WO2018095099A1 - 一种可疑样本的处理方法和装置 - Google Patents

一种可疑样本的处理方法和装置 Download PDF

Info

Publication number
WO2018095099A1
WO2018095099A1 PCT/CN2017/099910 CN2017099910W WO2018095099A1 WO 2018095099 A1 WO2018095099 A1 WO 2018095099A1 CN 2017099910 W CN2017099910 W CN 2017099910W WO 2018095099 A1 WO2018095099 A1 WO 2018095099A1
Authority
WO
WIPO (PCT)
Prior art keywords
suspicious
sample
samples
feature information
suspicious sample
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/099910
Other languages
English (en)
French (fr)
Inventor
郑文彬
丁卯胤
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Qihoo Technology Co Ltd
Original Assignee
Beijing Qihoo Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Qihoo Technology Co Ltd filed Critical Beijing Qihoo Technology Co Ltd
Publication of WO2018095099A1 publication Critical patent/WO2018095099A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a method and an apparatus for processing a suspicious sample.
  • the present invention has been made in order to provide a processing method and apparatus for suspicious samples that overcome the above problems or at least partially solve the above problems.
  • a method for processing a suspicious sample comprising: receiving a suspicious sample data stream from a data source; the suspicious sample data stream includes a plurality of suspicious samples; and delivering the received suspicious sample to the sand Running in the box, obtaining the running log corresponding to the suspicious sample; analyzing the running log corresponding to the suspicious sample, obtaining the feature information related to the suspicious sample; determining whether the suspicious sample is a threat sample according to the feature information related to the suspect sample and the preset rule; The feature information related to the suspicious sample determined to be a threat sample is placed in the threat database.
  • a processing apparatus for a suspect sample comprising: a sample receiving unit adapted to receive a suspicious sample data stream from a data source; the suspect sample data stream includes a plurality of suspicious samples; The unit is adapted to send the received suspicious sample to the sandbox for running, and obtain an operation log corresponding to the suspicious sample; the result analyzing unit is adapted to analyze the running log corresponding to the suspicious sample, and obtain characteristic information related to the suspicious sample; The feature information related to the suspicious sample and the preset rule determine whether the suspicious sample is a threat sample; the sample handling unit is adapted to put feature information related to the suspicious sample determined as the threat sample into the threat database.
  • a computer program comprising computer readable code
  • the computer readable code when run on a computing device, causes the computing device to perform a processing method according to the suspicious samples described above.
  • a computer readable medium storing a computer program as described above is provided.
  • the technical solution according to the present invention delivers the suspicious sample received from the data source to the sandbox, and runs the log to record the running process of the suspicious sample in the sandbox, and runs the suspicious sample in the sandbox.
  • the analysis of the process can obtain the characteristic information related to the suspicious sample, and then can clearly determine whether the suspect sample is a threatened threat sample, and put all relevant feature information of the threat sample into the threat database as a supplement and update of the known threat data.
  • An ecological environment-based threat data monitoring center with positive feedback has been formed, which has the following beneficial effects: collecting a large number of suspicious samples from the data source to ensure the source of the data samples is stable; running the suspicious sample with the sandbox as a virtual carrier, clearly Record all running trajectories of suspicious samples, according to which trajectory can obtain more comprehensive information about suspicious samples; when determining a suspicious sample as a threat sample, use the comprehensive feature information related to the suspicious sample obtained from each analysis Constantly looping iteratively to supplement updates Threaten existing database features information about the suspicious sample; and the number of threat data in the database, data type, data accuracy to accumulate, to provide increasingly strong support for follow-up based on database information security threats carried out.
  • FIG. 1 shows a flow chart of a method of processing a suspicious sample in accordance with one embodiment of the present invention
  • FIG. 2 is a block diagram showing a method of processing a suspicious sample in accordance with one embodiment of the present invention
  • FIG. 3 is a data flow diagram showing a method of processing a suspect sample according to an embodiment of the present invention
  • FIG. 4 shows a schematic diagram of a processing device for a suspect sample according to an embodiment of the present invention
  • Figure 5 shows schematically a block diagram of a computing device for performing the method according to the invention
  • Figure 6 shows schematically the storage of program code for maintaining or carrying a method according to the invention. Storage unit.
  • FIG. 1 shows a flow chart of a method of processing a suspicious sample in accordance with one embodiment of the present invention. As shown in Figure 1, the method includes:
  • Step S110 Receive a suspicious sample data stream from a data source; the suspect sample data stream includes a plurality of suspicious samples.
  • step S120 the received suspicious sample is sent to the sandbox to run, and the running log corresponding to the suspicious sample is obtained.
  • Step S130 analyzing an operation log corresponding to the suspicious sample, and obtaining feature information related to the suspicious sample.
  • Step S140 Determine whether the suspicious sample is a threat sample according to the feature information related to the suspicious sample and the preset rule.
  • step S150 the feature information related to the suspicious sample determined as the threat sample is placed in the threat database.
  • the method shown in FIG. 1 administers suspicious samples received from the data source to the sandbox, and runs the log to record the running process of the suspicious samples in the sandbox, by running the suspicious samples in the sandbox.
  • the analysis can obtain the characteristic information related to the suspicious sample, and then can clearly determine whether the suspicious sample is a threatened threat sample, and put all relevant feature information of the threat sample into the threat database as a supplement and update of the known threat data.
  • An ecological environment-based threat data monitoring center with positive feedback has the following beneficial effects: collecting a large number of suspicious samples from the data source to ensure the source of the data samples is stable; running a suspicious sample with the sandbox as a virtual carrier, clearly recording the suspicious According to the running trajectory, the trajectory related to the suspicious sample can be obtained more comprehensively; when a suspicious sample is determined as the threat sample, the comprehensive characteristic information related to the suspicious sample obtained by each analysis is continuously circulated Iteratively supplements the update threat database Some characteristic information of the suspicious sample; and the amount of data in the threat database, the type of data, and the accuracy of the data are continuously accumulated, which provides an increasingly powerful support for the subsequent information security protection according to the threat database.
  • the characteristic information related to the suspicious sample obtained by analyzing the running log corresponding to the suspicious sample includes: Static feature information of the suspect sample, and/or behavioral feature information of the suspect sample. That is to say, for each suspicious sample that is placed in the sandbox, whether it is the static feature of the suspect sample or the dynamic behavior of the suspect sample during the operation, it can be deconstructed. It is observed that the complete file of a suspicious sample is grasped, and whether the suspect sample is a threatened threat sample, and if the threat sample is prevented, the suspected sample can be found accurately. answer.
  • the files of the suspicious samples that are in control are constantly being improved, that is, the data in the threat database is continuously improved.
  • the step S150 in the step S150, the feature information related to the suspicious sample determined as the threat sample is placed in the threat database, and the feature information related to the suspicious sample determined as the threat sample is used in the threat database. The data is updated.
  • the data source may be a client distributed on different terminals of the solution, and the client performs a dot recording on the suspicious sample, and the suspicious sample received by the solution may be uploaded by each client.
  • the data source may also be a third-party security detection platform that cooperates with the solution.
  • the suspicious sample received by the solution may be a suspicious sample uploaded by the third-party security detection platform;
  • the data source may also be other products.
