WO2018121464A1

WO2018121464A1 - Method and device for detecting virus, and storage medium

Info

Publication number: WO2018121464A1
Application number: PCT/CN2017/118195
Authority: WO
Inventors: 罗元海
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2016-12-30
Filing date: 2017-12-25
Publication date: 2018-07-05
Also published as: CN106709350A; CN106709350B

Abstract

A method for detecting a virus, comprising: disassembling a sample to be tested to obtain a control flow graph corresponding to a disassembled function (S200); encoding each control flow graph separately to generate an identifier corresponding to each control flow graph (S202), different control flow graphs corresponding to different identifiers; collecting the identifiers corresponding to all control flow graphs to generate a feature of the sample to be tested (S204); matching the feature of the sample to be tested with features in a virus signature database (S206); if the feature of the sample to be tested matches a feature in the virus signature database successfully, determining that the sample to be tested is a malicious sample (S208). Also involved is a device for detecting a virus, and a storage medium.

Description

Virus detection method and device, storage medium

Cross-reference to related applications

The present application is based on a Chinese patent application filed on Jan. 30, 2016, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present invention relates to the field of computers, and in particular, to a virus detecting method, a virus detecting device, and a storage medium.

Background technique

With the development of electronic technology and mobile Internet technology, the functions of electronic devices, especially smart mobile devices, are becoming more and more powerful. As long as users install various applications on electronic devices according to their own needs, they can complete various tasks through the mobile Internet. Such as mobile payment, mobile office and so on. However, while electronic devices become very commonplace, electronic devices are increasingly infected with Trojans, which can easily cause huge losses to users.

Most of the current signature-based anti-virus engines are based on file hash matching and content binary byte matching. For example, the signature code of the famous open source anti-virus software Clam AntiVirus (ClamAV):

1. Format: HashString: FileSize: MalwareName

Example:

507d8f868c27feb88b18e6f8426adf1c:12391:Win.Exploit.CVE_2013_3163

2. Format: MalwareName=HexSignature:

Example:

Trojan.URLspoof.gen(Clam)=2e687265663d756e6573636170652827*3a2f2f*

The feature code based on the binary content of the virus sample in the prior art has no semantic analysis, lacks understanding of the program logic, and is very sensitive to the change of the sample. As long as the virus sample has slight changes, the signature may fail. This makes the broad spectrum of the signature very poor: on the one hand, the virus author can achieve the purpose of changing the virus hash and binary data to bypass the anti-virus software by slightly modifying the source code; on the other hand, most of them The compiler has optimization mechanisms such as instruction reordering and register reassignment, so that the binary content of the object files compiled by the same source code may be inconsistent.

Therefore, how to improve the spectral properties of signature codes and the difficulty of virus-free killing is a problem that current researchers are concerned about.

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a virus detection method, a virus detection device, and a storage medium, which solves the technical problem that the prior art is based on the poor spectral characteristics of the binary content of the virus sample and the difficulty of virus elimination.

In order to solve the above technical problem, the first aspect of the embodiments of the present invention discloses a virus detection method, including:

Disassemble the test sample to obtain a control flow graph corresponding to the disassembled function;

Encoding the obtained control flow graph to generate an identifier corresponding to the control flow graph; the identifiers corresponding to the different control flow graphs are different;

Collecting an identifier corresponding to the control flow graph to generate a feature of the sample to be detected;

Matching characteristics of the sample to be detected with features in a virus signature database;

If the feature of the sample to be detected matches the feature in the virus signature database, the sample to be detected is determined to be a malicious sample.

In the above solution, before the matching the feature of the sample to be detected with the feature in the virus signature database, the method further includes:

Disassemble the known malicious samples and obtain the control flow graph corresponding to the disassembled function;

Encoding the control flow graph corresponding to the known malicious sample, and generating an identifier corresponding to the control flow graph;

The identifiers of the control flow graphs corresponding to the known malicious samples are collected, the features of the known malicious samples are generated, and the features of the known malicious samples are stored in the virus signature database.

In the above solution, the control flow graph corresponding to the known malicious sample is encoded, and the identifier corresponding to the control flow graph is generated, including:

The control flow graph corresponding to each function is encoded into a triplet, and the triplet is used as an identifier corresponding to the control flow graph, wherein the triplet includes the basic block number of the control flow graph and the number of edges of the control flow graph And the number of calls in the control flow graph.

