WO2021223177A1 - 异常文件检测方法及相关产品 - Google Patents

异常文件检测方法及相关产品 Download PDF

Info

Publication number
WO2021223177A1
WO2021223177A1 PCT/CN2020/089033 CN2020089033W WO2021223177A1 WO 2021223177 A1 WO2021223177 A1 WO 2021223177A1 CN 2020089033 W CN2020089033 W CN 2020089033W WO 2021223177 A1 WO2021223177 A1 WO 2021223177A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
file
access relationship
access
relationship graph
Prior art date
Application number
PCT/CN2020/089033
Other languages
English (en)
French (fr)
Inventor
蔡杰
沈璐
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to PCT/CN2020/089033 priority Critical patent/WO2021223177A1/zh
Priority to CN202080099571.9A priority patent/CN115398861B/zh
Publication of WO2021223177A1 publication Critical patent/WO2021223177A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • This application relates to the computer field, and specifically relates to an abnormal file detection method and related products.
  • a webshell is a command execution environment in the form of web files such as asp, php, jsp, or cgi. It can also be called a web backdoor. After hackers invade a website, they usually mix the asp or php backdoor files with the normal webpage files in the web directory of the website server, and then they can use the browser to access the asp or php backdoor and get a command execution environment to achieve The purpose of controlling the web server, however, webshell is an abnormal file, but the detection efficiency of abnormal files is low. Therefore, the problem of how to improve the detection efficiency of abnormal files needs to be solved urgently.
  • the embodiments of the present application provide an abnormal file detection method and related products, which can improve the efficiency of abnormal file detection.
  • an abnormal file detection method applied to an electronic device, includes:
  • the target access relationship is at least one of the following: access relationship between files and files and IP The access relationship between addresses;
  • the target suspicious file is detected to obtain a detection result, and the detection result is output.
  • an embodiment of the present application provides an abnormal file detection device, which is applied to an electronic device, and the device includes: an acquisition unit, a determination unit, an extraction unit, and a detection unit, wherein:
  • the acquiring unit is configured to acquire the in and out traffic data of all hosts within a preset range, and extract a target access relationship from the in and out traffic data, and the target access relationship is at least one of the following: files and files The access relationship and the access relationship between the file and the IP address;
  • the determining unit is configured to determine an access relationship graph according to the target access relationship
  • the extraction unit is configured to extract the target suspicious file according to the access relationship graph
  • the detection unit is configured to detect the target suspicious file, obtain a detection result, and output the detection result.
  • an embodiment of the present application provides an electronic device, including a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and are configured by the above Executed by the processor, and the foregoing program includes instructions for executing the steps in the first aspect of the embodiments of the present application.
  • an embodiment of the present application provides a computer-readable storage medium, wherein the above-mentioned computer-readable storage medium stores a computer program for electronic data exchange, wherein the above-mentioned computer program enables a computer to execute Some or all of the steps described in one aspect.
  • the embodiments of the present application provide a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute as implemented in this application.
  • the computer program product may be a software installation package.
  • FIG. 1A is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • FIG. 1B is a schematic diagram of the architecture for implementing an abnormal file detection method provided by an embodiment of the present application
  • FIG. 1C is a schematic flowchart of an abnormal file detection method disclosed in an embodiment of the present application.
  • FIG. 1D is a schematic diagram illustrating an access relationship diagram disclosed in an embodiment of the present application.
  • FIG. 1E is a schematic diagram showing another access relationship diagram disclosed in an embodiment of the present application.
  • FIG. 1F is a schematic flowchart of the naive Bayes classification process disclosed in an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of another abnormal file detection method disclosed in an embodiment of the present application.
  • Fig. 3 is a schematic structural diagram of another electronic device disclosed in an embodiment of the present application.
  • Fig. 4 is a schematic structural diagram of an abnormal file detection device disclosed in an embodiment of the present application.
  • the electronic devices involved in the embodiments of this application may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices (smart watches, wireless headsets), computing devices or other processing devices connected to wireless modems, and various Various forms of user equipment (user equipment, UE), mobile station (mobile station, MS), terminal equipment (terminal device), and so on.
  • user equipment user equipment
  • MS mobile station
  • terminal device terminal device
  • the electronic device can also be a server, a gateway, or a smart home device.
  • Smart home equipment can be at least one of the following: smart speakers, smart cameras, smart rice cookers, smart wheelchairs, smart massage chairs, smart furniture, smart dishwashers, smart TVs, smart refrigerators, smart electric fans, smart heaters, smart Drying racks, smart lights, smart routers, smart switches, smart switch panels, smart humidifiers, smart air conditioners, smart doors, smart windows, smart stoves, smart disinfection cabinets, smart toilets, sweeping robots, etc., are not limited here .