  • the client or the hot patch deployed on the client of other products, the suspicious sample received by the solution may be a suspicious sample uploaded by a client of another product or a hot patch deployed on a client of another product;
  • the suspicious sample data stream received by the program may also include suspicious samples crawled from various websites by crawlers.
  • step S110 shown in FIG. 1 receives the suspicious sample data stream from the data source, including: Read suspicious samples uploaded by the client in a distributed cluster.
  • the method shown in FIG. 1 before the received suspicious sample is put into the sandbox for operation in step S120, the method shown in FIG. 1 further includes: screening the received suspicious samples, screening the valuable suspicious samples and delivering them to the Run in the sandbox to get the running log corresponding to each suspicious sample.
  • the running log of each suspicious sample screened is analyzed to obtain more valuable suspicious sample related feature information to promote the forward feedback of subsequent processing.
  • the filtering the received suspicious sample includes: de-dusting the received suspicious sample; calculating the priority of the de-duplicated suspicious sample according to the associated information of the suspicious sample and the preset policy, and prioritizing Suspicious samples with levels above the first preset threshold are screened out.
  • suspiciously received by comparison The identification information of the suspect sample is used to find the duplicate suspicious sample, and the de-duplication operation is completed; and the associated information of the suspicious sample is some characteristic information of the suspicious sample currently known, wherein the associated data of the suspicious sample includes the following one Kind or multiple: use information, domain name information, website information, IP information, model information, etc.
  • the association information of a suspicious sample includes: a url address, and it is necessary to determine whether the url address hits a preset important website list (the important URL)
  • the list includes the url address of the suspicious sample associated with the government website. If yes, increase the priority of the suspicious sample, otherwise it will not change.
  • the priority of each suspicious sample is compared to select a suspicious sample with a higher priority as a valuable suspicious sample.
  • the solution further includes: structuring the received suspicious samples to make the received suspicious samples
  • the data structure is unified to facilitate subsequent de-duplication and screening.
  • the step S130 analyzes the running log corresponding to the suspicious sample, and obtains the feature information related to the suspicious sample, including: synchronizing the running log corresponding to the suspicious sample into the distributed cluster for storage;
  • the computing framework in the cluster analyzes the running logs corresponding to the suspicious samples in batches, and obtains the feature information related to each suspicious sample.
  • the method shown in FIG. 1 further includes: selecting feature information related to the specified suspicious sample that meets the preset condition from the threat database at a preset time interval; and including the selected specified suspicious
  • the information of the feature information related to the sample is pushed to the data source, so that each data source makes a judgment of the suspicious sample according to the push information.
  • the solution further comprises: receiving feedback information from each data source; the feedback information is a ticker log generated by the data source in the process of determining the suspicious sample according to the push information.
  • the data source includes: a client that performs dot recording on the suspect sample, a third-party security detection platform “VT data source & other”, and a hot patch deployed on a client of another product. "Net shield hot fill”.
  • the client distributed on different terminals uploads suspicious samples to the HDFS distributed file system of the Hadoop distributed cluster for storage.
  • This solution receives suspicious samples from the client by reading suspicious samples from the HDFS.
  • the received suspicious samples are structured, and the suspicious samples with uniform data structures are placed in the detection task data screening module; the detection task data screening module selects valuable samples from the suspicious samples.
  • Suspicious sample the basis for which the screening is based on a suspicious sample
  • Each of the selected suspicious samples is sent to the analysis task module as a pending task; in this embodiment, the analysis task module is implemented by the ElasticSearch distributed search engine, and in order to improve the subsequent processing efficiency, the analysis task module will need to
  • the pending tasks (such as suspicious samples with priority higher than the predetermined threshold and suspicious samples for the current day) are delivered to the task distribution scheduling module; the task distribution scheduling module distributes the received suspicious samples and dispatches each suspicious sample.
  • each suspicious sample runs in parallel in the distributed sandbox system, and obtains the running logs corresponding to each suspicious sample; wherein the distribution rules can be related to the 0Day vulnerability according to the type described in the suspicious sample.
  • Suspicious samples, suspicious samples related to the NDay vulnerability, and malicious software-related suspicious samples are distributed to the distributed sandbox system, which is based on the Mongodb cluster.
  • the running log corresponding to each suspicious sample is returned as result data to the result buffer for caching, and the result data is classified and distributed, and distributed to the result data analysis, and the screening module performs analysis on the running log corresponding to the suspicious sample to obtain a suspicious sample.
  • Feature information determining whether the suspicious sample is a threat sample according to the feature information related to the suspicious sample and a preset rule, and screening the suspicious sample determined as the threat sample; in the embodiment shown in FIG. 2, the pair of result data
  • the process of classifying and distributing to the result data analysis and determination screening module is as follows: synchronizing the running logs corresponding to the suspicious samples into the Hadoop distributed cluster for storage, and using the MapReduce computing framework in the Hadoop distributed cluster to batchly run the suspicious samples.
  • the log is analyzed to obtain the feature information related to each suspicious sample.
  • the MapReduce computing framework in the Hadoop distributed cluster can be used to determine whether the suspicious sample is a threat sample according to the feature information related to the suspicious sample, and the threat is determined as a threat. Suspicious samples of the sample are screened out, and the feature information related to the suspicious sample determined as the threat sample is put into the threat database to supplement and improve the threat database.
  • feature information related to the specified suspicious sample that meets the preset condition is selected from the threat database every day as daily threat data is pushed to each data source, so that each data source performs a suspicious sample according to the push information.
  • the feedback information is a ticker log generated by the data source in the process of determining the suspicious sample according to the push information.
  • FIG. 3 shows a data flow diagram of a method of processing a suspicious sample in accordance with one embodiment of the present invention.
  • Clients distributed on different terminals collect suspicious samples from users, upload suspicious samples to Hadoop distributed clusters for storage, and use MapReduce computing framework in Hadoop distributed clusters.
  • the received suspicious samples are deduplicated, filtered and structured in batches, and the suspicious samples to be processed are obtained as pending tasks.
  • the ElasticSearch distributed search engine is used for task distribution and distributed to the distributed sandbox for operation.
  • the running log corresponding to each suspicious sample is taken as The result data, the result data analysis, the feature information related to each suspicious sample is obtained, and the ruled judgment is performed according to the rule to determine whether the suspicious sample is a threat sample. If the suspicious sample is not a threat sample, it is necessary to re-deliver to the sandbox to run. If not, discard the suspicious sample, and if necessary, re-deliver the suspicious sample to the sandbox; if the suspicious sample is a threat sample, structure the feature information related to the suspicious sample and put it into the threat database.
  • the feature information related to the suspicious sample that meets the push condition is filtered out from the threat database and pushed to the corresponding data source as the threat analysis basis, and the feedback result of the data source is received.
  • the suspicious sample is received from the data source, the suspicious sample is detected to implement the supplementary update to the threat database, and the threat database pushes the characteristic information related to the suspicious sample after the update to the data source, according to the data source.
