WO2015139569A1 - 文件信誉获取方法、网关设备和文件信誉服务器 - Google Patents

文件信誉获取方法、网关设备和文件信誉服务器 Download PDF

Info

Publication number
WO2015139569A1
WO2015139569A1 PCT/CN2015/073878 CN2015073878W WO2015139569A1 WO 2015139569 A1 WO2015139569 A1 WO 2015139569A1 CN 2015073878 W CN2015073878 W CN 2015073878W WO 2015139569 A1 WO2015139569 A1 WO 2015139569A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
function
hash value
function hash
sample set
Prior art date
Application number
PCT/CN2015/073878
Other languages
English (en)
French (fr)
Inventor
刘振华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP15764199.4A priority Critical patent/EP3109789B1/en
Publication of WO2015139569A1 publication Critical patent/WO2015139569A1/zh
Priority to US15/264,719 priority patent/US10355866B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/13—File access structures, e.g. distributed indices
    • G06F16/137—Hash-based
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the invention belongs to the technical field of computers, and in particular relates to a method for acquiring a file reputation, a gateway device and a file reputation server.
  • the user In networks such as Wireless Local Area Networks (WLAN), Second Generation Mobile Communication (2rd-Generation, 2G), and Third Generation Mobile Communication (3G),
  • WLAN Wireless Local Area Networks
  • 2G Second Generation Mobile Communication
  • 3G Third Generation Mobile Communication
  • the user generally accesses the network through a network device such as a gateway device, a Gateway GPRS Support Node (GGSN), a base station, and an enhanced base station, thereby accessing the network application.
  • GGSN Gateway GPRS Support Node
  • the network device needs to obtain the reputation value of the file, so as to determine whether to allow the user to access and other subsequent processing based on the reputation value.
  • the average enterprise user will additionally care about the reputation value of the file accessed by the user.
  • the email sent by the user will be more concerned, and the reputation value of the transmitted FTP file satisfies certain requirements, thereby ensuring the enterprise of the user.
  • the network system is safe and reliable.
  • a widely used method for obtaining a file reputation is that a network device such as a gateway device generates a feature value according to the full text or partial content of a file currently accessed by the user (hereinafter referred to as "accessed file" in the present application). Therefore, according to the generated feature value, the reputation value of the accessed file is queried in a database in which the gateway device stores a correspondence between a known feature value and a file reputation value.
  • the feature value of the file is generated according to the content of the file.
  • the feature value corresponding to the file to be queried does not exist in the file reputation database.
  • the phenomenon of file reputation value causes the query to fail.
  • the embodiment of the present invention provides a file reputation acquisition method, a gateway device, and a file reputation server, which are used to alleviate the problem that the file reputation value query failure rate is high in the prior art based on the file content generation feature value.
  • an embodiment of the present invention provides a method for obtaining a file reputation, including:
  • a classifier obtained by pre-training, determining a probability distribution respectively corresponding to each function hash value of the at least one function hash value, the probability distribution being used to indicate that each function hash value is in a black sample a probability of occurrence in a set of files, and a probability that each of the function hash values appears in a file of a white sample set, the black sample set including at least one malicious program file, the white sample set including at least one normal program file;
  • the obtaining a function hash value of at least one function in the accessed file includes:
  • a function hash value of each of the at least one function is separately calculated using a preset hash algorithm.
  • the using the pre-trained classifier to determine the at least one function respectively The probability distribution corresponding to each function hash value in the Greek value, including:
  • the method further includes:
  • the determining, according to the probability distribution corresponding to each function hash value, The reputation value of the file being accessed including:
  • Determining that the accessed file has a lower value than the second if there is a function hash value that exceeds a preset number and the probability distribution appears in the file of the black sample set is higher than the first preset threshold The reputation value of the preset threshold.
  • an embodiment of the present invention provides a file reputation obtaining method, including:
  • the classifier is trained with the function hash value of each function, and the function hash value of each function is counted at the output of the classifier respectively in the file of the black sample set The number of times and the number of occurrences in the file of the white sample set;
  • each function's function hash value normalize the number of occurrences of the function hash value in the file of the black sample set and the number of occurrences in the file of the white sample set to obtain The probability distribution of the function hash values of each function is formed to form a set of function hash probability distributions.
  • the obtaining the probability distribution of the function hash value of each function, after forming the function hash value probability distribution set further includes:
  • the at least one function hash value is Obtaining, by the gateway device, according to the accessed file, the accessed file is an executable program file;
  • the classifier obtained by using the training determines that at least one of the file and the accessed file are respectively The probability distribution corresponding to each function hash value in the function hash value, including:
  • a probability distribution corresponding to each of the function hash values of at least one function hash value in the accessed file is queried in the function hash value probability distribution set.
  • an embodiment of the present invention provides a gateway device, including:
  • An obtaining module configured to obtain a function hash value of at least one function in the accessed file, where the accessed file is an executable program file;
  • a determining module configured to determine, by using a pre-trained classifier, a probability distribution respectively corresponding to each of the at least one function hash value, the probability distribution being used to indicate each of the functions The probability that the hash appears in the file of the black sample set, and the probability that each of the function hash values appears in the file of the white sample set, the black sample set including at least one malicious program file, the white sample set Including at least one normal program file;
  • a processing module configured to determine a reputation value of the accessed file according to a probability distribution corresponding to each function hash value obtained by the determining module.
  • the acquiring module includes:
  • An obtaining unit configured to acquire function start position information included in a header of the accessed file
  • An assembly unit configured to start from the start position of the function obtained by the obtaining unit, and disassemble the accessed file by using a ret instruction as a function end instruction to obtain the at least one function in the accessed file;
  • a calculating unit configured to calculate a function hash value of each of the at least one function obtained by the assembly unit by using a preset hash algorithm.
  • the determining module is specifically configured to:
  • the processing module includes:
  • a first determining unit configured to determine whether a probability hash of a probability distribution in the file of the black sample set that is higher than a first preset threshold is present in the accessed file
  • a second determining unit configured to determine whether the probability that the probability distribution occurs in the file of the black sample set is higher than a preset number of function hash values of the first preset threshold
  • a processing unit configured to determine the accessed file if there is a function hash value that exceeds a preset number and the probability distribution appears in a file of the black sample set is higher than a first preset threshold Has a reputation value lower than a second predetermined threshold.
  • an embodiment of the present invention provides a file reputation server, including:
  • An obtaining module configured to respectively acquire at least one function of at least one of a file of a black sample set and a file of a white sample set, the black sample set including at least one malicious program file, the white sample set including at least one normal program files;
  • a calculation module configured to respectively calculate a function hash value of each of at least one of the files of the black sample set and at least one of the files of the white sample set;
  • a training module configured to train the classifier with a function hash value of each function obtained by the calculation module, and collect a function hash value of each function at an output end of the classifier The number of occurrences in the file of the black sample set and the number of occurrences in the file of the white sample set;
  • a normalization module for a function hash value for each function the number of occurrences of the function hash value in the file of the black sample set and the number of occurrences in the file of the white sample set
  • a process is performed to obtain a probability distribution of function hash values of each function to form a set of function hash probability distributions.
  • the server further includes:
  • a receiving module configured to receive at least one function hash value sent by the gateway device, where the at least one The function hash value is obtained by the gateway device according to the accessed file, and the accessed file is an executable program file;
  • a determining module configured to determine, by the classifier obtained by the training, a probability distribution respectively corresponding to each function hash value of at least one function hash value in the accessed file;
  • a sending module configured to send, to the gateway device, a probability distribution corresponding to each function hash value of at least one function hash value in the accessed file.
  • the determining module is specifically configured to:
  • a probability distribution corresponding to each of the function hash values of at least one function hash value in the accessed file is queried in the function hash value probability distribution set.
  • the file reputation obtaining method, the gateway device, and the file reputation server provided by the embodiment of the present invention determine the function hash with each function after obtaining the function hash value of at least one function in the accessed file.
  • the probability distribution corresponding to the value thereby determining the reputation value of the accessed file based on the probability distribution.
  • the reputation value of the determined file is evaluated based on the probability distribution of the function hash value in the accessed file, with the function being the smallest unit, even if the probability distribution of a small number of function hash values in the accessed file cannot be determined by the trained classifier.
  • FIG. 1 is a flowchart of a method for acquiring a file reputation according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a method for acquiring a file reputation according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic structural diagram of a gateway device according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic structural diagram of a file reputation server according to Embodiment 4 of the present invention.
  • FIG. 5 is a schematic structural diagram of a gateway device according to Embodiment 5 of the present invention.
  • FIG. 6 is a schematic structural diagram of a file reputation server according to Embodiment 6 of the present invention.
  • FIG. 1 is a flowchart of a file reputation acquisition method according to Embodiment 1 of the present invention.
  • the file reputation acquisition method provided by this embodiment may be performed by a network device such as a gateway device, a GPRS, a base station, or the like. The example is explained.