  • FIG. 1A is a schematic structural diagram of an electronic device disclosed in an embodiment of the present application.
  • the electronic device 100 may include a control circuit, and the control circuit may include a storage and processing circuit 110.
  • the storage and processing circuit 110 can be a memory, such as a hard disk drive memory, a non-volatile memory (such as flash memory or other electronic programmable read-only memory used to form a solid-state drive, etc.), and a volatile memory (such as a static or dynamic random access memory). Access to memory, etc.), etc., are not limited in the embodiment of the present application.
  • the processing circuit in the storage and processing circuit 110 may be used to control the operation of the electronic device 100.
  • the processing circuit can be implemented based on one or more microprocessors, microcontrollers, baseband processors, power management units, audio codec chips, application specific integrated circuits, display driver integrated circuits, and so on.
  • the storage and processing circuit 110 can be used to run software in the electronic device 100, such as Internet browsing applications, voice over internet protocol (VOIP) phone call applications, email applications, media playback applications, and operating system functions Wait. These softwares can be used to perform some control operations, for example, camera-based image capture, ambient light measurement based on ambient light sensors, proximity sensor measurement based on proximity sensors, and information based on status indicators such as the status indicators of light-emitting diodes.
  • software in the electronic device 100 such as Internet browsing applications, voice over internet protocol (VOIP) phone call applications, email applications, media playback applications, and operating system functions Wait.
  • VOIP voice over internet protocol
  • These softwares can be used to perform some control operations, for example, camera-based image capture, ambient light measurement based on ambient light sensors, proximity sensor measurement based on proximity sensors, and information based on status indicators such as the status indicators of light-emitting diodes.
  • Display functions touch event detection based on touch sensors, functions associated with displaying information on multiple (for example, layered) displays, operations associated with performing wireless communication functions, operations associated with collecting and generating audio signals ,
  • the control operations associated with the collection and processing of button press event data, as well as other functions in the electronic device 100, are not limited in the embodiment of the present application.
  • the electronic device 100 may further include an input-output circuit 150.
  • the input-output circuit 150 can be used to enable the electronic device 100 to input and output data, that is, to allow the electronic device 100 to receive data from an external device and also to allow the electronic device 100 to output data from the electronic device 100 to the external device.
  • the input-output circuit 150 may further include a sensor 170.
  • the sensor 170 may include an ambient light sensor, a proximity sensor based on light and capacitance, and a touch sensor (for example, a light-based touch sensor and/or a capacitive touch sensor.
  • the touch sensor structure is used independently), acceleration sensor, gravity sensor, and other sensors.
  • the input-output circuit 150 may also include one or more displays, such as the display 130.
  • the display 130 may include one or a combination of a liquid crystal display, an organic light emitting diode display, an electronic ink display, a plasma display, and a display using other display technologies.
  • the display 130 may include a touch sensor array (ie, the display 130 may be a touch display screen).
  • the touch sensor can be a capacitive touch sensor formed by an array of transparent touch sensor electrodes (such as indium tin oxide (ITO) electrodes), or it can be a touch sensor formed using other touch technologies, such as sonic touch, pressure-sensitive touch, and resistance. Touch, optical touch, etc., are not limited in the embodiment of the present application.
  • the audio component 140 may be used to provide audio input and output functions for the electronic device 100.
  • the audio component 140 in the electronic device 100 may include a speaker, a microphone, a buzzer, a tone generator, and other components for generating and detecting sounds.
  • the communication circuit 120 may be used to provide the electronic device 100 with the ability to communicate with external devices.
  • the communication circuit 120 may include analog and digital input-output interface circuits, and wireless communication circuits based on radio frequency signals and/or optical signals.
  • the wireless communication circuit in the communication circuit 120 may include a radio frequency transceiver circuit, a power amplifier circuit, a low noise amplifier, a switch, a filter, and an antenna.
  • the wireless communication circuit in the communication circuit 120 may include a circuit for supporting near field communication (NFC) by transmitting and receiving near-field coupled electromagnetic signals.
  • the communication circuit 120 may include a near field communication antenna and a near field communication transceiver.
  • the communication circuit 120 may also include a cellular phone transceiver and antenna, a wireless local area network transceiver circuit and antenna, and so on.
  • the electronic device 100 may further include a battery, a power management circuit, and other input-output units 160.
  • the input-output unit 160 may include buttons, joysticks, click wheels, scroll wheels, touch pads, keypads, keyboards, cameras, light emitting diodes, and other status indicators.