  • the characteristic information related to the suspicious samples pushed is recorded, more accurately intercepted and recorded suspicious samples and uploaded, and feedback results are fed back to the threat database, forming a positive feedback loop, which can continuously expand and improve the threat data monitoring constructed by the scheme.
  • the Threat Data Monitoring Center can establish the management of complete feature information about various types of threat samples through the threat database. The more complete and clear the feature information of the managed threat samples, the more able to find the strategy to prevent the detection of threat samples. And can promptly push the strategy of preventing the detection of threat samples to the data source to uniformly adjust the prevention and killing strategies of each data source, establish a very strict security protection mechanism, and protect Internet information security from a higher pattern. .
  • the processing device 400 of the suspect sample includes:
  • the sample receiving unit 410 is adapted to receive a suspicious sample data stream from the data source; the suspect sample data stream includes a plurality of suspicious samples.
  • the operation processing unit 420 is adapted to deliver the received suspicious sample to the sandbox for running, and obtain an operation log corresponding to the suspicious sample.
  • the result analyzing unit 430 is adapted to analyze the running log corresponding to the suspicious sample, obtain feature information related to the suspicious sample, and determine whether the suspicious sample is a threat sample according to the feature information related to the suspect sample and the preset rule.
  • the sample processing unit 440 is adapted to put feature information related to the suspicious sample determined as the threat sample into the threat database.
  • the device shown in FIG. 4 delivers the suspicious sample received from the data source to the sandbox, and runs the log to record the running process of the suspicious sample in the sandbox, by running the suspicious sample in the sandbox.
  • the analysis can know the characteristic information related to the suspicious sample, and then can clearly determine whether the suspicious sample is Threatened threat samples, and put all relevant feature information of threat samples into the threat database as a supplement and update of known threat data, forming an ecological environment-based threat data monitoring center with positive feedback, which has the following benefits.
  • the data source comprises: a client distributed over different terminals; and/or a third party security detection platform.
  • the client uploads the suspicious sample to the distributed cluster for storage; the sample receiving unit 410 is adapted to read the client-uploaded from the distributed cluster. Suspicious sample.
  • the operation processing unit 420 is further adapted to filter the received suspicious samples before the suspicious samples to be received are run into the sandbox; then the operation processing unit 420 It is suitable for the selected suspicious samples to be put into the sandbox to run, and the running log corresponding to each suspicious sample is obtained.
  • the operation processing unit 420 is configured to perform deduplication on the received suspicious sample; calculate, according to the association information of the suspicious sample and the preset policy, the priority of the deduplicated suspicious sample, and the priority is higher than the first A suspicious sample of a predetermined threshold is selected; wherein the associated data of the suspicious sample includes one or more of the following: utilization information, domain name information, web address information, IP information, and schema information.
  • the running processing unit 420 is further adapted to perform structured processing on the received suspicious samples before the screening of the received suspicious samples, so that the data structures of the received suspicious samples are unified.
  • the operation processing unit 420 is adapted to perform distribution scheduling on the received suspicious samples, and distribute each suspicious sample into the distributed sandbox system, so that each suspicious sample is in the distributed sandbox system. Run in parallel to get the run log corresponding to each suspicious sample.
  • the result analyzing unit 430 is adapted to synchronize the running logs corresponding to the suspicious samples to the distributed cluster for storage; and use the computing framework in the distributed cluster to batchly run the running logs corresponding to the suspicious samples. Analysis, obtaining feature information related to each suspicious sample.
  • the feature information related to the suspicious sample includes: static feature information of the suspect sample, and/or behavior characteristic information of the suspect sample.
  • the result analyzing unit 430 is further adapted to: after the obtaining the feature information related to the suspect sample, structurally processing the feature information related to the suspect sample, so that the feature information related to the suspect sample is unified The data structure.
  • the sample processing unit 440 is adapted to update the original data in the threat database according to the feature information related to the suspicious sample determined to be the threat sample.
  • the sample processing unit 440 is further configured to select feature information related to the specified suspicious sample that meets the preset condition from the threat database every preset time interval; and the selected specified suspicious sample is included
  • the information of the related feature information is pushed to the data source, so that each data source makes a judgment of the suspicious sample according to the push information.
  • the sample processing unit 440 is further adapted to receive feedback information from each data source; the feedback information is a ticker log generated by the data source in the process of determining the suspicious sample according to the push information.
  • FIG. 4 The embodiment of the device shown in FIG. 4 is the same as the embodiment described in FIG. 1 to FIG. 3 above, and has been described in detail above, and details are not described herein again.
  • the technical solution of the present invention delivers suspicious samples received from a data source into a sandbox, and runs a log to record the running process of suspicious samples in the sandbox, and runs the suspicious samples in the sandbox.
  • the analysis of the process can obtain the characteristic information related to the suspicious sample, and then can clearly determine whether the suspect sample is a threatened threat sample, and put all relevant feature information of the threat sample into the threat database as a supplement and update of the known threat data.
  • An ecological environment-based threat data monitoring center with positive feedback has been formed, which has the following beneficial effects: collecting a large number of suspicious samples from the data source to ensure the source of the data samples is stable; running the suspicious sample with the sandbox as a virtual carrier, clearly Record all running trajectories of suspicious samples, according to which trajectory can obtain more comprehensive information about suspicious samples; when determining a suspicious sample as a threat sample, use the comprehensive feature information related to the suspicious sample obtained from each analysis Constantly iteratively replenishing the number of update threats Existing library feature information of the suspicious sample; and the number of threat data in the database, data type, data accuracy to accumulate, to provide increasingly strong support for follow-up based on database information security threats carried out.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the suspicious sample processing device in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • Figure 5 shows a block diagram of a computing device for performing the method in accordance with the present invention.
  • the computing device A processor 510 and a computer program product or computer readable medium in the form of a memory 520 are conventionally included.
  • the memory 520 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 520 has a storage space 530 that stores program code 531 for performing any of the method steps described above.
  • the storage space 530 for storing program code may separately store respective program codes 531 for implementing various steps in the above method.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such computer program products are typically portable or fixed storage units such as those described in FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 520 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit stores computer readable program code 531' for performing the steps of the method according to the present invention, ie program code readable by a processor such as 510, when the program code is run by the computing device, resulting in The computing device performs the various steps in the methods described above.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种可疑样本的处理方法和装置，包括：从数据源接收可疑样本数据流；可疑样本数据流中包括多个可疑样本（S110）；将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志（S120）；对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息（S130）；根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本（S140）；将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中（S150）。其形成了一个具有正向反馈的威胁数据监控中心，以沙箱作为虚拟载体运行可疑样本，全面地获得可疑样本相关的特征信息；利用可疑样本相关的全面的特征信息来不断循环迭代地补充更新威胁数据库；而威胁数据库的不断累积，为后续信息安全防护提供有力支撑。