  • the method for obtaining a file reputation provided by this embodiment includes:
  • Step 101 Acquire a function hash value of at least one function in the accessed file, where the accessed file is an executable program file.
  • the executable file that the user needs to access is composed of a set of functions. These functions are continuously distributed in the file. Each function is a piece of instruction data.
  • the program running process is to execute these function instructions. the process of.
  • an enterprise user uses an application such as sending and receiving e-mails and transmitting an FTP file through a gateway device as an example to describe a method for obtaining a reputation value of an accessed file accessed by the user.
  • the gateway device receives the request of the user terminal for the application service, thereby obtaining a program file to be accessed when the user performs the application service, that is, the embodiment.
  • the accessed file Since the accessed file is an executable program file, it consists of at least one function.
  • the gateway device decomposes the accessed file by disassembling the at least one function included in the accessed file, and further adopts, for example, Message-Digest Algorithm 5 (hereinafter referred to as MD5), and cyclic redundancy check. (Cyclical Redundancy Check, hereinafter referred to as CRC) and other hash functions obtained by the hash algorithm, the function hash value as an attribute of the corresponding function, uniquely identifies the corresponding function.
  • MD5 Message-Digest Algorithm 5
  • CRC Cyclical Redundancy Check
  • the gateway device may obtain a function hash value of at least one function in the accessed file in the following manner:
  • the ret instruction is used as a function end instruction to disassemble the accessed file to obtain at least one function in the accessed file;
  • a function hash value of each of the at least one function is separately calculated using a preset hash algorithm.
  • a widely used data transmission method currently transmits data in the form of a data stream.
  • data is transmitted in the form of a data stream, and the entire application file is Transmitted in the network in the form of packets.
  • the data packet containing the file header includes the program code part, that is, the starting position information of the function part, and Information such as the entire file size and each packet size, so that the gateway device determines the starting position of the function according to the function start position information, and starts from the starting position, and uses the ret instruction as a function end instruction to disassemble the accessed file.
  • Determine each function in the accessed file and calculate the function hash value of each function according to a preset hash algorithm, such as MD5, CRC, and the like.
  • a preset hash algorithm such as MD5, CRC, and the like.
  • Step 102 Determine, by using a classifier obtained by pre-training, a probability distribution respectively corresponding to each function hash value of the at least one function hash value, where the probability distribution is used to indicate the hash value of each function a probability of occurrence in a file of a black sample set, and a probability that each of the function hash values appears in a file of a white sample set, the black sample set including at least one malicious program file, the white sample set including at least a normal program file;
  • the gateway device may determine the probability distribution corresponding to each function hash value by using the classifier obtained by the pre-training. Specifically, the gateway device may interact with a file reputation server set on the network side to send the function hash value to the file reputation server, so that the file reputation server uses the classifier obtained by the pre-training to determine respectively a probability distribution corresponding to each function hash value of the at least one function hash value, and returning a probability distribution corresponding to each function hash value to the gateway device.
  • the probability distribution is used to indicate a probability that each of the function hash values appears in a file of the black sample set, and each of the functions A probability that a hash value appears in a file of a white sample set, the black sample set including at least one malicious program file, the white sample set including at least one normal program file.
  • the malicious program file refers especially to a virus file, and a function hash value appears in the file of the black sample set, which means that the function hash value exists in the function hash value of the function included in the malicious program file.
  • a function hash value appears in the file of the white sample set, which means that the function hash value exists in the function hash value of the function included in the normal program file.
  • the set of values In the set of values.
  • the gateway device can send each function hash value included in the accessed file to the file reputation server, so that the file reputation server utilizes the file reputation service.
  • the classifier obtained by the pre-training of the server determines the probability distribution corresponding to each function hash value respectively, and the classifier can also be locally trained by the gateway device, and then the classifier obtained by the training is used to determine each function and each function.
  • the probability distribution corresponding to the hash value is only to not increase the load of the gateway device, and preferably adopts the former method, that is, the file reputation server performs processing.
  • the file reputation server pre-constructs a black sample set and a white sample set for training the classifier to obtain the training result of the classifier, that is, the normal program of the malicious program file and the white sample set by the black sample set.
  • a set of function hash probability distributions consisting of probability distributions of the hash values of the functions contained in the file for determining the probability distribution of the hash values of each function contained in the accessed file.
  • a machine learning method such as Bayesian or Support Vector Machine can be used to train the classifier.
  • Step 103 Determine a reputation value of the accessed file according to a probability distribution corresponding to each function hash value.
  • the gateway device After determining the probability distribution corresponding to each function hash value in the accessed file respectively, the gateway device determines the reputation value of the accessed file according to the determined probability distributions. Specifically, the following manner can be adopted:
  • Determining that the accessed file has a lower value than the second if there is a function hash value that exceeds a preset number and the probability distribution appears in the file of the black sample set is higher than the first preset threshold The reputation value of the preset threshold.
  • the gateway device determines the probability distribution corresponding to each function hash value in the accessed file, the gateway device can statistically obtain the function distribution in the accessed file, that is, how many black sample sets exist in the accessed file. The function with higher probability appears in the file, and there are many functions with higher probability in the file of the white sample set. If there is a function with a higher probability in the file of the black sample set in the accessed file, the reputation value of the accessed file is lower, and a lower reputation value, such as reputation, may be evaluated for the accessed file. The value is 0.2.
  • the probability distribution corresponding to each function hash value is determined by the classifier obtained by the pre-training, thereby obtaining the probability distribution according to the probability distribution.
  • the reputation value of the determined file is evaluated based on the probability distribution of the function hash value in the accessed file, with the function being the smallest unit, even if the probability distribution of a small number of function hash values in the accessed file cannot be determined by the trained classifier.
  • the function is the minimum unit, which can ensure sufficient function sample space, even for a brand new accessed file, You can also get the probability distribution of its function hash value, so that further text The reliability of the credibility of the value obtained.
  • Embodiment 2 is a flowchart of a file reputation acquisition method according to Embodiment 2 of the present invention.
  • the method provided in this embodiment may be performed by a gateway device in Embodiment 1 or may be performed by a file reputation server set by a network side.
  • the gateway device queries the probability distribution of the desired function hash value according to the local function hash value probability distribution set.
  • it is possible to interact with multiple gateway devices to provide a probability distribution of the function hash values required by the gateway device. 2 is only performed by a file reputation server set by the network side as an example.
  • the method includes:
  • Step 201 Acquire at least one of at least one function in a file of a black sample set and a file of a white sample set, where the black sample set includes at least one malicious program file, and the white sample set includes at least one normal program file. ;
  • Step 202 Calculate a function hash value of each of at least one of the files of the black sample set and at least one of the files of the white sample set respectively;
  • Step 203 Train the classifier with the function hash value of each function, and collect, at the output of the classifier, the function hash value of each function in the black sample set respectively.
  • Step 204 A function hash value for each function, the function hash value in the black sample set The number of occurrences in the file and the number of occurrences in the file of the white sample set are normalized to obtain a probability distribution of the function hash value of each function, forming a function hash value probability distribution set;
  • the file reputation server before determining the reputation value of the accessed file, the file reputation server needs to train the classifier according to the black sample set and the white sample set collected in advance, and obtain the training result, so as to perform the accessed file reputation according to the training result. The value is determined.
  • the file reputation server first acquires at least one of at least one of the files of the black sample set and the file of the white sample set, the black sample set including at least one malicious program file, the white sample set including at least one A normal program file.
  • At least one function in the black sample set can be obtained by disassembling each malicious program file of the black sample set, and at least one function in the white sample set is obtained by disassembling each normal program file of the white sample set.
  • the manner in which the function is obtained from the malicious program file or the normal program file is similar to the manner in which the function is obtained from the accessed file in the first step 101 of the first embodiment, and will not be described again here.
  • a function hash value of each of at least one of the files of the black sample set and at least one of the files of the white sample set is separately calculated by using a preset hash algorithm.
  • the classifier is then trained with the function hash value of each function in the black sample set and the white sample set, and the function hash value of each function is counted at the output of the classifier respectively in the black sample The number of occurrences in the set of files and the number of occurrences in the file of the white sample set. Further, for the function hash value of each function, the function hash value appears in the file of the black sample set.
  • Step 205 Receive at least one function hash value sent by the gateway device, where the at least one function hash value is obtained by the gateway device according to the accessed file, where the accessed file is an executable program file.
  • Step 206 Using the classifier obtained by training, determining that each of the accessed files is a probability distribution corresponding to each function hash value in one function hash value;