  • the user can input commands through the input-output circuit 150 to control the operation of the electronic device 100, and can use the output data of the input-output circuit 150 to realize receiving status information and other outputs from the electronic device 100.
  • webshell detection methods can be divided into three main categories: static detection, dynamic detection, and log analysis.
  • Static detection judges whether it is a webshell by matching the static attributes of the file such as signature, signature value, and dangerous function.
  • the common static detection method is rule matching, such as yara matching. The perfection of the rule will greatly affect the accuracy and false negative rate of detection.
  • static detection is to use strong and weak feature matching: a rule that hits a strong feature is considered to be a webshell, and a rule that hits a weak feature is left to humans to judge whether it is a misjudgment or a webshell.
  • Dynamic detection is to upload a file to the server. The characteristics displayed when the file is executed are called dynamic characteristics. The server determines whether the file is a webshell by monitoring various dynamic characteristics.
  • the principle of log detection is that webshell will leave webshell access data and data submission records in the web log.
  • a request model can be established through a large number of log files to detect abnormal files.
  • FIG. 1B provides a system architecture for implementing the method involved in the embodiment of this application.
  • the method involved in the embodiment of this application can be applied to the server, server and host side.
  • the server can communicate with each other to obtain suspicious files (webshell target files) uploaded by electronic devices.
  • the server can include a suspicious file separation engine, an opcode extraction engine, and a machine learning engine.
  • the suspicious file separation engine can be used to separate suspicious files.
  • the opcode extraction engine can be used to extract machine code (opcode) from the suspicious file
  • the machine learning engine can perform operations on the machine code to obtain the final detection result.
  • the embodiments of the present application can be applied to the host security product sentry, which is divided into two major parts: the host side and the server side (as shown in FIG. 1B).
  • the host side can run a file upload module to receive instructions from the server and upload specified files.
  • the server side can include three parts: the suspicious file separation engine, the opcode extraction engine, and the machine learning engine.
  • the suspicious file detection process can be serially detected by the server.
  • the suspicious file separation engine which can be deployed on a separate server, can obtain the in and out traffic data of all hosts from the gateway, extract the access relationship between files and files, and file and IP, and draw them into an access relationship diagram, and from the access relationship diagram Separate the suspicious file, and send an instruction to the host of the suspicious file to prompt the host to send the suspicious file to the server.
  • the host is only responsible for receiving instructions from the server and uploading files in the specified directory to the server. This method basically occupies zero resources on the host, ensuring the normal operation of host services to the greatest extent.
  • the opcode extraction engine obtains this part of the file and extracts the opcode of the executable file, sends it to the machine learning engine, and the machine learning engine judges it and obtains the final result.
  • an abnormal file detection method which is applied to an electronic device and may include the following steps:
  • the target access relationship is at least one of the following: access relationship between files and files and IP The access relationship between addresses;
  • the target suspicious file is detected to obtain a detection result, and the detection result is output.
  • the abnormal file detection method described in the embodiment of the present application is applied to electronic equipment to obtain the in and out traffic data of all hosts within a preset range, and extract the target access relationship from the in and out traffic data, and the target access relationship At least one of the following: the access relationship between the file and the file and the access relationship between the file and the IP address, the access relationship graph is determined based on the target access relationship, the target suspicious file is extracted based on the access relationship graph, and the target suspicious file is detected , To obtain the detection result, and output the detection result. Since the access relationship graph is sorted out through the access relationship, the abnormal file can be quickly found through the access relationship graph, and the abnormal file can be detected abnormally. In this way, the detection efficiency of the abnormal file can be improved .
  • FIG. 1C is a schematic flowchart of an abnormal file detection method provided by an embodiment of the present application.
  • the abnormal file detection method described in this embodiment is applied to the electronic device shown in FIG. 1A or the electronic device shown in FIG. 1B System architecture, the abnormal file detection method includes:
  • the preset range can be set by the user or the system defaults.
  • the electronic device and all hosts are in the same local area network, for example, a city, that is, all hosts are in the same city.
  • the electronic device is a server, it can obtain the in and out traffic data of all hosts within the preset range through the gateway.
  • the electronic device is not a server, for example, when the electronic device is a gateway, it can obtain the in and out traffic data of all hosts within the preset range. Traffic data.
  • the electronic device can obtain the in and out traffic data of all hosts within the preset range, and extract the target access relationship from the in and out traffic data, and the target access relationship may be at least one of the following: file-to-file access Relationships and access relationships between files and IP addresses.
  • a device can connect to or interact with other devices through an IP address. For example, you can enter a web page, click on a link below the web page, and then , Can extract the access sequence between file and file, file and IP address to get target access relationship.
