.

Step S202, extracting the target attribute information of the software to be tested, inputting the target attribute information into the abnormality recognition model, and performing multi-level recognition sequentially through classifiers at all levels.

Wherein, the target attribute information is attribute information of effective attributes of the software to be detected.

In the specific implementation process, the attribute information of the effective attributes of the software to be detected is sequentially input into the classifiers corresponding to the effective attributes according to the importance of each classifier for multi-level identification.

As shown in Figure 3, in one embodiment, the step S202 of extracting the target attribute information of the software to be detected includes:

Step S210, acquiring initial attribute information of the software to be detected.

Step S220, searching for the target attribute information corresponding to the effective attribute from the initial attribute information.

Since some attribute information in the software to be detected is not of high reference value for judging whether the software to be detected is abnormal software, the target attribute information corresponding to the effective attribute will be searched from the initial attribute information, and the The attribute information determines whether the software to be detected is abnormal software.

Step S203, read the output results of the classifiers at all levels of the abnormality recognition model in sequence, and call the abnormality operation function to calculate the abnormality detection value.

Specifically, the abnormal operation functions corresponding to classifiers at all levels may be the same, or multiple abnormal operation functions may be set, and each abnormal operation function corresponds to each classifier.

As shown in Figure 4, in one embodiment, the step of calling the abnormal operation function in step S203 to calculate the abnormal detection value includes:

Step S310, querying the abnormal operation functions corresponding to each of the classifiers.

It can be understood that, since the attribute information detected by each classifier is different, the corresponding abnormal operation functions are different.

Specifically, a variety of abnormal operation functions are pre-stored in the server, and each abnormal operation function is set with a corresponding valid attribute. Only by querying the corresponding effective attributes of each classifier, the abnormal operation function corresponding to the valid attribute can be obtained.

Step S320, sequentially calling each of the abnormal operation functions to perform operations on the corresponding output results to obtain each of the abnormal detection values.

In this embodiment, according to the effective attribute corresponding to the classifier, the abnormal operation function corresponding to the effective attribute is queried, and each time an effective attribute is detected, the output result is calculated according to the corresponding abnormal operation function, and the value of the effective attribute is calculated according to the importance of the effective attribute. degree, each target attribute is detected in turn.

Step S204, when the abnormality detection value calculated by any one of the classifiers reaches the set abnormality threshold, stop the detection and determine that the software to be detected is abnormal software.

In the specific implementation process, the importance of the effective attributes is sequentially detected by each classifier for each target. When the output result corresponding to a certain target attribute is found to be abnormal, the software to be detected is determined to be abnormal software.

It should be noted that when the output result corresponding to a target attribute is abnormal, the detection can be stopped and the software to be detected is determined to be abnormal software, and there is no need to detect other target attributes later, because the detection of the higher-ranked target The importance of the attribute information is higher. When the more important target attribute information has detected anomalies, there is no need to detect the relatively less important target attribute information.

For example, suppose there are three classifiers, and the corresponding valid attributes are authentication, authorization, and confidentiality. According to different classifiers, the authentication, authorization, and confidentiality of the software to be tested are detected in sequence. When the detection result of the authorization attribute is abnormal When , it is no longer necessary to detect the remaining confidentiality attributes, because the authorization attribute is more important than the confidentiality attribute, so detection can improve the speed of software detection.

Specifically, the set abnormality thresholds corresponding to the multi-level classifiers may be the same, or multiple set abnormality thresholds may be set, and each set abnormality threshold corresponds to each classifier.

In one embodiment, when the abnormality detection value calculated by any one-level classifier reaches the set abnormality threshold in step S204, before stopping the detection and judging that the software to be detected is abnormal software, it also includes: The abnormality threshold corresponding to the classifier is set.

Furthermore, because each classifier passes through the anomaly detection, it is necessary to judge whether the output result of the classifier reaches the set anomaly threshold, and the effective attributes corresponding to different classifiers are inconsistent, and the set anomalies corresponding to different effective attributes The threshold can be set to be different, therefore, it is necessary to obtain the set abnormal threshold corresponding to each classifier first.

In the specific implementation process, there are many kinds of set abnormal thresholds pre-stored in the server, and each set abnormal threshold is set with corresponding valid attributes. You only need to query the valid attributes corresponding to each classifier, and you can obtain the set corresponding to the valid attributes. Set the exception threshold.