  • Step 207 Send a probability distribution corresponding to each function hash value of at least one function hash value in the accessed file to the gateway device.
  • the file reputation server can use the trained classifier to query the probability distribution of each function hash value included in the accessed file. Specifically, the file reputation server receives at least one function hash value sent by the gateway device, the at least one function hash value is obtained by the gateway device according to the accessed file, and the accessed file is an executable program file. Further, querying a probability distribution corresponding to each function hash value of at least one function hash value in the accessed file in a function hash probability distribution set obtained by the classifier training, and each function is The probability distribution corresponding to the hash value is sent to the gateway device, so that the gateway device determines the reputation value of the accessed file according to the probability distribution.
  • the file reputation server separately trains the classifier according to the function hash value included in the files in the black and white sample sets, and obtains a function hash value probability distribution set to receive each of the accessed files. After the function hash value, the probability distribution of each function hash value in the accessed file is queried in the probability distribution set, so that the gateway device determines the reputation value of the accessed file according to the probability distribution.
  • the training sample of the classifier is the function hash value of the file in the black sample set and the white sample set.
  • the gateway device needs to be according to each of the accessed files received from the file reputation server.
  • the probability distribution of the function hash value is used to evaluate the reputation value of the accessed file, thereby effectively solving the problem that the file reputation value query fails due to the method of generating the feature value based on the file content in the prior art, and ensuring the reliability of the file reputation value acquisition. Sex.
  • FIG. 3 is a schematic structural diagram of a gateway device according to Embodiment 3 of the present invention. As shown in FIG. 3, the gateway device includes:
  • the obtaining module 11 is configured to obtain a function hash value of at least one function in the accessed file, where the accessed file is an executable program file;
  • a determining module 12 configured to determine, by using a pre-trained classifier, respectively, the at least one a probability distribution corresponding to each function hash value of the function hash values, the probability distribution is used to indicate a probability that each of the function hash values appears in a file of the black sample set, and each of the functions a probability that a hash value appears in a file of a white sample set, the black sample set including at least one malicious program file, the white sample set including at least one normal program file;
  • the processing module 13 is configured to determine a reputation value of the accessed file according to a probability distribution corresponding to each function hash value obtained by the determining module 12.
  • the obtaining module 11 includes:
  • the obtaining unit 111 is configured to acquire function start position information included in the accessed file header.
  • the assembly unit 112 is configured to start disassembling the accessed file with the ret instruction as a function end instruction to obtain the at least one of the accessed files, starting from the function starting position obtained by the acquiring unit 111. function;
  • the calculating unit 113 is configured to calculate a function hash value of each of the at least one function obtained by the assembly unit 112 by using a preset hash algorithm.
  • the determining module 12 is specifically configured to:
  • processing module 13 includes:
  • the first determining unit 131 is configured to determine whether a function hash value of the probability that the probability distribution is present in the file of the black sample set is higher than a first preset threshold.
  • the second determining unit 132 is configured to determine whether the probability that the probability distribution is higher in the file of the black sample set than the first preset threshold exceeds a preset number
  • the processing unit 133 is configured to determine, if there is a function hash value that exceeds a preset number and the probability distribution is higher in the file of the black sample set than the first preset threshold, The file has a reputation value that is lower than a second predetermined threshold.
  • the gateway device of this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 4 is a schematic structural diagram of a file reputation server according to Embodiment 4 of the present invention, as shown in FIG. 4 Show that the server includes:
  • An obtaining module 21 configured to respectively acquire at least one function of at least one of a file of a black sample set and a file of a white sample set, the black sample set including at least one malicious program file, the white sample set including at least one Normal program file;
  • a calculation module 22 configured to respectively calculate a function hash value of each of at least one of the files of the black sample set and at least one of the files of the white sample set;
  • the training module 23 is configured to train the classifier with the function hash value of each function obtained by the calculation module 22, and collect the function of each function at the output of the classifier.
  • server further includes:
  • the receiving module 25 is configured to receive at least one function hash value sent by the gateway device, where the at least one function hash value is obtained by the gateway device according to the accessed file, where the accessed file is an executable program file;
  • a determining module 26 configured to determine, by using the classifier obtained by the training, a probability distribution respectively corresponding to each function hash value of at least one function hash value in the accessed file;
  • the sending module 27 is configured to send, to the gateway device, a probability distribution corresponding to each function hash value of at least one function hash value in the accessed file.
  • the determining module 26 is specifically configured to:
  • a probability distribution corresponding to each of the function hash values of at least one function hash value in the accessed file is queried in the function hash value probability distribution set.
  • the file reputation server of this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 2, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 5 is a schematic structural diagram of a gateway device entity according to Embodiment 5 of the present invention. As shown in FIG. 5, the gateway device entity includes:
  • the processor 32 is configured to call the program code stored in the memory 31 to execute a function of acquiring at least one function in the accessed file in the file reputation obtaining method as shown in FIG.
  • the accessed file is an executable program file; using a classifier obtained by pre-training, determining a probability distribution respectively corresponding to each function hash value of the at least one function hash value, the probability a distribution for indicating a probability that each of the function hash values appears in a file of the black sample set, and a probability that each of the function hash values appears in a file of the white sample set, the black sample set including at least A malicious program file, the white sample set including at least one normal program file; determining a reputation value of the accessed file according to a probability distribution corresponding to each function hash value.
  • the processor 32 is configured to acquire function start position information included in the accessed file header; start from the function start position, and disassemble the accessed file by using a ret instruction as a function end instruction. And acquiring the at least one function in the accessed file; respectively calculating a function hash value of each of the at least one function by using a preset hash algorithm.
  • the gateway device entity further includes a transmitter 33 and a receiver 34, wherein the transmitter 33 is configured to send the at least one function hash value to a file reputation server, so that the file reputation server obtains by using pre-training a classifier that determines a probability distribution respectively corresponding to each of the at least one function hash value; the receiver 34 is configured to receive the function hash value corresponding to the function returned by the file reputation server Probability distribution.
  • the processor 32 is further configured to: determine, in the accessed file, whether there is a function hash value in which a probability distribution in the file of the black sample set is higher than a first preset threshold; Whether the probability distribution is higher in the file of the black sample set than the first preset threshold value, and the number of function hash values exceeds a preset number; if there is more than a preset number, and the probability distribution is in the If the probability of occurrence in the file of the black sample set is higher than the function hash value of the first preset threshold, it is determined that the accessed file has a reputation value lower than the second preset threshold.
  • the gateway device provided in the embodiment of the present invention is applied to the scenario described in the first embodiment and the second embodiment to implement the function of the gateway device.
  • the description of the gateway device in the first embodiment and the second embodiment is not described here.
  • FIG. 6 is a schematic structural diagram of a file reputation server entity according to Embodiment 6 of the present invention. As shown in FIG. 6, the file reputation server entity includes:
  • the file reputation obtaining method of 2 at least one of a function of at least one of a file of a black sample set and a file of a white sample set, the black sample set including at least one malicious program file, the white sample, respectively
  • the set includes at least one normal program file; respectively calculating a function hash value of each of at least one of the files of the black sample set and at least one of the files of the white sample set;
  • the function hash value of the function trains the classifier, and at the output of the classifier, counts the number of times the function hash value of each function appears in the file of the black sample set and The number of occurrences in the file of the white sample set; the function hash value for each function, the number of times the function hash value appears in the file of the black sample set and The number of occurrences in the file of the white sample set;
  • the file reputation server entity further includes a receiver 43 and a transmitter 44, wherein the receiver 43 is configured to receive at least one function hash value sent by the gateway device, and the at least one function hash value is the gateway The device is obtained according to the accessed file, and the accessed file is an executable program file;
  • the processor 42 is further configured to determine, by using the classifier obtained by the training, a probability distribution respectively corresponding to each function hash value of at least one function hash value in the accessed file;
  • the transmitter 44 is configured to send a probability distribution corresponding to each function hash value of at least one function hash value in the accessed file to the gateway device.
  • the processor 42 is further configured to query, in the function hash value probability distribution set, a probability distribution respectively corresponding to each function hash value of at least one function hash value in the accessed file.
  • the file reputation server provided in the embodiment of the present invention is applied to the scenario described in the second embodiment to implement the function of the file reputation server.
  • the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Power Engineering (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Virology (AREA)
  • Bioethics (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请实施例提供一种文件信誉获取方法、网关设备和文件信誉服务器，该方法包括：获取被访问文件中至少一个函数的函数哈希值；利用预先训练获得的分类器，确定分别与各函数哈希值对应的概率分布，该概率分布用于指示各函数哈希值在黑样本集的文件中出现的概率，以及各函数哈希值在白样本集的文件中出现的概率；根据各函数哈希值对应的概率分布，确定被访问文件的信誉值。基于被访问文件中的函数哈希值的概率分布来评估确定文件的信誉值，有效解决了现有技术中基于文件内容生成特征值的方式导致文件信誉值查询失败的问题。