In the above solution, after the matching the feature of the sample to be detected with the feature in the virus signature database, the method further includes:

If the feature of the sample to be detected fails to match all the features in the virus signature database, it is determined that the sample to be detected is a normal sample.

In the above solution, the matching the feature of the sample to be detected with the feature in the virus signature database includes:

Calculating a common coding set of the feature of the sample to be detected and one of the features in the virus signature database;

Calculating a similarity between the feature of the sample to be detected and the feature in the virus feature database according to the feature of the sample to be detected and the common code set;

Determining whether the similarity is greater than a preset threshold;

When the similarity is greater than the preset threshold, determining that the feature of the sample to be detected matches the feature in the virus signature database is successful.

In the above solution, the calculating, according to the feature of the to-be-detected sample and the common coding set, the similarity between the feature of the to-be-detected sample and the feature in the virus signature database, including:

Comparing the number of identifiers in the common code set by the number of identifiers in the set corresponding to the feature of the sample to be detected, to obtain a similarity; or

And dividing the number of the identifiers in the common code set by the number of target identifiers to obtain a similarity; the number of target identifiers includes the number of identifiers in the set corresponding to the feature of the sample to be detected, and the number in the virus signature database The sum of the number of identities in the set corresponding to the feature.

A second aspect of the embodiments of the present invention discloses a virus detecting apparatus, including:

a first disassembly module configured to disassemble the sample to be detected, and obtain a control flow graph corresponding to the disassembled function;

The first encoding module is configured to encode the obtained control flow graph to generate an identifier corresponding to each control flow graph; the identifiers corresponding to the different control flow graphs are different;

The ensemble module is configured to: collect an identifier corresponding to the control flow graph, and generate a feature of the sample to be detected;

a feature matching module configured to match features of the sample to be detected with features in a virus signature database;

The first determining module is configured to determine that the to-be-detected sample is a malicious sample if the feature of the to-be-detected sample matches the feature in the virus signature database.

In the above scheme,

a second disassembly module configured to disassemble the known malicious samples before the feature matching module matches the features of the sample to be detected with the features in the virus signature database, and obtain a function corresponding to the disassembled function Control flow graph;

The second encoding module is configured to encode the control flow graph corresponding to the known malicious sample, and generate an identifier corresponding to the control flow graph;

And a storage module configured to collect an identifier of the control flow graph corresponding to the known malicious sample, generate a feature of the known malicious sample, and store the feature of the known malicious sample in the virus signature database.

In the above solution, the first coding module is further configured to encode a control flow graph corresponding to each function into a triplet, and use the triplet as an identifier corresponding to the control flow graph; wherein the triplet includes Controls the basic number of blocks in the flow graph, the number of edges in the control flow graph, and the number of calls in the control flow graph.

In the above solution, the second determining module is configured to: after the feature matching module matches the feature of the sample to be detected with the feature in the virus signature database, if the feature of the sample to be detected and the virus signature database If all the features in the match fail, it is determined that the sample to be detected is a normal sample.

In the above solution, the feature matching module includes:

a common coding calculation unit configured to calculate a common coding set of the feature of the sample to be detected and a feature in the virus signature database;

a similarity calculation unit, configured to calculate, according to the feature of the to-be-detected sample and the common coding set, a similarity between a feature of the to-be-detected sample and a feature in a virus signature database;

a determining unit, configured to determine whether the similarity is greater than a preset threshold;

In the above solution, the similarity calculation unit includes:

a first calculating unit, configured to divide the number of identifiers in the common code set by the number of identifiers in the set corresponding to the feature of the sample to be detected, to obtain a similarity; or

a second calculating unit, configured to divide the number of the identifiers in the common code set by the number of target identifiers to obtain a similarity; the number of target identifiers includes the number of identifiers in the set corresponding to the feature of the sample to be detected, and the The sum of the number of identities in the set corresponding to the feature in the virus signature database.

A third aspect of the embodiments of the present invention discloses a virus detecting apparatus, including: a processor and a memory for storing a computer program capable of running on a processor, wherein the processor is configured to execute when the computer program is executed The method described above.

A fourth aspect of the embodiments of the present invention discloses a computer readable storage medium having stored thereon a computer program, wherein the computer program is executed by a processor to implement the above method.