In conjunction with accompanying drawing 5, the above-mentioned abnormal software detection method is further described, the target attribute information of the software to be tested is extracted, and input into the abnormal detection model formed by cascading multiple classifiers in sequence, each time a classifier is input, the pitch Take the corresponding abnormal operation function for operation, and compare the detection results of each level of classifier with the set abnormal threshold. When the operation result corresponding to a certain level of classifier reaches the corresponding abnormal detection value, the detection will be stopped. Then input the target attribute information into the next classifier for calculation, and determine that the software to be detected is abnormal software.

In order to better understand the above method, an application example of abnormal software detection of the present invention is elaborated below:

1), obtaining a plurality of normal sample software and a plurality of abnormal sample software, and selecting effective attributes from attribute information of a plurality of normal sample software and a plurality of abnormal sample software;

2) The selected effective attributes are authentication and authorization, and the two attributes are sorted according to the support difference of each effective attribute, and the importance is descending to authorization and authentication;

3) Concatenate the classifiers corresponding to the authorization and the classifiers corresponding to the identity verification in order to form an abnormality recognition model;

4) Extracting the target attribute information corresponding to authorization and identity verification from the initial attribute information of the software to be detected;

5) inputting the target attribute information corresponding to the authorization into the classifier corresponding to the authorization, and judging whether the first output result reaches the first set abnormal threshold;

6) If the first output result does not reach the first set abnormal threshold, input the target attribute information corresponding to the identity verification into the classifier corresponding to the identity verification, and judge whether the second output result reaches the second set abnormal threshold.

In the method for detecting abnormal software described above, corresponding classifiers are respectively constructed according to the attribute information detected by the software, and the classifiers are cascaded to form an abnormal recognition model; the target attribute information of the software to be detected is extracted, and the target attribute The information is input into the abnormality recognition model and multi-level recognition is sequentially carried out by classifiers at all levels; the output results of the classifiers at all levels of the abnormality recognition model are read in sequence, and the abnormal operation function is called to calculate the abnormality detection value; when any When the abnormal detection value calculated by the first-level classifier reaches the set abnormal threshold, the detection is stopped and the software to be detected is determined to be abnormal software. The various attribute information of the software to be detected is detected in sequence. When any attribute is detected to be abnormal, the detection can be stopped and the software to be detected is judged to be abnormal software, and the detection efficiency is higher; the detection of various target attribute information of the software, The detection is more comprehensive and the accuracy is higher.

As shown in FIG. 6, FIG. 6 is a schematic structural diagram of an abnormal software detection device in an embodiment. An abnormal software detection device is provided in this embodiment, including a recognition model building module 601, a multi-level recognition module 602, and an abnormal operation module 603. And abnormal judgment module 604, wherein:

The recognition model building module 601 is used to build corresponding classifiers according to the attribute information detected by the software, and cascade the classifiers to form an abnormal recognition model;

The multi-level identification module 602 is used to extract the target attribute information of the software to be detected, input the target attribute information into the abnormal identification model and perform multi-level identification sequentially through classifiers at all levels;

Abnormal operation module 603, used to sequentially read the output results of the classifiers at all levels of the abnormal recognition model, and call the abnormal operation function to calculate the abnormal detection value;

An abnormality determination module 604, configured to stop detection and determine that the software to be detected is abnormal software when the abnormality detection value calculated correspondingly by any one of the classifiers reaches a set abnormality threshold.

For the specific limitations of the abnormal software detection device, please refer to the above-mentioned definition of the abnormal software detection method, which will not be repeated here. Each module in the above-mentioned abnormal software detection device can be fully or partially realized by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, and can also be stored in the memory of the computer device in the form of software, so that the processor can invoke and execute the corresponding operations of the above-mentioned modules.

As shown in FIG. 7, FIG. 7 is a schematic diagram of the internal structure of a computer device in an embodiment. The computer equipment includes a processor, a non-volatile storage medium, a memory and a network interface connected through a device bus. Wherein, the non-volatile storage medium of the computer device stores an operating device, a database, and computer-readable instructions, and the database can store control information sequences. When the computer-readable instructions are executed by the processor, the processor can realize a An abnormal software detection method. The processor of the computer equipment is used to provide computing and control capabilities and support the operation of the entire computer equipment. Computer-readable instructions may be stored in the memory of the computer device, and when the computer-readable instructions are executed by the processor, the processor may execute a method for detecting abnormal software. The network interface of the computer device is used for connecting and communicating with the terminal. Those skilled in the art can understand that the structure shown in Figure 7 is only a block diagram of a part of the structure related to the solution of this application, and does not constitute a limitation to the computer equipment on which the solution of this application is applied. The specific computer equipment can be More or fewer components than shown in the figures may be included, or some components may be combined, or have a different arrangement of components.