Description

文件信誉获取方法、网关设备和文件信誉服务器
本申请要求于2014年3月18日提交中国专利局、申请号为201410101467.5、发明名称为“文件信誉获取方法、网关设备和文件信誉服务器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明属于计算机技术领域，具体是涉及一种文件信誉获取方法、网关设备和文件信誉服务器。
背景技术
随着计算机技术的快速发展，网络安全越来越受到人们的重视。当用户通过其终端进行诸如网页浏览等网络应用业务时，需要访问不同应用程序文件，而这些文件很有可能已经遭受了各种各样恶意病毒代码的攻击，从而造成用户终端感染病毒。
在诸如无线局域网(Wireless Local Area Networks，以下简称WLAN)、第二代移动通信技术(2rd-Generation，以下简称2G)、第三代移动通信技术(3rd-Generation，以下简称3G)等网络中，用户一般是通过网关设备、网关GPRS支持节点(Gateway GPRS Support Node，以下简称GGSN)、基站、增强型基站等网络设备接入网络，从而进行网络应用访问的。目前，网络设备在接收到用户对某应用程序文件的访问请求后，需获取该文件的信誉值，以基于该信誉值来确定是否允许用户访问等后续处理。在实际应用中，一般企业用户会额外地关心用户访问的文件的信誉值，比如会比较关心该用户发送的电子邮件，传输的FTP文件的信誉值是否满足一定要求，从而保证该用户所在企业的网络系统的安全可靠。目前，一种被广泛采用的文件信誉获取方式是，网关设备等网络设备根据当前被用户访问的文件(在本申请中后续简称为“被访问文件”)的全文或局部内容生成一特征值，从而根据生成的特征值，在该网关设备存储有已知的特征值与文件信誉值的对应关系的数据库中，查询该被访问文件的信誉值。
上述方式中，文件的特征值是根据文件的内容生成的，在新的应用业务不断出现或应用频繁更新升级的情况下，往往会出现文件信誉数据库中不存在被查询的文件的特征值对应的文件信誉值的现象，造成查询失败。
发明内容
本发明实施例提供一种文件信誉获取方法、网关设备和文件信誉服务器，用以缓解现有技术中基于文件内容生成特征值的方式存在的文件信誉值查询失败率高的问题。
第一方面，本发明实施例提供一种文件信誉获取方法，包括：
获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；
利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
根据第一方面，在第一方面的第一种可能的实现方式中，所述获取被访问文件中至少一个函数的函数哈希值，包括：
获取所述被访问文件头部中包含的函数起始位置信息；
自所述函数起始位置开始，以ret指令作为函数结束指令反汇编所述被访问文件，以获取所述被访问文件中的所述至少一个函数；
采用预设哈希算法，分别计算所述至少一个函数中的每个函数的函数哈希值。
根据第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，包括：
将所述至少一个函数哈希值发送到文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中 的每个函数哈希值对应的概率分布；
相应地，所述根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值之前，还包括：
接收所述文件信誉服务器返回的所述每个函数哈希值对应的概率分布。
根据第一方面或第一方面的第一种可能的实现方式，在第一方面的第三种可能的实现方式中，所述根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值，包括：
判断所述被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；
判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；
若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
第二方面，本发明实施例提供一种文件信誉获取方法，包括：
分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；
以所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；
针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。
根据第二方面，在第二方面的第一种可能的实现方式中，所述获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合之后，还包括：
接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是 所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布；
将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
根据第二方面的第一种可能的实现方式中，在第二方面的第二种可能的实现方式中，所述利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布，包括：
在所述函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布。
第三方面，本发明实施例提供一种网关设备，包括：
获取模块，用于获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；
确定模块，用于利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
处理模块，用于根据所述确定模块得到的所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
根据第三方面，在第三方面的第一种可能的实现方式中，所述获取模块，包括：
获取单元，用于获取所述被访问文件头部中包含的函数起始位置信息；
汇编单元，用于自所述获取单元得到的所述函数起始位置开始，以ret指令作为函数结束指令反汇编所述被访问文件，以获取所述被访问文件中的所述至少一个函数；
计算单元，用于采用预设哈希算法，分别计算所述汇编单元得到的所述至少一个函数中的每个函数的函数哈希值。
根据第三方面或第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，所述确定模块，具体用于：
将所述至少一个函数哈希值发送到文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布；
接收所述文件信誉服务器返回的所述每个函数哈希值对应的概率分布。
根据第三方面或第三方面的第一种可能的实现方式，在第三方面的第三种可能的实现方式中，所述处理模块，包括：
第一判断单元，用于判断所述被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；
第二判断单元，用于判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；
处理单元，用于若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
第四方面，本发明实施例提供一种文件信誉服务器，包括：
获取模块，用于分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
计算模块，用于分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；
训练模块，用于以所述计算模块得到的所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；
归一化模块，用于针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。
根据第四方面，在第四方面的第一种可能的实现方式中，所述服务器还包括：
接收模块，用于接收网关设备发送的至少一个函数哈希值，所述至少一 个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
确定模块，用于利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布；
发送模块，用于将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
根据第四方面的第一种可能的实现方式中，在第四方面的第二种可能的实现方式中，所述确定模块，具体用于：
在所述函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布。
本发明实施例提供的文件信誉获取方法、网关设备和文件信誉服务器，在获取被访问文件中的至少一个函数的函数哈希值之后，通过预先训练获得的分类器来确定与每个函数哈希值对应的概率分布，从而根据概率分布来确定被访问文件的信誉值。基于被访问文件中的函数哈希值的概率分布来评估确定文件的信誉值，以函数为最小单位，即使被访问文件中存在少量函数哈希值的概率分布不能通过训练获得的分类器确定的情况，仍可以根据被访问文件中的其他函数的函数哈希值来评估确定被访问文件的信誉值，减少了被访问文件的信誉值无法确定的情况的发生，相对于现有技术中基于文件内容生成特征值的方式，提高了确定文件信誉值时的成功率。