After the embodiment of the present invention is implemented, the control flow graph corresponding to the function is obtained by disassembling the sample to be detected, the control flow graph is encoded, the identifier corresponding to the control flow graph is generated, and then the identifier corresponding to the control flow graph is collected, and the to-be-detected is generated. The characteristics of the sample; finally, the characteristics of the sample to be detected are matched with the features in the virus signature database to perform virus detection, thus solving the problem that the prior art is based on the poor spectral characteristics of the binary content of the virus sample, and the difficulty of virus elimination Low technical issues.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic diagram of a scenario structure of a virus detection according to an embodiment of the present invention;

2 is a schematic flowchart of a virus detecting method according to an embodiment of the present invention;

3 is a schematic diagram of a function control flow diagram provided by an embodiment of the present invention;

4 is a schematic diagram of a principle for encoding a control flow graph according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart diagram of another embodiment of a virus detecting method provided by the present invention; FIG.

6 is a schematic diagram of a feature calculation principle provided by an embodiment of the present invention;

7 is a schematic structural diagram of a virus detecting apparatus according to an embodiment of the present invention;

8 is a schematic structural diagram of another embodiment of a virus detecting apparatus provided by the present invention;

9 is a schematic structural diagram of a feature matching module according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of another embodiment of a virus detecting apparatus provided by the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

In order to better understand a virus detection method and apparatus disclosed in the embodiments of the present invention, the scenario architecture of the embodiment of the present invention is described below. Please refer to FIG. 1. FIG. 1 is a schematic diagram of a scenario structure of a virus detection according to an embodiment of the present invention. As shown in Figure 1, the virus signature database needs to be generated first, and the known malicious samples (ie, virus samples) are extracted, and then stored in the virus signature database. Then, after the sample to be detected is acquired, the feature to be detected is extracted by the same feature extraction, and then the feature scan is performed to see whether the feature of the sample to be detected matches the feature in the virus signature database. Then, the sample to be detected is a malicious sample, and if it does not match, the sample to be detected is a normal sample.

The sample in the embodiment of the present invention may include an executable file. Specifically, the executable file format is different according to different operating systems. For example, the executable file under Windows is exe format, and the executable file under Linux is elf format, Android. The executable files under Android are dex format, elf format, and so on.

The virus detecting method of the embodiment of the invention can be applied to a personal computer, a smart mobile terminal (such as a mobile phone, a mobile computer, a tablet computer), a personal digital assistant (PDA), a smart TV, a smart watch, a smart glasses, and a smart device. On an electronic device with an operating system such as a wristband.

Based on the scenario architecture shown in FIG. 1 , in conjunction with FIG. 2 , FIG. 2 is a schematic flowchart of a virus detection method according to an embodiment of the present invention, and details how to perform virus detection in the embodiment of the present invention may include the following steps:

Step S200: disassembling the sample to be detected, and obtaining a control flow graph corresponding to the function after disassembling;

Specifically, after the sample to be detected is acquired, the sample to be detected is disassembled, and the object code is converted into assembly code, or the machine language is converted into an assembly language code, thereby obtaining a function corresponding to the disassembled function. Control flow graph. For example, one embodiment of the present invention can disassemble the detected samples by IDA, and obtain a control flow graph corresponding to the disassembled function. FIG. 3 is a schematic diagram of a function control flow graph provided by an embodiment of the present invention.

It should be noted that the decompiled function can be described by using a directed graph, which is the control flow graph in the embodiment of the present invention. A sequence of all assembly statements for a function can be divided into several basic blocks. A basic block is a contiguous sequence of assembly statements, from which the control flow enters and exits from its end, with no interruptions or branches (except at the end). The nodes of the control flow graph are composed of basic blocks, which represent calculations; the edges between the nodes represent control flow directions. Each function control flow graph has only one entry (a point with an entry degree of 0), but can have multiple exits (points with an exit degree of 0). As shown in Figure 3, a function control flow graph example, this function control flow graph contains 5 basic blocks, 6 edges.