Description

一种可疑样本的处理方法和装置 技术领域
本发明涉及互联网技术领域，具体涉及一种可疑样本的处理方法和装置。
背景技术
随着互联网技术的不断发展，人们对于网络的使用愈加频繁，通过网络可以进行工作、学习、生活、娱乐等多方面的事宜，给人们带来了极大的便利。然而，当前互联网技术中存在漏洞，这些漏洞给恶意开发者以可乘之机，恶意开发者们通过威胁样本利用这些漏洞对各种客户端、服务端所在的终端进行攻击，获取用户的个人信息，威胁用户的信息安全，给用户的人身、财产等方面损失。
因此，如何有效、全面地对互联网中的可疑样本进行挖掘、检测和处理，是当前亟待解决的重要问题。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的可疑样本的处理方法和装置。
依据本发明的一个方面，提供了一种可疑样本的处理方法，包括：从数据源接收可疑样本数据流；所述可疑样本数据流中包括多个可疑样本；将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志；对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息；根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本；将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中。
依据本发明的另一个方面，提供了一种可疑样本的处理装置，包括：样本接收单元，适于从数据源接收可疑样本数据流；所述可疑样本数据流中包括多个可疑样本；运行处理单元，适于将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志；结果分析单元，适于对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息；根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本；样本处置单元，适于将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中。
依据本发明的另一方面，提供了一种计算机程序，包括计算机可读代码，当 所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据上述的可疑样本的处理方法。
依据本发明的又一方面，提供了一种计算机可读介质，其中存储了如上所述的计算机程序。
由上述可知，根据本发明的技术方案将从数据源接收的可疑样本投放到沙箱中运行，通过运行日志来记录可疑样本在沙箱中的运行过程，通过对可疑样本在沙箱中的运行过程的分析可以获知可疑样本相关的特征信息，进而可以明确地判定可疑样本是否是具有威胁的威胁样本，并将威胁样本的全部相关特征信息放入威胁数据库中作为已知威胁数据的补充和更新，形成了一个具有正向反馈的生态环境式的威胁数据监控中心，具有以下有益效果：从数据源收集海量可疑样本，保证数据样本的来源稳定；以沙箱作为虚拟载体运行可疑样本，清晰地记录可疑样本的所有运行轨迹，根据该运行轨迹可以更加全面地获得可疑样本相关的特征信息；在判定一个可疑样本为威胁样本时，利用每次分析得到的该可疑样本相关的全面的特征信息来不断循环迭代地补充更新威胁数据库中现有的该可疑样本的特征信息；而威胁数据库中的数据数量、数据种类、数据准确度地不断累积，为后续依据威胁数据库所进行的信息安全防护提供愈来愈有力的支撑。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了根据本发明一个实施例的一种可疑样本的处理方法的流程图；
图2示出了根据本发明一个实施例的一种可疑样本的处理方法的架构图；
图3示出了根据本发明一个实施例的一种可疑样本的处理方法的数据流转图；
图4示出了根据本发明一个实施例的一种可疑样本的处理装置的示意图；
图5示意性地示出了用于执行根据本发明的方法的计算设备的框图；以及
图6示意性地示出了用于保持或者携带实现根据本发明的方法的程序代码的存 储单元。
具体实施例
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
图1示出了根据本发明一个实施例的一种可疑样本的处理方法的流程图。如图1所示，该方法包括：
步骤S110，从数据源接收可疑样本数据流；所述可疑样本数据流中包括多个可疑样本。
步骤S120，将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志。
步骤S130，对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息。
步骤S140，根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本。
步骤S150，将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中。
可见，图1所示的方法将从数据源接收的可疑样本投放到沙箱中运行，通过运行日志来记录可疑样本在沙箱中的运行过程，通过对可疑样本在沙箱中的运行过程的分析可以获知可疑样本相关的特征信息，进而可以明确地判定可疑样本是否是具有威胁的威胁样本，并将威胁样本的全部相关特征信息放入威胁数据库中作为已知威胁数据的补充和更新，形成了一个具有正向反馈的生态环境式的威胁数据监控中心，具有以下有益效果：从数据源收集海量可疑样本，保证数据样本的来源稳定；以沙箱作为虚拟载体运行可疑样本，清晰地记录可疑样本的所有运行轨迹，根据该运行轨迹可以更加全面地获得可疑样本相关的特征信息；在判定一个可疑样本为威胁样本时，利用每次分析得到的该可疑样本相关的全面的特征信息来不断循环迭代地补充更新威胁数据库中现有的该可疑样本的特征信息；而威胁数据库中的数据数量、数据种类、数据准确度地不断累积，为后续依据威胁数据库所进行的信息安全防护提供愈来愈有力的支撑。
其中，通过分析可疑样本对应的运行日志得到的可疑样本相关的特征信息包括： 可疑样本的静态特征信息，和/或，可疑样本的行为特征信息。也就是说，对于放入沙箱中运行的每个可疑样本，无论是该可疑样本的静态特征，还是该可疑样本在运行过程中的动态行为特征，均可以被解构出来，均可以从本方案的视角观察到，即掌握了一个可疑样本的完整的档案，进而对于该可疑样本是不是具有威胁的威胁样本、如果是威胁样本如何对该可疑样本进行预防、查杀等问题均可以找到准确的答案。
随着本方案的不断实施，所掌握的可疑样本的档案不断被完善，即威胁数据库中的数据不断被完善。在本发明的一个实施例中，上述步骤S150将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中包括：根据所述判定为威胁样本的可疑样本相关的特征信息对威胁数据库中原有的数据进行更新。
在本发明的一个实施例中，数据源可以是本方案的分布于不同终端上的客户端，客户端对于可疑样本进行打点记录，本方案所接收到的可疑样本可以是由各个客户端上传的可疑样本；数据源也可以是与本方案合作的第三方安全检测平台，本方案所接收到的可疑样本可以是由该第三方安全检测平台检测后上传的可疑样本；数据源也可以是其他产品的客户端或者部署于其他产品的客户端上的热补丁，本方案所接收到的可疑样本可以是由其他产品的客户端或者部署于其他产品的客户端上的热补丁上传的可疑样本；此外，本方案所接收到的可疑样本数据流中还可以包括通过爬虫从各种网站上爬取的可疑样本。