附图说明
图1为本发明实施例一提供的文件信誉获取方法的流程图；
图2为本发明实施例二提供的文件信誉获取方法的流程图；
图3为本发明实施例三提供的网关设备的结构示意图；
图4为本发明实施例四提供的文件信誉服务器的结构示意图；
图5为本发明实施例五提供的网关设备的结构示意图；
图6为本发明实施例六提供的文件信誉服务器的结构示意图。
具体实施方式
图1为本发明实施例一提供的文件信誉获取方法的流程图，本实施例提供的文件信誉获取方法可以由诸如网关设备、GPRS、基站等网络设备来执行，本实施例仅以网关设备为例进行说明。如图1所示，本实施例提供的文件信誉获取方法，具体包括：
步骤101、获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；
在实际应用中，用户使用一些应用需要访问的可执行程序文件，都是由一组函数组成的，这些函数在文件中连续分布，每个函数是一段指令数据，程序运行过程就是执行这些函数指令的过程。
本实施例中，以企业用户通过网关设备进行收发电子邮件、传输FTP文件等应用为例来说明对该用户访问的被访问文件的信誉值的获取方法。当用户在其用户终端上触发诸如收发电子邮件等应用业务时，网关设备会接收到该用户终端对该应用业务的请求，从而获得用户进行该应用业务时要访问的程序文件，即本实施例所述的被访问文件。由于该被访问文件为一个可执行的程序文件，它由至少一个函数组成。因此，网关设备通过反汇编该被访问文件，以对该被访问文件中包含的至少一个函数进行分界，进而采用比如信息摘要算法5(Message-Digest Algorithm5，以下简称MD5)，循环冗余校验(Cyclical Redundancy Check，以下简称CRC)等哈希算法计算获得的每个函数的哈希值，函数哈希值作为对应函数的一种属性，唯一标识了对应的函数。
具体地，本实施例中网关设备可以采用如下方式来获取被访问文件中至少一个函数的函数哈希值：
获取被访问文件头部中包含的函数起始位置信息；
自该函数起始位置开始，以ret指令作为函数结束指令反汇编被访问文件，以获取被访问文件中的至少一个函数；
采用预设哈希算法，分别计算该至少一个函数中的每个函数的函数哈希值。
另外，目前一种广泛使用的数据传输方式是以数据流的形式来传输数据，在比如视频观看等应用业务中，数据是以数据流的形式在网络中传输的，此时整个应用程序文件是以一个个数据包的形式在网络中传输的。
在上述应用场景下，如果用户要访问的文件是一个以数据流的方式进行 传输的文件，此时由于被访问文件是由一个个数据包组成并在网络中传输的，一般在包含文件头部的数据包中会包含有程序代码部分即函数部分的起始位置信息，以及整个文件大小和每个数据包大小等信息，以使网关设备根据函数起始位置信息确定函数的起始位置，并从该起始位置开始，以ret指令作为函数结束指令反汇编被访问文件，以确定被访问文件中的各个函数，并根据预设的哈希算法，比如MD5，CRC等算法分别计算各个函数的函数哈希值。在此过程中，由于文件是以数据包为单位进行传输的，故而网关设备需逐一数据包进行上述处理，直至所有数据包处理完毕，获得整个文件中包含的所有函数的函数哈希值。
步骤102、利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
本实施例中，网关设备在获得被访问文件中的每个函数哈希值之后，可以利用预先训练获得的分类器，确定分别与每个函数哈希值对应的概率分布。具体地，网关设备可以与网络侧设置的文件信誉服务器交互，以将所述每个函数哈希值发送给文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，并返回所述每个函数哈希值对应的概率分布给网关设备。
本实施例中所述的与每个函数哈希值对应的概率分布，该概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件。其中，该恶意程序文件尤其是指病毒文件，而某个函数哈希值在黑样本集的文件中出现，是指该函数哈希值存在于由该恶意程序文件包含的函数的函数哈希值组成的哈希值集合中，相应的，某个函数哈希值在白样本集的文件中出现，是指该函数哈希值存在于由正常程序文件包含的函数的函数哈希值组成的哈希值集合中。
可以理解的是，本实施例中网关设备既可以将被访问文件中包含的每个函数哈希值发送给文件信誉服务器，以使文件信誉服务器利用该文件信誉服 务器预先训练获得的分类器，查询确定分别与每个函数哈希值对应的概率分布，也可以由该网关设备预先本地训练分类器，进而利用训练获得的分类器确定分别与每个函数哈希值对应的概率分布，只是为了不增加网关设备的负载，优选地采用前一种方式，即交由文件信誉服务器进行处理。
因此，文件信誉服务器预先构造一个黑样本集和一个白样本集，用于对分类器进行训练，从而得到分类器的训练结果，即由黑样本集的恶意程序文件中和白样本集的正常程序文件中包含的各函数哈希值的概率分布组成的函数哈希值概率分布集合，以用于对被访问文件中包含的每个函数哈希值的概率分布的确定。本实施例中，可以采用比如贝叶斯、支持向量机等机器学习方法来训练分类器。
步骤103、根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
网关设备在确定分别与被访问文件中的每个函数哈希值对应的概率分布之后，根据确定的各概率分布，来确定该被访问文件的信誉值。具体地，可以采用如下的方式：
判断被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；
判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；
若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
本实施例中，可以假设黑样本集中的恶意程序文件具有很低的信誉值，比如信誉值为0，而白样本集中的正常程序文件具有很高的信誉值，比如信誉值为1。网关设备在确定分别与被访问文件中的每个函数哈希值对应的概率分布之后，网关设备可以统计获得该被访问文件中的函数分布情况，即该被访问文件中存在多少在黑样本集的文件中出现概率较高的函数，存在多少在白样本集的文件中出现概率较高的函数。如果该被访问文件中存在较多在黑样本集的文件中出现概率较高的函数，说明该被访问文件的信誉值较低，可以评估赋予该被访问文件一个较低的信誉值，比如信誉值为0.2。
本实施例中，在获取被访问文件中的至少一个函数的函数哈希值之后，通过预先训练获得的分类器来确定与每个函数哈希值一一对应的概率分布，从而根据概率分布来确定被访问文件的信誉值。基于被访问文件中的函数哈希值的概率分布来评估确定文件的信誉值，以函数为最小单位，即使被访问文件中存在少量函数哈希值的概率分布不能通过训练获得的分类器确定的情况，仍可以根据被访问文件中的其他函数的函数哈希值来评估确定它的信誉值，不会导致被访问文件的信誉值无法确定的情况的发生，从而有效解决了现有技术中基于文件内容生成特征值的方式导致文件信誉值查询失败的问题；而且，仅需查询获得被访问文件中至少一个函数哈希值的概率分布，进而基于该概率分布来评估确定被访问文件的信誉值，相对于直接查询获得文件信誉值的方式来说，有利于降低对样本数量的过分依赖；另外，以函数为最小单位，能够保证获得充足的函数样本空间，即使对一个全新的被访问文件，也可以获得其函数哈希值的概率分布，从而进一步文件信誉值获取的可靠性。
图2为本发明实施例二提供的文件信誉获取方法的流程图，本实施例提供的所述方法可以由实施例一中的网关设备执行，也可以由网络侧设置的文件信誉服务器来执行。在由网关设备执行的情况下，网关设备根据本地函数哈希值概率分布集合，查询得到所需的函数哈希值的概率分布。在由文件信誉服务器执行的情况下，可以与多个网关设备交互，提供网关设备所需的函数哈希值的概率分布。附图2仅以由网络侧设置的文件信誉服务器来执行为例，进行说明，如图2所示，该方法包括：
步骤201、分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
步骤202、分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；
步骤203、以所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；
步骤204、针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集 的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合；
本实施例中，文件信誉服务器在确定被访问文件的信誉值之前，需要根据预先收集的黑样本集和白样本集对分类器进行训练，得到训练结果，以根据该训练结果进行被访问文件信誉值的确定。
具体地，文件信誉服务器首先分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件。可以通过反汇编黑样本集的各恶意程序文件获得黑样本集中的至少一个函数，并通过反汇编白样本集的各正常程序文件获得白样本集中的至少一个函数。从恶意程序文件或正常程序文件中获得函数的方式与实施例一步骤101中从被访问文件中获得函数的方式类似，在这里不再赘述。