Step S202: Encoding the obtained control flow graph to generate an identifier corresponding to the control flow graph; different identifiers corresponding to the different control flow graphs are different. For example, in a specific example, each control flow graph is separately encoded to generate each Control the identifier corresponding to the flow graph;

Specifically, the identifiers corresponding to the different control flow graphs in the embodiment of the present invention are different. That is, the embodiment of the present invention does not limit the manner in which the control flow graph is encoded, and only needs to ensure that the encoding of the same control flow graph is consistent, and different control The coding of the flow graph is inconsistent. For example, one embodiment of the present invention may encode a control flow graph corresponding to each function into a triplet, and use the triplet as an identifier corresponding to the control flow graph; wherein the triplet includes a basic block of the control flow graph. Number Node, the number of edges of the control flow graph Edge and the number of calls Call in the control flow graph. Then, in a function control flow diagram example shown in FIG. 3, the schematic diagram of the principle of encoding the control flow graph provided by the embodiment of the present invention as shown in FIG. 4, after encoding, the basic block number Node is 5, and the control is performed. The edge number Edge of the flow graph is 7, and the number of calls in the control flow graph Call is 4 (that is, the number of BL statements in FIG. 3), so the corresponding identifier of the encoded control flow graph is (5, 7, 4).

Step S204: The identifier corresponding to the control flow graph is generated, and the feature of the sample to be detected is generated. For example, in a specific example, the identifier corresponding to all the control flow graphs is collected, and the feature of the sample to be detected is generated.

Specifically, if there are multiple disassembled functions in the sample to be detected, then each function is encoded, and an identifier corresponding to the control flow graph is obtained. Therefore, the identifiers corresponding to all the control flow graphs are collected, and the to-be-generated The characteristics of the sample are detected, that is to say, each sample to be detected will get an element as a set of codes, and this set is the feature of the sample to be detected.

Step S206: matching the feature of the sample to be detected with the feature in the virus signature database;

Specifically, the feature corresponding to the at least one known virus sample is pre-stored in the virus signature database, and then the feature of the sample to be detected (one element is a coded set) is matched to each feature in the feature library (one element is coded) The collection of the virus signature library, that is, the traversal of each feature in the virus signature database, if the matching is found to be successful during the traversal process, step S208 may be performed, if all the features in the virus signature database are traversed If the match is found to be successful, step S210 can be performed. Thereby, it is determined whether the sample to be detected is a malicious sample.

Step S208: If the feature of the sample to be detected matches the feature in the virus signature database, the sample to be detected is determined to be a malicious sample.

Step S210: If the feature of the to-be-detected sample fails to match all the features in the virus signature database, determine that the to-be-detected sample is a normal sample.

Further, as shown in the flow diagram of another embodiment of the virus detection method provided by the present invention, as shown in FIG. 5, a detailed description of how the virus detection is performed in the embodiment of the present invention may include the following steps:

Step S500: disassembling the known malicious samples, and obtaining a control flow graph corresponding to the disassembled function;

Step S502: Encoding the control flow graph corresponding to the known malicious sample, and generating an identifier corresponding to the control flow graph. For example, in a specific example, each control flow graph is separately encoded to generate a corresponding control flow graph. Identification

Step S504: Collecting identifiers of control flow graphs corresponding to known malicious samples, generating features of the known malicious samples, and storing the features of the known malicious samples in a virus signature database, for example, in a specific example. And collecting identifiers corresponding to all control flow graphs, generating features of the known malicious samples, and storing the features of the known malicious samples in a virus signature database;

Specifically, the principle of step S500 to step S504 can be referred to step S200 to step S204 in the foregoing embodiment of FIG. 2, and details are not described herein again. Only the objects are different. The steps S500 to S504 are for known malicious samples, and the above steps S200 to S204 are for the samples to be detected.

Step S506: disassembling the sample to be detected, and obtaining a control flow graph corresponding to the function after disassembling;

Step S508: encoding each control flow graph separately, and generating an identifier corresponding to each control flow graph;

Step S510: Collecting identifiers corresponding to all control flow graphs, and generating features of the to-be-detected samples;

Specifically, the principle of step S506 to step S510 can be referred to step S200 to step S204 in the foregoing embodiment of FIG. 2, and details are not described herein again.

Step S512: Calculating a common coding set of the feature of the sample to be detected and the feature in the virus signature database;

Specifically, the embodiment of the present invention performs matching by calculating a common coding set of two features, as shown in the schematic diagram of the feature calculation principle provided by the embodiment of the present invention, and calculates the relationship between the feature A and the feature B. Public coding set. In the embodiment of the present invention, the feature A can be used to refer to the feature of the sample to be detected, and the feature B refers to the feature in the virus feature database.