In one embodiment, a computer device is proposed. The computer device includes a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the following steps are implemented: Each attribute information constructs a corresponding classifier, and the classifiers are cascaded to form an abnormality recognition model; the target attribute information of the software to be detected is extracted, and the target attribute information is input into the abnormality recognition model and passed through all levels of classification. The multi-level identification is carried out in sequence; the output results of the classifiers at all levels of the abnormal identification model are read in sequence, and the abnormal operation function is called to calculate the abnormal detection value; when the abnormal detection value calculated by any one of the classifiers reaches the set When the abnormal threshold is set, the detection is stopped and the software to be detected is determined to be abnormal software.

In one of the embodiments, when the processor executes the computer program, the step of constructing corresponding classifiers according to the attribute information detected by the software includes: obtaining a plurality of first attribute sets detected by software of normal samples, and obtaining multiple A second attribute set detected by abnormal sample software; selecting effective attributes from the first attribute set and the second attribute set; generating corresponding classifiers according to the attribute information of each of the effective attributes.

In one of the embodiments, when the processor executes the computer program, the step of selecting effective attributes from the first attribute set and the second attribute set includes: calculating the first attribute set and the second attribute set In the attribute set, the first support between each attribute and the first attribute set, and the second support between each attribute and the second attribute set; calculate the first support and the second support The difference between the two support degrees is to obtain a support difference value; when the support degree difference value is greater than a preset difference value, the corresponding attribute is used as the effective attribute.

In one of the embodiments, when the processor executes the computer program, the step of cascading the classifiers to form an abnormality recognition model includes: pairing the corresponding classifiers according to the size of the support difference Sorting; cascading the sorted classifiers to form the abnormality recognition model.

In one of the embodiments, when the processor executes the computer program, the step of extracting the target attribute information of the software to be detected includes: obtaining the initial attribute information of the software to be detected; searching for the effective attribute information from the initial attribute information The corresponding target attribute information.

In one embodiment, when the processor executes the computer program, the step of calling the abnormal operation function to calculate the abnormal detection value includes: querying the abnormal operation function corresponding to each of the classifiers; calling each of the abnormal operation functions in turn Computing is performed on each of the corresponding output results to obtain each of the abnormality detection values.

In one of the embodiments, when the processor executes the computer program, when the abnormality detection value calculated correspondingly by any one-level classifier reaches the set abnormality threshold, the step of stopping the detection and determining that the software to be detected is abnormal software Before, the method further includes: acquiring the set abnormality threshold corresponding to each classifier.

In one embodiment, a storage medium storing computer-readable instructions is provided. When executed by one or more processors, the computer-readable instructions cause the one or more processors to perform the following steps: Each attribute information constructs a corresponding classifier, and the classifiers are cascaded to form an abnormality recognition model; the target attribute information of the software to be detected is extracted, and the target attribute information is input into the abnormality recognition model and passed through all levels of classification. The multi-level identification is carried out in sequence; the output results of the classifiers at all levels of the abnormal identification model are read in sequence, and the abnormal operation function is called to calculate the abnormal detection value; when the abnormal detection value calculated by any one of the classifiers reaches the set When the abnormal threshold is set, the detection is stopped and the software to be detected is determined to be abnormal software.

In one of the embodiments, when the computer-readable instructions are executed by the processor, the step of constructing corresponding classifiers according to the attribute information detected by the software includes: obtaining the first attribute set detected by the software of a plurality of normal samples, and acquiring a plurality of second attribute sets detected by abnormal sample software; selecting effective attributes from the first attribute set and the second attribute set; generating corresponding classifiers according to the attribute information of each of the effective attributes .

In one of the embodiments, when the computer readable instructions are executed by the processor, the step of selecting valid attributes from the first attribute set and the second attribute set includes: calculating the first attribute set and the In the second attribute set, the first support between each attribute and the first attribute set, and the second support between each attribute and the second attribute set; calculate the first support and The difference of the second support degree obtains a support degree difference value; when the support degree difference value is greater than a preset difference value, the corresponding attribute is used as the effective attribute.

In one of the embodiments, when the computer-readable instructions are executed by the processor, the step of cascading the classifiers to form an abnormality recognition model includes: pairing the corresponding classifiers according to the size of the support difference The classifiers are sorted; the sorted classifiers are cascaded to form the abnormality recognition model.

In one of the embodiments, when the computer-readable instructions are executed by the processor, the step of extracting the target attribute information of the software to be detected includes: obtaining the initial attribute information of the software to be detected; The target attribute information corresponding to the effective attribute.