进而，采用预设的哈希算法，分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值。之后以黑样本集和白样本集中的每个函数的函数哈希值为输入对分类器进行训练，并在分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数，进而，针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。举例来说，比如某个函数哈希值在黑样本集的恶意程序文件中出现了100次，而在白样本集的正常程序文件中出现了400次，那么归一化处理之后，该函数哈希值在黑样本集的文件中出现的概率为100/(100+400)＝20％，在白样本集的文件中出现的概率为400/(100+400)＝80％，以此类推，得到黑样本集的文件中和白样本集的文件中包含的所述每个函数哈希值的概率分布。
步骤205、接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
步骤206、利用训练获得的所述分类器，确定分别与所述被访问文件中至 少一个函数哈希值中的每个函数哈希值对应的概率分布；
步骤207、将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
文件信誉服务器在对分类器进行训练之后，可以利用该训练后的分类器来查询确定被访问文件中包含的每个函数哈希值的概率分布。具体地，文件信誉服务器接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件。进而，在分类器训练获得的函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布，并将每个函数哈希值对应的概率分布发送给所述网关设备，以使网关设备根据该概率分布来确定被访问文件的信誉值。
本实施例中，文件信誉服务器预先分别根据黑、白样本集中的文件中包含的函数哈希值对分类器进行训练，得到函数哈希值概率分布集合，以在接收到被访问文件中的每个函数哈希值后，在该概率分布集合中查询确定被访问文件中每个函数哈希值的概率分布，以使网关设备根据该概率分布来确定被访问文件的信誉值。分类器的训练样本为黑样本集和白样本集中的文件的函数哈希值，由于可执行程序文件是由一个个函数构成的，而且不同的可执行程序文件间有很多相同的函数，与现有技术中由于不同文件的特征值均不同，且基于文件内容生成特征值的方式相比，可以有效减少对样本文件数量和实时性的依赖；并且，文件信誉服务器中保存的是函数哈希值与概率分布的对应关系的函数哈希值概率分布集合，与现有技术中直接查询获得文件信誉值的方式不同，本实施例中网关设备需根据从文件信誉服务器接收的被访问文件中每个函数哈希值的概率分布来评估确定被访问文件的信誉值，从而有效解决了现有技术中基于文件内容生成特征值的方式导致文件信誉值查询失败的问题，保证了文件信誉值获取的可靠性。
图3为本发明实施例三提供的网关设备的结构示意图，如图3所示，该网关设备包括：
获取模块11，用于获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；
确定模块12，用于利用预先训练获得的分类器，确定分别与所述至少一 个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
处理模块13，用于根据所述确定模块12得到的所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
进一步地，所述获取模块11，包括：
获取单元111，用于获取所述被访问文件头部中包含的函数起始位置信息；
汇编单元112，用于自所述获取单元111得到的所述函数起始位置开始，以ret指令作为函数结束指令反汇编所述被访问文件，以获取所述被访问文件中的所述至少一个函数；
计算单元113，用于采用预设哈希算法，分别计算所述汇编单元112得到的所述至少一个函数中的每个函数的函数哈希值。
具体地，所述确定模块12，具体用于：
将所述至少一个函数哈希值发送到文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布；
接收所述文件信誉服务器返回的所述每个函数哈希值对应的概率分布。
进一步地，所述处理模块13，包括：
第一判断单元131，用于判断所述被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；
第二判断单元132，用于判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；
处理单元133，用于若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
本实施例的网关设备可以用于执行图1所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图4为本发明实施例四提供的文件信誉服务器的结构示意图，如图4所 示，该服务器包括：
获取模块21，用于分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
计算模块22，用于分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；
训练模块23，用于以所述计算模块22得到的所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；
归一化模块24，用于针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。
进一步地，所述服务器还包括：
接收模块25，用于接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
确定模块26，用于利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布；
发送模块27，用于将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
具体地，所述确定模块26，具体用于：
在所述函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布。
本实施例的文件信誉服务器可以用于执行图2所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图5为本发明实施例五提供的网关设备实体的结构示意图，如图5所示，该网关设备实体包括：
存储器31以及与所述存储器31连接的处理器32，其中，所述存储器31 用于存储一组程序代码，所述处理器32用于调用所述存储器31中存储的程序代码，以执行如图1所示文件信誉获取方法中的：获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
具体地，所述处理器32用于获取所述被访问文件头部中包含的函数起始位置信息；自所述函数起始位置开始，以ret指令作为函数结束指令反汇编所述被访问文件，以获取所述被访问文件中的所述至少一个函数；采用预设哈希算法，分别计算所述至少一个函数中的每个函数的函数哈希值。
进一步地，该网关设备实体还包括发射器33和接收器34，其中，发射器33用于将所述至少一个函数哈希值发送到文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布；接收器34用于接收所述文件信誉服务器返回的所述每个函数哈希值对应的概率分布。
进一步地，所述处理器32，还用于判断所述被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
本装置实施例中提供的网关设备，应用于方法实施例一、实施例二所描述的场景中，实现其中网关设备的功能。该网关设备可以实现的其他附加功能、以及与其他网元设备的交互过程，请参照方法实施例一、实施例二中对网关设备的描述，在这里不再赘述。
图6为本发明实施例六提供的文件信誉服务器实体的结构示意图，如图6所示，该文件信誉服务器实体包括：
存储器41以及与所述存储器41连接的处理器42，其中，所述存储器41用于存储一组程序代码，所述处理器42用于调用所述存储器41中存储的程序代码，以执行如图2所示文件信誉获取方法中的：分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；以所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。
进一步地，所述文件信誉服务器实体还包括接收器43和发射器44，其中，接收器43用于接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
相应的，所述处理器42还用于利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布；
所述发射器44用于将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
进一步地，所述处理器42还用于在所述函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布。
本装置实施例中提供的文件信誉服务器，应用于实施例二所描述的场景中，实现其中文件信誉服务器的功能。该网关设备可以实现的其他附加功能、以及与其他网元设备的交互过程，请参照方法实施例二中对文件信誉服务器的描述，在这里不再赘述。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读 取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (14)