  • step 101 obtaining inbound and outbound traffic data of all hosts within a preset range, may include the following steps:
  • the display screen of the electronic device can display the host distribution map, which is used to display the distribution of the host.
  • the electronic device can receive the touch track, and the touch track can be obtained by the user's touch operation, for example, touch The pen realizes touch, or the finger touches, the touch track can form a closed area, and then, the electronic device can obtain the in and out traffic data of all hosts within the closed area in the host distribution map.
  • the electronic device can generate an access relationship graph based on the access relationship, and the access relationship graph may be a directed graph. Assuming that v and w are the two vertices of the access relationship graph, then v->w represents an edge from v to w. In a directed graph, the relationship between two vertices may have the following four situations:
  • FIG. 1D provides an access relationship graph.
  • Each vertex of the access relationship graph can be a file or an IP address, and a1, a2, ..., a10 are the vertices of the access relationship graph.
  • step 102 determining the access relationship graph according to the target access relationship, may include the following steps:
  • the electronic device can extract the first file identifier, the first IP address, and the access relationship in the target access relationship.
  • the electronic device can determine the access relationship graph according to the second file ID, the second IP address, and the access direction, that is, the second file can be processed according to the access direction.
  • the identifier and the second IP are connected by arrows to obtain an access relationship graph.
  • the server may extract the target suspicious file according to the access relationship graph through the suspicious file separation engine, and the target suspicious file may be located in at least one of the above-mentioned hosts.
  • the target suspicious file can be a webshell file.
  • the main principle of the suspicious file separation engine can be to draw a directed graph based on the relationship between files and files, and files and IPs to filter out suspicious files.
  • the difference between a directed graph and an undirected graph is that its edges are unidirectional, the two vertices connected by each edge are an ordered pair, and their adjacency is unidirectional.
  • a directed edge is pointed by the first vertex and points to the second vertex, the out degree of a vertex is the total number of edges pointed out by the vertex; the in degree of a vertex is the edge pointing to the vertex total.
  • each file forms a group because of its access relationship with other files or IP, and files with complex access relationships form a large group. The less related ones form a small group.
  • the webshell file Due to the independence of the webshell file, the webshell file will form a single point that only has access to a specific few IPs, and then finally these single points (that is, suspicious files) will be uploaded to In the cloud, further testing is performed.
  • the access volume of files such as index files, etc.
  • access to the cluster will result in a particularly large amount of calculation in data processing, and may even cause the server to crash.
  • the white point such as defining the home page file as a white point file, and the default file or IP that interacts with the white point is a normal file, and it is not displayed on the map, then only the white point needs to be processed. Files that are irrelevant can be used.
  • the white point setting it can be automatically set to automatically convert to a white point when the access volume of a certain web file reaches a certain threshold, which greatly reduces the amount of calculation on the server.
  • step 103 extracting the target suspicious file according to the access relationship graph, may include the following steps:
  • the access relationship graph is a directed graph and the access relationship graph includes multiple vertices;
  • the aforementioned preset threshold can be set by the user or the system defaults.
  • the electronic device can determine the number of interactive objects at each vertex in the access relationship graph according to the access relationship graph, and obtain multiple values.
  • the access relationship graph is a directed graph and the access relationship graph includes multiple vertices, which can be files or IPs.
  • the address and the interaction object may also be a vertex, and further, a target value smaller than a preset threshold may be selected from a plurality of values, and a file corresponding to the target value may be obtained as the target suspicious file.
  • obtaining the file corresponding to the target value as the target suspicious file may include the following steps:
  • the electronic device may send an acquisition instruction to the target host corresponding to the target value.
  • the acquisition instruction may be used to acquire at least one file related to the target host in the in and out traffic data, and the target host may send the at least one file to the electronic device.
  • the electronic device can receive at least one file fed back by the target host, and can extract the target suspicious file from the at least one file.
  • the electronic device may detect the target suspicious file to obtain the detection result, and the detection result may be that the target suspicious file is an abnormal file, or the target suspicious file is not an abnormal file.
  • the above step 104 detecting the target suspicious file to obtain the detection result, may include the following steps:
  • the target opcode is opcoe
  • opcode is the system opcode
  • the interpreter execution process is to execute the smallest optimized opcode in a basic unit op_array, traverse the execution in order, execute the current opcode, and prefetch the next opcode , Until the last RETRUN this special opcode returns and exits.
  • the opcode processing engine is specially used to process the files from the first part, extract the opcodes of these executable files, and save and send them back to the cloud. Now most types of executable files have corresponding opcode extraction plug-ins. Take php as an example, php has the vld extension tool.