Step S514: Calculate the similarity between the feature of the sample to be detected and the feature in the virus feature database according to the feature of the sample to be detected and the common code set;

Specifically, the number of identifiers in the common code set may be divided by the number of identifiers in the set corresponding to the feature of the sample to be detected to obtain a similarity; or the number of identifiers in the common code set may be divided by the target identifier. And the number of the target identifiers includes a sum of the number of identifiers in the set corresponding to the feature of the sample to be detected and the number of identifiers in the set corresponding to the feature in the virus signature database. For example:

The similarity between feature A and feature B is calculated: similarity(A, B) = the number of codes of A and B common code / A.

E.g:

Characteristics A={(12,3,4), (5,7,4), (22,11,2), (56,90,5), (32,54,1),(123,34,15 )};

Characteristic B = {(54, 32, 1), (56, 90, 5), (22, 11, 2), (5, 7, 4), (12, 3, 4)};

The common coding set of A and B = {(12, 3, 4), (5, 7, 4), (22, 11, 2), (56, 90, 5)}

Similarity(A,B)=count({(12,3,4),(5,7,4),(22,11,2),(56,90,5)})/count(A)=4 /6=0.67;

or

Similarity(A,B)=count({(12,3,4),(5,7,4),(22,11,2),(56,90,5)})/count(A)+count (B) = 4/11 = 0.36;

Step S516: determining whether the similarity is greater than a preset threshold;

Specifically, the embodiment of the present invention presets a threshold (that is, the preset threshold), and the threshold may set different thresholds based on different calculation algorithms in step S514, and the preset threshold may be selected according to experience or experiment, for example, In the case where the number of identifiers in the common code set is divided by the number of identifiers in the set corresponding to the feature of the sample to be detected, the threshold may be 0.8 or the like, and the number of identifiers in the common code set is divided by the target identifier. In the case where the number is similar, the threshold value may be 0.4 or the like, which is not limited in the present invention.

When the similarity is greater than the preset threshold, the feature corresponding to the sample to be detected is successfully matched with the feature in the virus signature database, and step S518 is performed; otherwise, step S520 is performed.

Step S518: determining that the sample to be detected is a malicious sample;

Step S520: determining that the sample to be detected is a normal sample.

After the embodiment of the present invention is implemented, the control flow graph corresponding to the function is obtained by disassembling the sample to be detected, the control flow graph is encoded, the identifier corresponding to the control flow graph is generated, and then the identifier corresponding to the control flow graph is collected, and the to-be-detected is generated. The characteristics of the sample; finally, the characteristics of the sample to be detected are matched with the features in the virus signature database to perform virus detection, thus solving the problem that the prior art is based on the poor spectral characteristics of the binary content of the virus sample, and the difficulty of virus elimination Low technical problem; the embodiment of the present invention performs virus detection by controlling the structured features of the flow graph based on the function, and treats each function of the sample as a directed graph and encodes it as a feature, thereby taking into account the logic of the program. The process can well resist the interference introduced by the compiler optimization strategy and the interference introduced by the virus author's modification of the source code, which greatly improves the broad spectrum of the feature code and the difficulty of virus elimination.

In order to facilitate the implementation of the above solution of the embodiment of the present invention, the present invention further provides a virus detecting device, which will be described in detail below with reference to the accompanying drawings:

FIG. 7 is a schematic structural diagram of a virus detecting apparatus according to an embodiment of the present invention. The virus detecting apparatus 70 may include: a first disassembly module 700, a first encoding module 702, a set module 704, a feature matching module 706, and a first Determining module 708, wherein

The first disassembly module 700 is configured to disassemble the sample to be detected, and obtain a control flow graph corresponding to the disassembled function;

The first encoding module 702 is configured to encode the obtained control flow graph to generate an identifier corresponding to the control flow graph; the identifiers corresponding to the different control flow graphs are different;

The ensemble module 704 is configured to generate an identifier corresponding to the control flow graph, and generate a feature of the sample to be detected.

Feature matching module 706 is configured to match features of the sample to be detected with features in a virus signature database;

The first determining module 708 is configured to determine that the to-be-detected sample is a malicious sample if the feature of the to-be-detected sample matches the feature in the virus signature database.

Specifically, as shown in the structural diagram of another embodiment of the virus detecting apparatus provided by the present invention, the virus detecting apparatus 70 includes a first disassembling module 700, a first encoding module 702, a set module 704, and a feature matching module. The 706 and the first determining module 708 may further include: a second disassembly module 7010, a second encoding module 7012, a storage module 7014, and a second determining module 7016, where

The second disassembly module 7010 is configured to disassemble the known malicious samples before the feature matching module 706 matches the features of the sample to be detected with the features in the virus signature database, and obtain the corresponding control of the disassembled function. Flow chart

The second encoding module 7012 is configured to encode the control flow graph corresponding to the known malicious sample, and generate an identifier corresponding to the control flow graph;

The storage module 7014 is configured to collect an identifier of the control flow graph corresponding to the known malicious sample, generate a feature of the known malicious sample, and store the feature of the known malicious sample in the virus signature database.