  1. 一种文件信誉获取方法，其特征在于，包括：
    获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；
    利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
    根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
  2. 根据权利要求1所述的方法，其特征在于，所述获取被访问文件中至少一个函数的函数哈希值，包括：
    获取所述被访问文件头部中包含的函数起始位置信息；
    自所述函数起始位置开始，以ret指令作为函数结束指令反汇编所述被访问文件，以获取所述被访问文件中的所述至少一个函数；
    采用预设哈希算法，分别计算所述至少一个函数中的每个函数的函数哈希值。
  3. 根据权利要求1或2所述的方法，其特征在于，所述利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，包括：
    将所述至少一个函数哈希值发送到文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布；
    相应地，所述根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值之前，还包括：
    接收所述文件信誉服务器返回的所述每个函数哈希值对应的概率分布。
  4. 根据权利要求1或2所述的方法，其特征在于，所述根据所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值，包括：
    判断所述被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；
    判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；
    若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
  5. 一种文件信誉获取方法，其特征在于，包括：
    分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
    分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；
    以所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；
    针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。
  6. 根据权利要求5所述的方法，其特征在于，所述获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合之后，还包括：
    接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
    利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函 数哈希值中的每个函数哈希值对应的概率分布；
    将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
  7. 根据权利要求6所述的方法，其特征在于，所述利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布，包括：
    在所述函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布。
  8. 一种网关设备，其特征在于，包括：
    获取模块，用于获取被访问文件中至少一个函数的函数哈希值，所述被访问文件为可执行程序文件；
    确定模块，用于利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布，所述概率分布用于指示所述每个函数哈希值在黑样本集的文件中出现的概率，以及所述每个函数哈希值在白样本集的文件中出现的概率，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
    处理模块，用于根据所述确定模块得到的所述每个函数哈希值对应的概率分布，确定所述被访问文件的信誉值。
  9. 根据权利要求8所述的设备，其特征在于，所述获取模块，包括：
    获取单元，用于获取所述被访问文件头部中包含的函数起始位置信息；
    汇编单元，用于自所述获取单元得到的所述函数起始位置开始，以ret指令作为函数结束指令反汇编所述被访问文件，以获取所述被访问文件中的所述至少一个函数；
    计算单元，用于采用预设哈希算法，分别计算所述汇编单元得到的所述至少一个函数中的每个函数的函数哈希值。
  10. 根据权利要求8或9所述的设备，其特征在于，所述确定模块，具体用于：
    将所述至少一个函数哈希值发送到文件信誉服务器，以使所述文件信誉服务器利用预先训练获得的分类器，确定分别与所述至少一个函数哈希值中的每个函数哈希值对应的概率分布；
    接收所述文件信誉服务器返回的所述每个函数哈希值对应的概率分布。
  11. 根据权利要求8或9所述的设备，其特征在于，所述处理模块，包括：
    第一判断单元，用于判断所述被访问文件中是否存在概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值；
    第二判断单元，用于判断所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值的数量是否超过预设数量；
    处理单元，用于若存在超过预设数量的、且所述概率分布在所述黑样本集的文件中出现的概率高于第一预设阈值的函数哈希值，则确定所述被访问文件具有低于第二预设阈值的信誉值。
  12. 一种文件信誉服务器，其特征在于，包括：
    获取模块，用于分别获取黑样本集的文件中的至少一个函数和白样本集的文件中的至少一个函数，所述黑样本集包括至少一个恶意程序文件，所述白样本集包括至少一个正常程序文件；
    计算模块，用于分别计算所述黑样本集的文件中的至少一个函数和所述白样本集的文件中的至少一个函数中的每个函数的函数哈希值；
    训练模块，用于以所述计算模块得到的所述每个函数的函数哈希值为输入对分类器进行训练，并在所述分类器的输出端统计所述每个函数的函数哈希值分别在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数；
    归一化模块，用于针对每个函数的函数哈希值，对该函数哈希值在所述黑样本集的文件中出现的次数和在所述白样本集的文件中出现的次数进行归一化处理，以获得所述每个函数的函数哈希值的概率分布，形成函数哈希值概率分布集合。
  13. 根据权利要求12所述的服务器，其特征在于，还包括：
    接收模块，用于接收网关设备发送的至少一个函数哈希值，所述至少一个函数哈希值是所述网关设备根据被访问文件获取到的，所述被访问文件为可执行程序文件；
    确定模块，用于利用训练获得的所述分类器，确定分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布；
    发送模块，用于将所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布发送给所述网关设备。
  14. 根据权利要求13所述的服务器，其特征在于，所述确定模块，具体用于：
    在所述函数哈希值概率分布集合中查询分别与所述被访问文件中至少一个函数哈希值中的每个函数哈希值对应的概率分布。
PCT/CN2015/073878 2014-03-18 2015-03-09 文件信誉获取方法、网关设备和文件信誉服务器 WO2015139569A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP15764199.4A EP3109789B1 (en) 2014-03-18 2015-03-09 Method and gateway device for obtaining file reputation and file reputation server
US15/264,719 US10355866B2 (en) 2014-03-18 2016-09-14 File reputation acquiring method, gateway device, and file reputation server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410101467.5 2014-03-18
CN201410101467.5A CN104933059B (zh) 2014-03-18 2014-03-18 文件信誉获取方法、网关设备和文件信誉服务器