其中，当数据源为分布在不同终端上的客户端时，客户端将可疑样本上传到分布式集群中进行存储；则图1所示步骤S110从数据源接收可疑样本数据流包括：从所述分布式集群中读取客户端上传的可疑样本。
通常，由于从数据源接收到的可疑样本数据流中可疑样本数目众多，其中不乏重复冗余无价值的可疑样本，因此，为了提高本方案运转效率，减少无意义地资源占用，在本发明的一个实施例中，在步骤S120将接收到的可疑样本投放到沙箱中运行之前，图1所示的方法进一步包括：对接收到的可疑样本进行筛选，将有价值的可疑样本筛选出来投放到沙箱中运行，获得筛选出来的每个可疑样本对应的运行日志。对筛选出来的每个可疑样本的运行日志进行分析，以获得更有价值的可疑样本相关的特征信息，以推动后续处理的正向反馈行进。
具体地，上述对接收到的可疑样本进行筛选包括：对接收到的可疑样本进行去重；根据可疑样本的关联信息和预设策略，对去重后的可疑样本的优先级进行计算，将优先级高于第一预设阈值的可疑样本筛选出来。其中，可疑通过比对接收到的可 疑样本的标识信息来找出重复的可疑样本，完成去重操作；以及，可疑样本的关联信息即是可疑样本在当前已知的一些特征信息，其中，所述可疑样本的关联数据包括如下一种或多种：利用信息、域名信息、网址信息、IP信息、模式化信息等，随着本方案的不断实施，可疑样本的关联信息会不断被扩充，对于去重后的每个可疑样本，根据当前已知的该可疑样本的特征信息计算该可疑样本的优先级，例如，一个可疑样本的关联信息包括：url地址，则需要判断该url地址是否命中预置的重要网址列表(该重要网址列表中包括与政府网站相关的可疑样本的url地址)，是则，增加该可疑样本的优先级，否则不变。将各个可疑样本的优先级进行比较，筛选出优先级较高的可疑样本，作为有价值的可疑样本。
进一步地，由于来自不同数据源的可疑样本的格式不同，因此在上述对接收到的可疑样本进行筛选之前，本方案进一步包括：对接收到的可疑样本进行结构化处理，使得接收到的可疑样本的数据结构相统一，以利于后续的去重和筛选。
在本发明的一个实施例中，上述步骤S130对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息包括：将可疑样本对应的运行日志同步到分布式集群中进行存储；利用分布式集群中的计算框架批量地对可疑样本对应的运行日志进行分析，获得各个可疑样本相关的特征信息。
在本发明的一个实施例中，图1所示的方法进一步包括：每隔预设时间间隔，从威胁数据库中选取符合预设条件的指定可疑样本相关的特征信息；将包含所选取的指定可疑样本相关的特征信息的信息推送至数据源，使得各数据源依据所述推送信息进行可疑样本的判断。
以及，在向数据源推送信息之后，该方案进一步包括：从各数据源接收反馈信息；所述反馈信息是数据源在依据所述推送信息进行可疑样本的判断的过程中所产生的打点日志。
图2示出了根据本发明一个实施例的一种可疑样本的处理方法的架构图。如图2所示，在本实施例中，数据源包括：对可疑样本进行打点记录的客户端、第三方安全检测平台“VT数据源&其他”以及部署于其他产品的客户端上的热补丁“网盾热补”。其中，分布于不同终端的客户端将可疑样本上传至Hadoop分布式集群的HDFS分布式文件系统中进行存储，本方案通过从HDFS中读取可疑样本来接收来自客户端的可疑样本。在接收到来自不同数据源的可疑样本之后，对接收到的可疑样本进行结构化，将数据结构统一的可疑样本放入检测任务数据筛选模块；检测任务数据筛选模块从可疑样本中筛选出有价值的可疑样本，其筛选依据为可疑样本的关联信 息，将筛选出来的每一个可疑样本作为一条待处理任务发送至分析任务模块；本实施例中，分析任务模块由ElasticSearch分布式搜索引擎来实现的，为了提高后续处理效率，分析任务模块将需要立即进行处理的待处理任务(如优先级高于预定阈值的可疑样本以及当天的可疑样本)下发至任务分发调度模块；任务分发调度模块对接收到的可疑样本进行分发调度，将各个可疑样本分发到分布式沙箱系统中，使得各个可疑样本在分布式沙箱系统中并行地运行，获得各个可疑样本对应的运行日志；其中分发规则可以依据可疑样本所述的类型，将0Day漏洞相关的可疑样本、NDay漏洞相关的可疑样本以及恶意软件相关的可疑样本分发到分布式沙箱系统中，该分布式沙箱系统具体基于Mongodb集群搭建。
将各个可疑样本对应的运行日志作为结果数据回传到结果缓存区进行缓存，对于结果数据进行分类派发，派发至结果数据分析判定筛选模块执行对可疑样本对应的运行日志进行分析获得可疑样本相关的特征信息、根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本、以及将判定为威胁样本的可疑样本筛选出来的过程；在图2所示的实施例中，上述对结果数据进行分类派发至结果数据分析判定筛选模块的过程具体为：将可疑样本对应的运行日志同步到Hadoop分布式集群中进行存储，利用Hadoop分布式集群中的MapReduce计算框架批量地对可疑样本对应的运行日志进行分析，获得各个可疑样本相关的特征信息；进一步地，还可以利用Hadoop分布式集群中的MapReduce计算框架根据可疑样本相关的特征信息判断可疑样本是否为威胁样本，并将判定为威胁样本的可疑样本筛选出来，将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中，以对威胁数据库进行补充和完善。
进一步地，如图2所示，每天从威胁数据库中选取符合预设条件的指定可疑样本相关的特征信息作为每日威胁数据推送到各个数据源，使得各数据源依据所述推送信息进行可疑样本的判断，以及，从各数据源接收反馈信息；所述反馈信息是数据源在依据所述推送信息进行可疑样本的判断的过程中所产生的打点日志。
图3示出了根据本发明一个实施例的一种可疑样本的处理方法的数据流转图。如图3所示，整个数据流转过程说明如下：分布于不同终端的客户端从用户处收集可疑样本，将可疑样本上传到Hadoop分布式集群中进行存储，利用Hadoop分布式集群中的MapReduce计算框架批量地对接收到的可疑样本进行去重、筛选和结构化处理，得到待处理的可疑样本作为待处理任务，利用ElasticSearch分布式搜索引擎进行任务分发，分发到分布式沙箱中进行运行，得到各可疑样本对应的运行日志作为 结果数据，进行结果数据分析，得到每个可疑样本相关的特征信息，根据规则进行规则化判定，判断可疑样本是否为威胁样本，如果可疑样本不是威胁样本，看是否需要重新投放到沙箱中运行，如果不需要则放弃该可疑样本，如果需要则将该可疑样本重新投放到沙箱中运行；如果可疑样本是威胁样本，结构化该可疑样本相关的特征信息，再放入到威胁数据库中，从威胁数据库中筛选出符合推送条件的可疑样本相关的特征信息并推送至相应的数据源作为威胁分析依据，并接收数据源的反馈结果。
可以看到，在本方案中，从数据源接收可疑样本，对可疑样本进行检测实现对威胁数据库的补充更新，威胁数据库向数据源推送补充更新后的可疑样本相关的特征信息，数据源根据该推送的可疑样本相关的特征信息进行打点记录，更精确地拦截、记录可疑样本并上传，以及向威胁数据库反馈推送结果，形成了正反馈闭环，能够不断地扩充完善本方案所构建的威胁数据监控中心，该威胁数据监控中心能够通过威胁数据库建立起关于各种类型的威胁样本的完整的特征信息的管理，所管理的威胁样本的特征信息越完善清晰，越能够找到预防查杀威胁样本的策略，并可以及时将预防查杀威胁样本的策略统一推送到数据源中对于各个数据源的预防查杀策略进行统一的调整，建立起非常严密的安全防护机制，从更高的格局保障互联网信息安全。