  • the preset machine learning model may be at least one of the following: neural network model, genetic algorithm model, Bayesian classification algorithm, etc.
  • the neural network model is not limited here, and may be at least one of the following: all The connection neural network model, cyclic neural network model, convolutional neural network model, spiking neural network model, etc. are not limited here.
  • the electronic device can obtain the target operation code of the target suspicious file.
  • the target suspicious file can be parsed to obtain the target operation code.
  • the target operation code can be input to the preset machine learning model to obtain the detection result .
  • the preset machine learning model may use the naive Bayesian supervision algorithm, and the electronic device may use the naive Bayesian supervision algorithm to detect the extracted opcode.
  • Bayesian classification algorithm is a general term for a class of algorithms, all based on Bayes' theorem, and the naive Bayes algorithm is a very commonly used Bayesian classification algorithm.
  • the principle of the naive Bayes algorithm is to put it simply: for a given item to be classified, the probability of each category appearing under the condition of the occurrence of the item is solved, and the item is considered to belong to which category which is the largest (the mathematical derivation process here Skip).
  • the Naive Bayes classification process can be represented by Figure 1F:
  • steps S1 and S2 are the preparatory work stages. At this stage, it is necessary to determine the characteristics of the opcode of webshell.
  • the opcode of webshell generally appears in the form of combinations. Among them, some specific combinations are rarely seen in normal files. And it often appears in webshell, therefore, the combination of various opcodes is used as a feature;
  • steps S3 and S4 are the classifier training stage.
  • the task of this stage is to calculate the frequency of each category in the training sample and the probability estimation of each feature attribute division for each category, and record the result.
  • the input is Feature attributes and training samples, the output is a classifier;
  • steps S5 and S6 are the application stage.
  • the opcode extracted from the suspicious file uploaded on the host side is put into the trained model, and the judgment result is output;
  • judgment result of opcode corresponds to the judgment result of the original executable file.
  • judgment result is stored in the database and reported to the host, and the host decides whether to process these acceptable files.
  • X is a feature attribute
  • Y is a category
  • i is any category.
  • Different features can correspond to different categories.
  • webshell can be identified with a faster speed, lower host resource occupation and higher accuracy, and the three engines at the back end can be distributed on different servers, to a certain extent The above improves the detection efficiency of webshell.
  • inputting the target operation code into a preset machine learning model to obtain the detection result may include the following steps:
  • the target feature parameter can be understood as the feature parameter of the opcode, which can be used to express the feature of the opcode.
  • the electronic device can extract the feature of the target opcode to obtain the target feature parameter, and then the target feature The parameters are input to the preset machine learning model, and the detection result is obtained.
  • the use of the above detection method can take advantage of each engine, and there are three major benefits.
  • the host resource occupies less.
  • This detection system does not need to deploy a more complicated and cumbersome webshell detection system on the host, which greatly reduces the resource occupation of irrelevant services and ensures the normal operation of online services to the greatest extent.
  • Suitable for large-scale enterprises secondly, it has a high detection rate for deformed, encrypted, and obfuscated webshells, that is, it has a high detection rate for webshells.
  • the abnormal file detection method mentioned in the embodiment of the present application addresses the problem of low accuracy of static detection and the problem of large resource occupation and slow speed of dynamic detection. It can identify webshells with high accuracy while maintaining high speed and low resource usage.
  • the embodiment of the application adopts the method of extracting opcode judgment.
  • the opcode is generated when the file is dynamically executed. It also has a good killing rate for encrypted, obfuscated, and deformed webshells.
  • the embodiment of this application puts the main calculation work on the server.
  • the server will draw a directed graph based on the host traffic and filter out suspicious files.
  • the host side only needs to follow the server's instructions. Uploading the corresponding suspicious files to the server for judgment, the whole process hardly occupies host resources, and will not affect the business on the host. And because suspicious files are filtered and processed before entering the machine learning engine, the detection speed of the machine learning engine can also be improved.
  • step 102 after determining the access relationship graph based on the target access relationship, and step 103, before extracting the target suspicious file based on the access relationship graph, may further include the following steps:
  • the electronic device can detect isolated vertices of the access relationship graph. When there are isolated vertices in the access relationship graph, it indicates that there may be an abnormal file, and step 103 can be executed; otherwise, it indicates that the system is safe and step 103 may not be executed.
  • step 101 the following steps may also be included:
  • the preset security level can be set by the user or the system defaults.
  • the network parameters can be at least one of the following: network load, number of vulnerabilities, number of abnormal accesses, etc., which are not limited here.