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/264,719 Continuation US10355866B2 (en) 2014-03-18 2016-09-14 File reputation acquiring method, gateway device, and file reputation server

Publications (1)

Publication Number Publication Date
WO2015139569A1 true WO2015139569A1 (zh) 2015-09-24

Family

ID=54120227

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/073878 WO2015139569A1 (zh) 2014-03-18 2015-03-09 文件信誉获取方法、网关设备和文件信誉服务器

Country Status (4)

Country Link
US (1) US10355866B2 (zh)
EP (1) EP3109789B1 (zh)
CN (1) CN104933059B (zh)
WO (1) WO2015139569A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106778241B (zh) * 2016-11-28 2020-12-25 东软集团股份有限公司 恶意文件的识别方法及装置
CN108399477B (zh) * 2017-02-07 2021-03-05 创新先进技术有限公司 一种风险阈值确定的方法及装置
US10089467B1 (en) * 2017-05-23 2018-10-02 Malwarebytes Inc. Static anomaly-based detection of malware files
CN114127718A (zh) * 2019-05-24 2022-03-01 赛诺菲 确定公差区间极限的方法、评估生产过程的方法和相应的计算装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101576947A (zh) * 2009-06-05 2009-11-11 成都市华为赛门铁克科技有限公司 文件防护处理方法、装置及系统
CN102822839A (zh) * 2009-12-31 2012-12-12 迈克菲股份有限公司 经由信誉系统的恶意软件检测

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7487544B2 (en) * 2001-07-30 2009-02-03 The Trustees Of Columbia University In The City Of New York System and methods for detection of new malicious executables
US7660865B2 (en) * 2004-08-12 2010-02-09 Microsoft Corporation Spam filtering with probabilistic secure hashes
US8621625B1 (en) * 2008-12-23 2013-12-31 Symantec Corporation Methods and systems for detecting infected files

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101576947A (zh) * 2009-06-05 2009-11-11 成都市华为赛门铁克科技有限公司 文件防护处理方法、装置及系统
CN102822839A (zh) * 2009-12-31 2012-12-12 迈克菲股份有限公司 经由信誉系统的恶意软件检测

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3109789A4 *

Also Published As

Publication number Publication date
EP3109789B1 (en) 2018-03-07
US10355866B2 (en) 2019-07-16
EP3109789A4 (en) 2016-12-28
CN104933059B (zh) 2019-02-01
EP3109789A1 (en) 2016-12-28
CN104933059A (zh) 2015-09-23
US20170005801A1 (en) 2017-01-05

Similar Documents

Publication Publication Date Title
US10789322B2 (en) Short link processing to improve service efficiency
KR20220079958A (ko) 블록체인 메시지 처리 방법 및 장치, 컴퓨터 및 판독 가능한 저장 매체
US11431662B2 (en) Techniques for message deduplication
WO2015139569A1 (zh) 文件信誉获取方法、网关设备和文件信誉服务器
US9961157B2 (en) Adaptive compression management for web services
US8719332B2 (en) Method and system for content categorization
WO2016195847A1 (en) Method for enforcing endpoint health standards
WO2020057388A1 (zh) 一种智能合约管理方法、系统、设备及计算机存储介质
US10608960B2 (en) Techniques for batched bulk processing
US11461276B2 (en) Method and device for deduplication
US10834113B2 (en) Compact logging of network traffic events
CN103810268B (zh) 加载搜索结果推荐信息、网址检测的方法、装置和系统
CN107360122B (zh) 防止恶意请求的方法和装置
CN107248995B (zh) 账号验证方法及装置
US20190207888A1 (en) Techniques for message indexing
CN103793508B (zh) 一种加载推荐信息、网址检测的方法、装置和系统
WO2019195690A1 (en) Mechanisms for service layer resource ranking and enhanced resource discovery
JP2017529587A (ja) コンバージョンに対する様々なユーザ・インタラクションの貢献度の決定
US20150312183A1 (en) Variable image acquisition and processing techniques based on image data type
WO2017088294A1 (zh) 用于建立无线连接的方法与设备
US20160037509A1 (en) Techniques to reduce bandwidth usage through multiplexing and compression
CN109446052B (zh) 一种应用程序的校验方法及设备
US10860804B2 (en) Quick text classification model
CA3197673A1 (en) System and method for machine learning based malware detection
US10250515B2 (en) Method and device for forwarding data messages

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15764199

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015764199

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015764199

Country of ref document: EP