图4示出了根据本发明一个实施例的一种可疑样本的处理装置的示意图。如图4所示，该可疑样本的处理装置400包括：
样本接收单元410，适于从数据源接收可疑样本数据流；所述可疑样本数据流中包括多个可疑样本。
运行处理单元420，适于将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志。
结果分析单元430，适于对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息；根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本。
样本处置单元440，适于将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中。
可见，图4所示的装置将从数据源接收的可疑样本投放到沙箱中运行，通过运行日志来记录可疑样本在沙箱中的运行过程，通过对可疑样本在沙箱中的运行过程的分析可以获知可疑样本相关的特征信息，进而可以明确地判定可疑样本是否是具 有威胁的威胁样本，并将威胁样本的全部相关特征信息放入威胁数据库中作为已知威胁数据的补充和更新，形成了一个具有正向反馈的生态环境式的威胁数据监控中心，具有以下有益效果：从数据源收集海量可疑样本，保证数据样本的来源稳定；以沙箱作为虚拟载体运行可疑样本，清晰地记录可疑样本的所有运行轨迹，根据该运行轨迹可以更加全面地获得可疑样本相关的特征信息；在判定一个可疑样本为威胁样本时，利用每次分析得到的该可疑样本相关的全面的特征信息来不断循环迭代地补充更新威胁数据库中现有的该可疑样本的特征信息；而威胁数据库中的数据数量、数据种类、数据准确度地不断累积，为后续依据威胁数据库所进行的信息安全防护提供愈来愈有力的支撑。
在本发明的一个实施例中，数据源包括：分布在不同终端上的客户端；和/或，第三方安全检测平台。其中，当数据源为分布在不同终端上的客户端时，客户端将可疑样本上传到分布式集群中进行存储；样本接收单元410，适于从所述分布式集群中读取客户端上传的可疑样本。
在本发明的一个实施例中，运行处理单元420，进一步适于在所述将接收到的可疑样本投放到沙箱中运行之前，对接收到的可疑样本进行筛选；则所述运行处理单元420，适于将筛选出来的可疑样本投放到沙箱中运行，获得筛选出来的每个可疑样本对应的运行日志。
具体地，运行处理单元420，适于对接收到的可疑样本进行去重；根据可疑样本的关联信息和预设策略，对去重后的可疑样本的优先级进行计算，将优先级高于第一预设阈值的可疑样本筛选出来；其中，所述可疑样本的关联数据包括如下一种或多种：利用信息、域名信息、网址信息、IP信息、模式化信息。
以及，运行处理单元420，进一步适于在所述对接收到的可疑样本进行筛选之前，对接收到的可疑样本进行结构化处理，使得接收到的可疑样本的数据结构相统一。
在本发明的一个实施例中，运行处理单元420，适于对接收到的可疑样本进行分发调度，将各个可疑样本分发到分布式沙箱系统中，使得各个可疑样本在分布式沙箱系统中并行地运行，获得各个可疑样本对应的运行日志。
在本发明的一个实施例中，结果分析单元430，适于将可疑样本对应的运行日志同步到分布式集群中进行存储；利用分布式集群中的计算框架批量地对可疑样本对应的运行日志进行分析，获得各个可疑样本相关的特征信息。
在本发明的一个实施例中，可疑样本相关的特征信息包括：可疑样本的静态特征信息，和/或，可疑样本的行为特征信息。
在本发明的一个实施例中，结果分析单元430，进一步适于在所述获得可疑样本相关的特征信息之后，对可疑样本相关的特征信息进行结构化处理，使得可疑样本相关的特征信息具有统一的数据结构。
在本发明的一个实施例中，样本处置单元440，适于根据所述判定为威胁样本的可疑样本相关的特征信息对威胁数据库中原有的数据进行更新。
在本发明的一个实施例中，样本处置单元440，进一步适于每隔预设时间间隔，从威胁数据库中选取符合预设条件的指定可疑样本相关的特征信息；将包含所选取的指定可疑样本相关的特征信息的信息推送至数据源，使得各数据源依据所述推送信息进行可疑样本的判断。
其中，样本处置单元440，进一步适于从各数据源接收反馈信息；所述反馈信息是数据源在依据所述推送信息进行可疑样本的判断的过程中所产生的打点日志。
其中，图4所示的装置的实施例与上文中图1-图3所描述的各实施例对应相同，上文中已经有详细说明，在此不再赘述。
综上所述，本发明的技术方案将从数据源接收的可疑样本投放到沙箱中运行，通过运行日志来记录可疑样本在沙箱中的运行过程，通过对可疑样本在沙箱中的运行过程的分析可以获知可疑样本相关的特征信息，进而可以明确地判定可疑样本是否是具有威胁的威胁样本，并将威胁样本的全部相关特征信息放入威胁数据库中作为已知威胁数据的补充和更新，形成了一个具有正向反馈的生态环境式的威胁数据监控中心，具有以下有益效果：从数据源收集海量可疑样本，保证数据样本的来源稳定；以沙箱作为虚拟载体运行可疑样本，清晰地记录可疑样本的所有运行轨迹，根据该运行轨迹可以更加全面地获得可疑样本相关的特征信息；在判定一个可疑样本为威胁样本时，利用每次分析得到的该可疑样本相关的全面的特征信息来不断循环迭代地补充更新威胁数据库中现有的该可疑样本的特征信息；而威胁数据库中的数据数量、数据种类、数据准确度地不断累积，为后续依据威胁数据库所进行的信息安全防护提供愈来愈有力的支撑。
需要说明的是：
在此提供的算法和显示不与任何特定计算机、虚拟装置或者其它设备固有相关。各种通用装置也可以与基于在此的示教一起使用。根据上面的描述，构造这类装置所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的可疑样本的处理装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图5示出了用于执行根据本发明的方法的计算设备的框图。该计算设备 传统上包括处理器510和以存储器520形式的计算机程序产品或者计算机可读介质。存储器520可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器520具有存储用于执行上述方法中的任何方法步骤的程序代码531的存储空间530。例如，用于存储程序代码的存储空间530可以分别存储用于实现上面的方法中的各种步骤的各个程序代码531。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为例如图6所述的便携式或者固定存储单元。该存储单元可以具有与图5的计算设备中的存储器520类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元存储有用于执行根据本发明的方法步骤的计算机可读程序代码531’，即可以由诸如510之类的处理器读取的程序代码，当这些程序代码由计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (28)