In one of the embodiments, when the computer-readable instructions are executed by the processor, the step of calling the abnormal operation function to calculate the abnormal detection value includes: querying the abnormal operation function corresponding to each of the classifiers; The abnormal operation function performs operation on each of the corresponding output results to obtain each of the abnormal detection values.

In one of the embodiments, when the computer-readable instructions are executed by the processor, when the abnormal detection value calculated correspondingly by any classifier reaches the set abnormal threshold, the detection is stopped and the software to be detected is determined to be abnormal. Before the steps of the software, it also includes: acquiring the set abnormality threshold corresponding to each classifier.

It should be understood that although the various steps in the flow chart of the accompanying drawings are displayed sequentially according to the arrows, these steps are not necessarily executed sequentially in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the order of execution is also It is not necessarily performed sequentially, but may be performed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

The above descriptions are only part of the embodiments of the present invention. It should be pointed out that those skilled in the art can make some improvements and modifications without departing from the principles of the present invention. It should be regarded as the protection scope of the present invention.

Claims (10)

1. A method for detecting abnormal software, characterized in that, comprising the steps of: Construct corresponding classifiers respectively according to the attribute information detected by the software, and cascade the classifiers to form an abnormality recognition model; extracting the target attribute information of the software to be detected, inputting the target attribute information into the abnormality recognition model and sequentially performing multi-level recognition through classifiers at all levels; Read the output results of the classifiers at all levels of the abnormal recognition model in sequence, and call the abnormal operation function to calculate the abnormal detection value; When the abnormality detection value calculated correspondingly by any one-level classifier reaches the set abnormality threshold, the detection is stopped and the software to be detected is determined to be abnormal software. 2. The method according to claim 1, wherein the step of constructing corresponding classifiers according to the attribute information detected by the software includes: Obtaining a first set of attributes detected by a plurality of normal sample software, and obtaining a second set of attributes detected by a plurality of abnormal sample software; selecting valid attributes from the first attribute set and the second attribute set; The corresponding classifiers are generated according to the attribute information of each effective attribute. 3. The method according to claim 2, wherein the step of selecting valid attributes from the first attribute set and the second attribute set comprises: Calculating the first support degree between each attribute and the first attribute set in the first attribute set and the second attribute set, and the second support degree between each attribute and the second attribute set ; calculating the difference between the first support degree and the second support degree to obtain a support degree difference; When the support difference is greater than a preset difference, the corresponding attribute is used as the effective attribute. 4. The method according to claim 3, wherein the step of cascading the classifiers to form an abnormality recognition model comprises: Sorting the corresponding classifiers according to the size of the support difference; The sorted classifiers are cascaded to form the abnormality recognition model. 5. The method according to claim 2, wherein the step of extracting the target attribute information of the software to be detected comprises: Obtain initial attribute information of the software to be detected; Searching for the target attribute information corresponding to the effective attribute from the initial attribute information. 6. The method according to claim 1, wherein the step of calling an abnormal operation function to calculate an abnormal detection value comprises: Querying the abnormal operation functions corresponding to each of the classifiers; Each of the abnormal operation functions is called in turn to perform operations on the corresponding output results to obtain each of the abnormal detection values. 7. The method according to claim 1, characterized in that, when the abnormality detection value calculated correspondingly by the any one-level classifier reaches the set abnormality threshold, the detection is stopped and the software to be detected is determined to be abnormal software Before the steps, also include: A set abnormality threshold corresponding to each of the classifiers is acquired. 8. A device for detecting abnormal software, comprising: A recognition model building module, used to construct corresponding classifiers respectively according to the attribute information detected by the software, and cascade the classifiers to form an abnormal recognition model; A multi-level identification module is used to extract the target attribute information of the software to be detected, input the target attribute information into the abnormal identification model and perform multi-level identification sequentially through classifiers at all levels; The abnormal operation module is used to sequentially read the output results of the classifiers at all levels of the abnormal recognition model, and call the abnormal operation function to calculate the abnormal detection value; An abnormality determination module, configured to stop detection and determine that the software to be detected is abnormal software when the abnormality detection value calculated correspondingly by any one of the classifiers reaches a set abnormality threshold. 9. A computer device, comprising a memory and a processor, wherein computer-readable instructions are stored in the memory, wherein when the computer-readable instructions are executed by the processor, the processor performs the The steps of the abnormal software detection method described in any one of requirements 1 to 7. 10. A storage medium storing computer-readable instructions, wherein, when the computer-readable instructions are executed by one or more processors, one or more processors execute any A step of the abnormal software detection method.