  • Each network parameter can correspond to a weight.
  • the target network parameter can include multiple networks. Parameters, and further, weighting operations can be performed according to each network parameter and the corresponding weight of the target network parameters to obtain the corresponding target network evaluation value, and the target can be determined according to the mapping relationship between the preset network evaluation value and the security level
  • the target security level corresponding to the network evaluation value, and when the target security level is lower than the preset security level, step 101 may be performed, otherwise, step 101 may not be performed. In this way, abnormal file detection can be performed when a network security crisis occurs.
  • step 101 the following steps may also be included:
  • the target emotion type is the preset emotion type
  • the physiological state parameters may be various parameters used to reflect the physiological functions of the user, and the physiological state parameters may be at least one of the following: heart rate, blood pressure, blood temperature, blood lipid content, blood glucose content, and thyroxine content , Adrenaline content, platelet content, blood oxygen content, etc., are not limited here.
  • the preset emotion type can be set by the user or the system defaults. The preset emotion type can be at least one of the following: dull, crying, calm, irritable, excited, depressed, etc., which are not limited here.
  • the electronic device can obtain the user's target physiological state parameters through a wearable device that can communicate with the electronic device.
  • Different physiological state parameters reflect the user's emotional type.
  • the electronic device can pre-store the physiological state parameters and emotions.
  • the mapping relationship between the types, and further, the target emotion type corresponding to the target physiological state parameter can be determined according to the mapping relationship, and further, when the target emotion type is the preset emotion type, step 101 may be executed, otherwise, step 101 may not be executed 101.
  • the above step C1 determining the target emotion type corresponding to the target physiological state parameter, can be implemented in the following manner:
  • C14 Determine the target first emotion value corresponding to the target heart rate level according to the preset mapping relationship between the heart rate level and the first emotion value;
  • C17 Determine the target weight pair corresponding to the target heart rate level according to the preset mapping relationship between the heart rate level and the weight value pair, and the weight value pair includes a first weight value and a second weight value.
  • a weight value is a weight value corresponding to the first emotion value
  • the second weight value is a weight value corresponding to the second emotion value;
  • the specified time period can be set by the user or the system defaults.
  • the electronic device can pre-store the mapping relationship between the preset heart rate level and the first emotion value, and the preset mean square error and the second emotion value.
  • the mapping relationship, and the mapping relationship between the preset heart rate level and the weight value pair, and the mapping relationship between the preset emotion value and the emotion type, the above weight value pair may include a first weight value and a second weight value,
  • the first weight value is the weight value corresponding to the first sentiment value
  • the second weight value is the weight value corresponding to the second sentiment value.
  • the sum of the first weight value and the second weight value can be 1, and the first weight value ,
  • the value range of the second weight is 0 ⁇ 1.
  • the emotion can be evaluated by the heart rate change curve.
  • the electronic device can sample the heart rate curve.
  • the specific sampling method can be: uniform sampling or random sampling to obtain multiple heart rate values, and the average heart rate can be calculated based on the multiple heart rate values to obtain the average heart rate value.
  • the mapping relationship between the heart rate value and the heart rate level can be stored in advance, and then the target heart rate level corresponding to the average heart rate value can be determined according to the mapping relationship, and further, can be based on the preset heart rate level and the first emotional value.
  • the mapping relationship is used to determine the target first emotion value corresponding to the target heart rate level.
  • the mean square error operation can be performed on multiple heart rate values to obtain the target mean square error, and the target mean square error can be calculated according to the preset mean square error and the second emotion value.
  • the mapping relationship determines the target second sentiment value corresponding to the target mean square error.
  • the electronic device may also determine a target weight pair corresponding to the target heart rate level according to the above-mentioned preset mapping relationship between the heart rate level and the weight value pair, and the target weight value pair may include the target first weight value and the target first weight value.
  • a weight value, the target first weight value is the weight value corresponding to the target first emotion value
  • the target second weight value is the weight value corresponding to the target second emotion value.
  • the electronic device can be based on the target first emotion value and the target first emotion value.
  • the second emotional value, the first weight of the target and the second weight of the target are weighted to obtain the final emotional value.
  • the specific calculation formula is as follows:
  • the target emotion type corresponding to the target emotion value can be determined according to the foregoing preset mapping relationship between the emotion value and the emotion type.
  • the above average heart rate reflects the user's heart rate value
  • the mean square error of the heart rate reflects the stability of the heart rate
  • the user's emotion is reflected through the two dimensions of the average heart rate and the mean square error, and the user's emotion type can be accurately determined.