  1. 一种可疑样本的处理方法，包括：
    从数据源接收可疑样本数据流；所述可疑样本数据流中包括多个可疑样本；
    将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志；
    对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息；
    根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本；以及
    将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中。
  2. 如权利要求1所述的方法，其中，所述数据源包括：
    分布在不同终端上的客户端；
    和/或，
    第三方安全检测平台。
  3. 如权利要求2所述的方法，其中，当数据源为分布在不同终端上的客户端时，客户端将可疑样本上传到分布式集群中进行存储；
    则所述从数据源接收可疑样本数据流包括：从所述分布式集群中读取客户端上传的可疑样本。
  4. 如权利要求1所述的方法，其中，在所述将接收到的可疑样本投放到沙箱中运行之前，该方法进一步包括：对接收到的可疑样本进行筛选；
    所述将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志包括：将筛选出来的可疑样本投放到沙箱中运行，获得筛选出来的每个可疑样本对应的运行日志。
  5. 如权利要求4所述的方法，其中，所述对接收到的可疑样本进行筛选包括：
    对接收到的可疑样本进行去重；以及
    根据可疑样本的关联信息和预设策略，对去重后的可疑样本的优先级进行计算，将优先级高于第一预设阈值的可疑样本筛选出来；
    其中，所述可疑样本的关联数据包括如下一种或多种：利用信息、域名信息、网址信息、IP信息、模式化信息。
  6. 如权利要求4所述的方法，其中，在所述对接收到的可疑样本进行筛 选之前，该方法进一步包括：
    对接收到的可疑样本进行结构化处理，使得接收到的可疑样本的数据结构相统一。
  7. 如权利要求1所述的方法，其中，所述将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志包括：
    对接收到的可疑样本进行分发调度，将各个可疑样本分发到分布式沙箱系统中，使得各个可疑样本在分布式沙箱系统中并行地运行，获得各个可疑样本对应的运行日志。
  8. 如权利要求1所述的方法，其中，所述对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息包括：
    将可疑样本对应的运行日志同步到分布式集群中进行存储；以及
    利用分布式集群中的计算框架批量地对可疑样本对应的运行日志进行分析，获得各个可疑样本相关的特征信息。
  9. 如权利要求1所述的方法，其中，可疑样本相关的特征信息包括：
    可疑样本的静态特征信息，和/或，可疑样本的行为特征信息。
  10. 如权利要求1所述的方法，其中，在所述获得可疑样本相关的特征信息之后，该方法进一步包括：
    对可疑样本相关的特征信息进行结构化处理，使得可疑样本相关的特征信息具有统一的数据结构。
  11. 如权利要求1所述的方法，其中，所述将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中包括：
    根据所述判定为威胁样本的可疑样本相关的特征信息对威胁数据库中原有的数据进行更新。
  12. 如权利要求1所述的方法，进一步包括：
    每隔预设时间间隔，从威胁数据库中选取符合预设条件的指定可疑样本相关的特征信息；以及
    将包含所选取的指定可疑样本相关的特征信息的信息推送至数据源，使得各数据源依据所述推送信息进行可疑样本的判断。
  13. 如权利要求12所述的方法，进一步包括：
    从各数据源接收反馈信息；所述反馈信息是数据源在依据所述推送信息 进行可疑样本的判断的过程中所产生的打点日志。
  14. 一种可疑样本的处理装置，包括：
    样本接收单元，适于从数据源接收可疑样本数据流；所述可疑样本数据流中包括多个可疑样本；
    运行处理单元，适于将接收到的可疑样本投放到沙箱中运行，获得可疑样本对应的运行日志；
    结果分析单元，适于对可疑样本对应的运行日志进行分析，获得可疑样本相关的特征信息；根据可疑样本相关的特征信息和预设规则判断可疑样本是否为威胁样本；以及
    样本处置单元，适于将判定为威胁样本的可疑样本相关的特征信息放入威胁数据库中。
  15. 如权利要求14所述的装置，其中，所述数据源包括：
    分布在不同终端上的客户端；
    和/或，
    第三方安全检测平台。
  16. 如权利要求15所述的装置，其中，当数据源为分布在不同终端上的客户端时，客户端将可疑样本上传到分布式集群中进行存储；
    所述样本接收单元，适于从所述分布式集群中读取客户端上传的可疑样本。
  17. 如权利要求14所述的装置，其中，
    所述运行处理单元，进一步适于在所述将接收到的可疑样本投放到沙箱中运行之前，对接收到的可疑样本进行筛选；以及
    则所述运行处理单元，适于将筛选出来的可疑样本投放到沙箱中运行，获得筛选出来的每个可疑样本对应的运行日志。
  18. 如权利要求17所述的装置，其中，
    所述运行处理单元，适于对接收到的可疑样本进行去重；根据可疑样本的关联信息和预设策略，对去重后的可疑样本的优先级进行计算，将优先级高于第一预设阈值的可疑样本筛选出来；
    其中，所述可疑样本的关联数据包括如下一种或多种：利用信息、域名信息、网址信息、IP信息、模式化信息。
  19. 如权利要求17所述的装置，其中，
    所述运行处理单元，进一步适于在所述对接收到的可疑样本进行筛选之前，对接收到的可疑样本进行结构化处理，使得接收到的可疑样本的数据结构相统一。
  20. 如权利要求14所述的装置，其中，
    所述运行处理单元，适于对接收到的可疑样本进行分发调度，将各个可疑样本分发到分布式沙箱系统中，使得各个可疑样本在分布式沙箱系统中并行地运行，获得各个可疑样本对应的运行日志。
  21. 如权利要求14所述的装置，其中，
    所述结果分析单元，适于将可疑样本对应的运行日志同步到分布式集群中进行存储；利用分布式集群中的计算框架批量地对可疑样本对应的运行日志进行分析，获得各个可疑样本相关的特征信息。
  22. 如权利要求14所述的装置，其中，可疑样本相关的特征信息包括：
    可疑样本的静态特征信息，和/或，可疑样本的行为特征信息。
  23. 如权利要求14所述的装置，其中，
    所述结果分析单元，进一步适于在所述获得可疑样本相关的特征信息之后，对可疑样本相关的特征信息进行结构化处理，使得可疑样本相关的特征信息具有统一的数据结构。
  24. 如权利要求14所述的装置，其中，
    所述样本处置单元，适于根据所述判定为威胁样本的可疑样本相关的特征信息对威胁数据库中原有的数据进行更新。
  25. 如权利要求14所述的装置，其中，
    所述样本处置单元，进一步适于每隔预设时间间隔，从威胁数据库中选取符合预设条件的指定可疑样本相关的特征信息；将包含所选取的指定可疑样本相关的特征信息的信息推送至数据源，使得各数据源依据所述推送信息进行可疑样本的判断。
  26. 如权利要求25所述的装置，其中，
    所述样本处置单元，进一步适于从各数据源接收反馈信息；所述反馈信息是数据源在依据所述推送信息进行可疑样本的判断的过程中所产生的打点日志。
  27. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1-13中的任一个所述的可疑样本的处理方法。
  28. 一种计算机可读介质，其中存储了如权利要求27所述的计算机程序。
PCT/CN2017/099910 2016-11-24 2017-08-31 一种可疑样本的处理方法和装置 Ceased WO2018095099A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611045688.0A CN106709326A (zh) 2016-11-24 2016-11-24 一种可疑样本的处理方法和装置
CN201611045688.0 2016-11-24