The second determining module 7016 is configured to: after the feature matching module 706 matches the feature of the to-be-detected sample with the feature in the virus signature database, if the feature of the sample to be detected and all features in the virus signature database are If the matching fails, it is determined that the sample to be detected is a normal sample.

It should be noted that the first disassembly module 700 and the first encoding module 702 in the virus detecting device 70 may also perform operations of the second disassembly module 7010 and the second encoding module 7012, that is, the virus detecting device 70. The second disassembly module 7010 and the second encoding module 7012 may also be included, and the first disassembly module 700 may directly match the features of the to-be-detected sample with the features in the virus signature database by the feature matching module 706. The known malicious samples are disassembled, the control flow graph corresponding to the disassembled function is obtained, and each control flow graph is encoded by the first encoding module 702 to generate an identifier corresponding to each control flow graph.

Further, the structure matching module 706 may include a common coding calculation unit 7060, a similarity calculation unit 7062, and a determination unit 7063, where

The common coding calculation unit 7060 is configured to calculate a common coding set of features of the sample to be detected and features in the virus signature database;

The similarity calculation unit 7062 is configured to calculate, according to the feature of the to-be-detected sample and the common coding set, a similarity between a feature of the to-be-detected sample and a feature in a virus signature database;

The determining unit 7063 is configured to determine whether the similarity is greater than a preset threshold;

The similarity calculation unit 7062 may include a first calculation unit or a second calculation unit, where

The first calculating unit is configured to divide the number of the identifiers in the common code set by the number of the identifiers in the set corresponding to the feature of the sample to be detected to obtain a similarity; or

The second calculating unit is configured to divide the number of the identifiers in the common code set by the number of target identifiers to obtain a similarity; the number of target identifiers includes the number of identifiers in the set corresponding to the feature of the sample to be detected, and the The sum of the number of identities in the set corresponding to the feature in the virus signature database.

Further, the first encoding module 702 or the second encoding module 7012 in the embodiment of the present invention may be further configured to encode the control flow graph corresponding to each function into a triplet and use the triplet as the control flow graph. Corresponding identifier; wherein the triplet includes a basic block number of the control flow graph, a number of edges of the control flow graph, and a number of calls in the control flow graph.

In this embodiment, a virus detecting apparatus is further provided, comprising: a processor and a memory for storing a computer program capable of running on a processor, wherein the processor is configured to execute the computer program The steps of the method. Specifically, please refer to FIG. 10. FIG. 10 is a schematic structural diagram of another embodiment of a virus detecting apparatus provided by the present invention. As shown in FIG. 10, the virus detecting apparatus 100 may include: at least one processor 1001, such as a CPU, at least one network interface 1004, a user interface 1003, a memory 1005, at least one communication bus 1002, a display screen 1006, and a camera module 1007. . Among them, the communication bus 1002 is used to implement connection communication between these components. Among them, the user interface 1003 may include a touch screen or the like. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory, and the memory 1005 includes a flash in the embodiment of the present invention. The memory 1005 can also optionally be at least one storage system located remotely from the aforementioned processor 1001. As shown in FIG. 10, an operating system, a network communication module, a user interface module, and a virus detection program may be included in the memory 1005 as a computer storage medium.

In the virus detecting apparatus 100 shown in FIG. 10, the processor 1001 can be used to call the virus detecting program stored in the memory 1005 and perform the following operations:

Matching the feature of the sample to be detected with a feature in the virus signature database; specifically, the virus signature database may be stored in the memory 1005;

Specifically, before the processor 1001 matches the feature of the to-be-detected sample with the feature in the virus signature database, the processor 1001 may further perform:

The identifier corresponding to the control flow graph corresponding to the known malicious sample is collected, the feature of the known malicious sample is generated, and the feature of the known malicious sample is stored in the virus signature database.