  • the abnormal file detection method described in the embodiment of the present application is applied to electronic equipment to obtain the in and out traffic data of all hosts within a preset range, and extract the target access relationship from the in and out traffic data, and the target access relationship At least one of the following: the access relationship between the file and the file and the access relationship between the file and the IP address, the access relationship graph is determined based on the target access relationship, the target suspicious file is extracted based on the access relationship graph, and the target suspicious file is detected , Get the detection result, and output the detection result. Because the access relationship graph is sorted out through the access relationship, the abnormal file can be quickly found through the access relationship graph, and the abnormal file can be detected abnormally. In this way, the detection efficiency of the abnormal file can be improved. .
  • FIG. 2 is a schematic flowchart of another abnormal file detection method provided by an embodiment of the present application.
  • the abnormal file detection method described in this embodiment is applied to the electronic device as shown in FIG. 1A Or the system architecture shown in FIG. 1B, the method may include the following steps:
  • the target security level is lower than the preset security level, obtain the in and out traffic data of all hosts within the preset range, and extract the target access relationship from the in and out traffic data, where the target access relationship is as follows At least one: the access relationship between the file and the file and the access relationship between the file and the IP address.
  • the abnormal file detection method described in the embodiment of the present application is applied to electronic equipment to obtain the in and out traffic data of all hosts within a preset range, and extract the target access relationship from the in and out traffic data, and the target access relationship At least one of the following: the access relationship between the file and the file and the access relationship between the file and the IP address, the access relationship graph is determined based on the target access relationship, the target suspicious file is extracted based on the access relationship graph, and the target suspicious file is detected , Get the detection result, and output the detection result. Because the access relationship graph is sorted out through the access relationship, the abnormal file can be quickly found through the access relationship graph, and the abnormal file can be detected abnormally. In this way, the detection efficiency of the abnormal file can be improved. .
  • the following is a device for implementing the above abnormal file detection method, which is specifically as follows:
  • FIG. 3 is an electronic device provided by an embodiment of the present application, including: a processor and a memory; and one or more programs, the one or more programs are stored in the In the memory and configured to be executed by the processor, the program includes instructions for executing the following steps:
  • the target access relationship is at least one of the following: access relationship between files and files and IP The access relationship between addresses;
  • the target suspicious file is detected to obtain a detection result, and the detection result is output.
  • the electronic device described in the embodiment of the present application obtains the in and out traffic data of all hosts within a preset range, and extracts the target access relationship from the in and out traffic data, and the target access relationship is at least one of the following: file The access relationship with the file and the access relationship between the file and the IP address. Determine the access relationship graph based on the target access relationship, extract the target suspicious file based on the access relationship graph, detect the target suspicious file, get the detection result, and output According to the detection result, since the access relationship graph is sorted out through the access relationship, the abnormal file can be quickly searched through the access relationship graph, and abnormality detection can be performed on the abnormal file. In this way, the detection efficiency of the abnormal file can be improved.
  • the program includes instructions for executing the following steps:
  • the program includes instructions for executing the following steps:
  • the target feature parameter is input to the preset machine learning model to obtain the detection result.
  • the program includes instructions for executing the following steps:
  • the access relationship graph is a directed graph and the access relationship graph includes multiple vertices;
  • a target value smaller than a preset threshold is selected from the multiple values, and a file corresponding to the target value is obtained as the target suspicious file.
  • the program includes instructions for executing the following steps:
  • the program includes instructions for executing the following steps:
  • the access relationship graph is determined according to the second file identifier, the second IP address, and the access direction.
  • the program includes instructions for executing the following steps:
  • the program further includes instructions for executing the following steps :
  • the step of extracting the target suspicious file according to the access relationship graph is performed.
  • the program further includes instructions for executing the following steps:
  • the step of acquiring the inbound and outbound traffic data of all hosts within the preset range is executed.
  • FIG. 4 is a schematic structural diagram of an abnormal file detection device provided by this embodiment.
  • the abnormal file detection device is applied to the electronic device shown in FIG. 1A or the system architecture shown in FIG.
  • the acquiring unit 401 is configured to acquire in and out traffic data of all hosts within a preset range, and extract a target access relationship from the in and out traffic data, where the target access relationship is at least one of the following: The access relationship between files and the access relationship between files and IP addresses;
  • the determining unit 402 is configured to determine an access relationship graph according to the target access relationship
  • the extraction unit 403 is configured to extract the target suspicious file according to the access relationship graph
  • the detection unit 404 is configured to detect the target suspicious file, obtain a detection result, and output the detection result.