Publications (1)

Publication Number Publication Date
WO2018095099A1 true WO2018095099A1 (zh) 2018-05-31

Family

ID=58934765

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/099910 Ceased WO2018095099A1 (zh) 2016-11-24 2017-08-31 一种可疑样本的处理方法和装置

Country Status (2)

Country Link
CN (1) CN106709326A (zh)
WO (1) WO2018095099A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112580036A (zh) * 2019-09-30 2021-03-30 奇安信安全技术(珠海)有限公司 病毒防御的优化方法及装置、存储介质、计算机设备
CN117251691A (zh) * 2023-08-04 2023-12-19 华能信息技术有限公司 一种可疑样本分析处理方法及系统

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106709326A (zh) * 2016-11-24 2017-05-24 北京奇虎科技有限公司 一种可疑样本的处理方法和装置
CN107506641A (zh) * 2017-09-30 2017-12-22 北京奇虎科技有限公司 沙箱管理方法及装置、计算设备、存储介质
CN108718293A (zh) * 2018-04-08 2018-10-30 安徽展航信息科技发展有限公司 一种信息安全网络安全实验室系统
CN112597494A (zh) * 2020-12-21 2021-04-02 成都安思科技有限公司 一种用于恶意程序检测的行为白名单自动收集方法
CN112632529A (zh) * 2020-12-23 2021-04-09 北京鸿腾智能科技有限公司 漏洞识别方法、设备、存储介质及装置
CN114417339B (zh) * 2022-01-26 2025-10-31 福州启元信息科技有限责任公司 恶意应用程序的对抗方法、装置及相关产品
CN114491535A (zh) * 2022-01-26 2022-05-13 北京八分量信息科技有限公司 恶意应用程序的检测方法、装置及相关产品
CN114417338A (zh) * 2022-01-26 2022-04-29 北京八分量信息科技有限公司 恶意应用程序的展示方法、装置及相关产品

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103839003A (zh) * 2012-11-22 2014-06-04 腾讯科技（深圳）有限公司 恶意文件检测方法及装置
CN105205397A (zh) * 2015-10-13 2015-12-30 北京奇虎科技有限公司 恶意程序样本分类方法及装置
CN105718798A (zh) * 2015-08-18 2016-06-29 哈尔滨安天科技股份有限公司 基于私有网络信息放大的恶意代码自动分析方法及系统
CN105743877A (zh) * 2015-11-02 2016-07-06 哈尔滨安天科技股份有限公司 一种网络安全威胁情报处理方法及系统
CN106130966A (zh) * 2016-06-20 2016-11-16 北京奇虎科技有限公司 一种漏洞挖掘检测方法、服务器、装置和系统
CN106709326A (zh) * 2016-11-24 2017-05-24 北京奇虎科技有限公司 一种可疑样本的处理方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103839003A (zh) * 2012-11-22 2014-06-04 腾讯科技（深圳）有限公司 恶意文件检测方法及装置
CN105718798A (zh) * 2015-08-18 2016-06-29 哈尔滨安天科技股份有限公司 基于私有网络信息放大的恶意代码自动分析方法及系统
CN105205397A (zh) * 2015-10-13 2015-12-30 北京奇虎科技有限公司 恶意程序样本分类方法及装置
CN105743877A (zh) * 2015-11-02 2016-07-06 哈尔滨安天科技股份有限公司 一种网络安全威胁情报处理方法及系统
CN106130966A (zh) * 2016-06-20 2016-11-16 北京奇虎科技有限公司 一种漏洞挖掘检测方法、服务器、装置和系统
CN106709326A (zh) * 2016-11-24 2017-05-24 北京奇虎科技有限公司 一种可疑样本的处理方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112580036A (zh) * 2019-09-30 2021-03-30 奇安信安全技术(珠海)有限公司 病毒防御的优化方法及装置、存储介质、计算机设备
CN112580036B (zh) * 2019-09-30 2024-01-30 奇安信安全技术(珠海)有限公司 病毒防御的优化方法及装置、存储介质、计算机设备
CN117251691A (zh) * 2023-08-04 2023-12-19 华能信息技术有限公司 一种可疑样本分析处理方法及系统

Also Published As

Publication number Publication date
CN106709326A (zh) 2017-05-24

Similar Documents

Publication Publication Date Title
US20220263860A1 (en) Advanced cybersecurity threat hunting using behavioral and deep analytics
Dong et al. {DISTDET}: A {Cost-Effective} distributed cyber threat detection system
US11948379B2 (en) Systems and methods of detecting email-based attacks through machine learning
US11675915B2 (en) Protecting data based on a sensitivity level for the data
US11301578B2 (en) Protecting data based on a sensitivity level for the data
US12238124B2 (en) Systems and methods of malware detection
Moustafa et al. Anomaly detection system using beta mixture models and outlier detection
CN106709326A (zh) 一种可疑样本的处理方法和装置
EP4270875A2 (en) Security weakness and infiltration detection and repair in obfuscated website content
US20250165788A1 (en) Automatic triaging of network events
CN105205397B (zh) 恶意程序样本分类方法及装置
JP2024536226A (ja) 機械学習を介して悪意のあるハンズオンキーボード活動を検出するためのシステムおよび方法
US10248789B2 (en) File clustering using filters working over file attributes
US12579269B2 (en) Artificial intelligence (AI)-based system for detecting malware in endpoint devices using a multi-source data fusion and method thereof
Shukla et al. SDDA-IoT: storm-based distributed detection approach for IoT network traffic-based DDoS attacks
Bhattarai et al. Prov2vec: Learning provenance graph representation for anomaly detection in computer systems
Singh et al. A study of implementing a blockchain-based forensic model integration (BBFMI) for IoT devices in digital forensics
CN108351940B (zh) 用于信息安全事件的高频启发式数据获取与分析的系统和方法
Liu et al. A research and analysis method of open source threat intelligence data
Bhattarai et al. Prov2vec: Learning Provenance Graph Representation for Unsupervised APT Detection
Alnajjar et al. The Enhanced Forensic Examination and Analysis for Mobile Cloud Platform by Applying Data Mining Methods.
Al Fahdi et al. Towards an automated forensic examiner (AFE) based upon criminal profiling & artificial intelligence
EP3361405B1 (en) Enhancement of intrusion detection systems
Ali et al. A Blockchain-Based Digital Classified Forensic Image Preservation Framework
Orzechowski et al. Cryptojacking Detection Using eBPF and Machine Learning Techniques

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17873857

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17873857

Country of ref document: EP

Kind code of ref document: A1