Specifically, the processor 1001 matches the feature of the sample to be detected with the feature in the virus signature database, including:

Calculating a common coding set of features of the sample to be detected and features in the virus signature database;

Determining whether the similarity is greater than a preset threshold;

Specifically, the processor 1001 encodes the control flow graph corresponding to the known malicious sample, and generates an identifier corresponding to the control flow graph, including:

Specifically, after the processor 1001 matches the feature of the to-be-detected sample with the feature in the virus signature database, the processor 1001 may further perform:

Specifically, the processor 1001 calculates, according to the feature of the to-be-detected sample and the common coding set, the similarity between the feature of the to-be-detected sample and the feature in the virus signature database, which may include:

It should be noted that the functions of the modules in the virus detecting device 70 or the virus detecting device 100 in the embodiments of the present invention may be corresponding to the specific implementation manners of any of the foregoing embodiments in the foregoing method embodiments, for example, The first disassembly module 700, the first encoding module 702, the aggregation module 704, the feature matching module 706, the first determining module 708, the second disassembling module 7010, the second encoding module 7012, the storage module 7014, and the second determining module 7016 can be implemented by the processor 1001 described above.

Embodiments of the present invention implement a control flow graph corresponding to a function by disassembling a sample to be detected, respectively encoding each control flow graph, generating an identifier corresponding to each control flow graph, and then collecting all control flow graphs corresponding to each Identifying, generating a feature of the sample to be detected; and finally matching the feature of the sample to be detected with a feature in the virus signature database for virus detection. The prior art solves the technical problem that the feature code of the binary content of the virus sample is poor in spectral characteristics, and the virus is not difficult to kill. The embodiment of the present invention performs virus detection by controlling the structured feature of the flow graph based on the function, and each of the samples is The function is treated as a directed graph and encoded as a feature, thus taking into account the logic flow of the program, which can well resist the interference introduced by the compiler optimization strategy and the interference introduced by the virus author's modification of the source code, greatly improving The broad spectrum of signature codes and the difficulty of virus elimination.

The embodiment further provides a computer readable storage medium having stored thereon a computer program, wherein the computer program is executed by the processor to implement the steps of the method described above.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and thus equivalent changes made in the claims of the present invention are still within the scope of the present invention.

Industrial applicability

The embodiment of the invention performs virus detection by controlling the structured features of the flow graph based on the function, and each function of the sample is regarded as a directed graph and encoded as a feature, thereby taking into account the logic flow of the program, which can be very good. The interference introduced by the ground resistance compiler optimization strategy and the interference introduced by the virus author's modification of the source code greatly improve the broad spectrum of the feature code and the difficulty of virus elimination.

Claims

A virus detection method comprising:

Disassemble the test sample to obtain a control flow graph corresponding to the disassembled function;

Encoding the obtained control flow graph to generate an identifier corresponding to the control flow graph; the identifiers corresponding to the different control flow graphs are different;

Collecting an identifier corresponding to the control flow graph to generate a feature of the sample to be detected;

Matching characteristics of the sample to be detected with features in a virus signature database;

If the feature of the sample to be detected matches the feature in the virus signature database, the sample to be detected is determined to be a malicious sample.
The method of claim 1, wherein before the matching the feature of the sample to be detected with the feature in the virus signature database, the method further comprises:

Disassemble the known malicious samples and obtain the control flow graph corresponding to the disassembled function;

Encoding the control flow graph corresponding to the known malicious sample, and generating an identifier corresponding to the control flow graph;

The identifiers of the control flow graphs corresponding to the known malicious samples are collected, the features of the known malicious samples are generated, and the features of the known malicious samples are stored in the virus signature database.
The method of claim 2, wherein the encoding the control flow graph corresponding to the known malicious sample to generate the identifier corresponding to the control flow graph comprises:

The control flow graph corresponding to each function is encoded into a triplet, and the triplet is used as an identifier corresponding to the control flow graph, wherein the triplet includes the basic block number of the control flow graph and the number of edges of the control flow graph And the number of calls in the control flow graph.
The method of claim 1, wherein after the matching the feature of the sample to be detected with the feature in the virus signature database, the method further comprises:

If the feature of the sample to be detected fails to match all the features in the virus signature database, it is determined that the sample to be detected is a normal sample.
The method according to any one of claims 1 to 4, wherein the matching the feature of the sample to be detected with the feature in the virus signature database comprises:

Calculating a common coding set of the feature of the sample to be detected and one of the features in the virus signature database;

Calculating a similarity between the feature of the sample to be detected and the feature in the virus feature database according to the feature of the sample to be detected and the common code set;

Determining whether the similarity is greater than a preset threshold;

When the similarity is greater than the preset threshold, determining that the feature of the sample to be detected matches the feature in the virus signature database is successful.
The method according to claim 5, wherein the calculating the similarity between the feature of the sample to be detected and the feature in the virus feature library according to the feature of the sample to be detected and the common code set, including :

Comparing the number of identifiers in the common code set by the number of identifiers in the set corresponding to the feature of the sample to be detected, to obtain a similarity; or

And dividing the number of the identifiers in the common code set by the number of target identifiers to obtain a similarity; the number of target identifiers includes the number of identifiers in the set corresponding to the feature of the sample to be detected, and the number in the virus signature database The sum of the number of identities in the set corresponding to the feature.
A virus detecting device comprising:

a first disassembly module configured to disassemble the sample to be detected, and obtain a control flow graph corresponding to the disassembled function;

The first encoding module is configured to encode the obtained control flow graph to generate an identifier corresponding to the control flow graph; the identifiers corresponding to the different control flow graphs are different;

The ensemble module is configured to: collect an identifier corresponding to the control flow graph, and generate a feature of the sample to be detected;

a feature matching module configured to match characteristics of the sample to be detected with features in a virus signature database;

The first determining module is configured to determine that the to-be-detected sample is a malicious sample if the feature of the to-be-detected sample matches the feature in the virus signature database.
The apparatus of claim 7 further comprising:

a second disassembly module configured to disassemble the known malicious samples before the feature matching module matches the features of the sample to be detected with the features in the virus signature database, and obtain a function corresponding to the disassembled function Control flow graph;

The second encoding module is configured to encode the control flow graph corresponding to the known malicious sample, and generate an identifier corresponding to the control flow graph;

And a storage module configured to collect an identifier of the control flow graph corresponding to the known malicious sample, generate a feature of the known malicious sample, and store the feature of the known malicious sample in the virus signature database.
The apparatus according to claim 8, wherein the first encoding module is further configured to encode a control flow graph corresponding to each function into a triplet, and use the triplet as an identifier corresponding to the control flow graph; The triplet includes the basic block number of the control flow graph, the number of edges of the control flow graph, and the number of calls in the control flow graph.
The apparatus of claim 7 further comprising:

a second determining module, configured to: after the feature matching module matches the feature of the to-be-detected sample with the feature in the virus signature database, if the feature of the sample to be detected and all the features in the virus signature database If the matching fails, it is determined that the sample to be detected is a normal sample.
The apparatus of any of claims 7-10, wherein the feature matching module comprises:

a common coding calculation unit configured to calculate a common coding set of the feature of the sample to be detected and a feature in the virus signature database;

a similarity calculation unit, configured to calculate, according to the feature of the to-be-detected sample and the common coding set, a similarity between a feature of the to-be-detected sample and a feature in a virus signature database;

a determining unit, configured to determine whether the similarity is greater than a preset threshold;

When the similarity is greater than the preset threshold, determining that the feature of the sample to be detected matches the feature in the virus signature database is successful.
The apparatus of claim 11, wherein the similarity calculation unit comprises:

a first calculating unit, configured to divide the number of identifiers in the common code set by the number of identifiers in the set corresponding to the feature of the sample to be detected, to obtain a similarity; or

a second calculating unit, configured to divide the number of the identifiers in the common code set by the number of target identifiers to obtain a similarity; the number of target identifiers includes the number of identifiers in the set corresponding to the feature of the sample to be detected, and the The sum of the number of identities in the set corresponding to the feature in the virus signature database.
A virus detection method comprising:

The virus detecting device disassembles the detected sample, and obtains a control flow graph corresponding to the disassembled function;

The virus detecting device encodes the obtained control flow graph to generate an identifier corresponding to the control flow graph; the identifiers corresponding to the different control flow graphs are different;

The virus detecting device collects an identifier corresponding to the flow graph, and generates a feature of the sample to be detected;

The virus detecting device matches characteristics of the sample to be detected with features in a virus signature database;

If the feature of the sample to be detected matches the feature in the virus signature database, the virus detecting device determines that the sample to be detected is a malicious sample.
A virus detecting apparatus comprising: a processor and a memory for storing a computer program executable on a processor, wherein the processor is configured to execute the method of claims 1 to 6 when the computer program is run.
A computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the method of claims 1 to 6.