  • the abnormal file detection device described in the embodiment of this application is applied to electronic equipment to obtain the in and out traffic data of all hosts within a preset range, and extract the target access relationship from the in and out traffic data, and the target access relationship At least one of the following: the access relationship between the file and the file and the access relationship between the file and the IP address, the access relationship graph is determined based on the target access relationship, the target suspicious file is extracted based on the access relationship graph, and the target suspicious file is detected , Get the detection result, and output the detection result. Because the access relationship graph is sorted out through the access relationship, the abnormal file can be quickly found through the access relationship graph, and the abnormal file can be detected abnormally. In this way, the detection efficiency of the abnormal file can be improved. .
  • the detection unit 404 is specifically configured to:
  • the detection unit 404 is specifically configured to:
  • the target feature parameter is input to the preset machine learning model to obtain the detection result.
  • the extracting unit 403 is specifically configured to:
  • the access relationship graph is a directed graph and the access relationship graph includes a plurality of vertices
  • a target value smaller than a preset threshold is selected from the multiple values, and a file corresponding to the target value is obtained as the target suspicious file.
  • the extracting unit 403 is specifically configured to:
  • the determining unit 402 is specifically configured to:
  • the access relationship graph is determined according to the second file identifier, the second IP address, and the access direction.
  • the acquiring unit 401 is specifically configured to:
  • the detection unit 404 is further configured to detect whether there are isolated vertices in the access relationship graph
  • the extraction unit 403 executes the step of extracting the target suspicious file according to the access relationship graph.
  • the detection unit 404 is also used to perform network environment detection to obtain target network parameters
  • the determining unit 402 is further configured to determine a target security level according to the target network parameters
  • the obtaining unit 401 executes the step of obtaining inbound and outbound traffic data of all hosts within the preset range.
  • each program module of the abnormal file detection apparatus of this embodiment can be implemented according to the method in the above method embodiment, and the specific implementation process can be referred to the relevant description of the above method embodiment, which will not be repeated here. .
  • An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute any abnormal file detection method as described in the above method embodiment. Part or all of the steps.
  • the embodiments of the present application also provide a computer program product.
  • the computer program product includes a non-transitory computer-readable storage medium storing a computer program.
  • the computer program is operable to cause a computer to execute the method described in the foregoing method embodiment. Part or all of the steps of any abnormal file detection method.
  • the disclosed device may be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or in the form of software program modules.
  • the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer readable memory.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory.
  • a number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned memory includes: U disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), mobile hard disk, magnetic disk, or optical disk and other media that can store program codes.
  • the program can be stored in a computer-readable memory, and the memory can include: a flash disk , ROM, RAM, magnetic disk or CD, etc.

Abstract

本申请实施例公开了一种异常文件检测方法及相关产品，该方法包括：获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；依据所述目标访问关系确定访问关系图；依据所述访问关系图提取出目标可疑文件；对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。采用本申请实施例，能够提升异常文件检测效率。

Description

异常文件检测方法及相关产品 技术领域
本申请涉及计算机领域，具体涉及一种异常文件检测方法及相关产品。
背景技术
webshell是以asp、php、jsp或者cgi等网页文件形式存在的一种命令执行环境，也可以将其称做为一种网页后门。黑客在入侵了一个网站后，通常会将asp或php后门文件与网站服务器WEB目录下正常的网页文件混在一起，然后就可以使用浏览器来访问asp或者php后门，得到一个命令执行环境，以达到控制网站服务器的目的，但是，webshell属于异常文件，但是针对异常文件检测效率较低，因此，如何提升异常文件检测效率的问题亟待解决。
发明内容
本申请实施例提供了一种异常文件检测方法及相关产品，能够提升异常文件检测效率。
第一方面，本申请实施例一种异常文件检测方法，应用于电子设备，包括：
获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
依据所述目标访问关系确定访问关系图；
依据所述访问关系图提取出目标可疑文件；
对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
第二方面，本申请实施例提供了一种异常文件检测装置，应用于电子设备，所述装置包括：获取单元、确定单元、提取单元和检测单元，其中，
所述获取单元，用于获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
所述确定单元，用于依据所述目标访问关系确定访问关系图；
所述提取单元，用于依据所述访问关系图提取出目标可疑文件；
所述检测单元，用于对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
第三方面，本申请实施例提供一种电子设备，包括处理器、存储器、通信接口，以及一个或多个程序，其中，上述一个或多个程序被存储在上述存储器中，并且被配置由上述处理器执行，上述程序包括用于执行本申请实施例第一方面中的步骤的指令。
第四方面，本申请实施例提供了一种计算机可读存储介质，其中，上述计算机可读存储介质存储用于电子数据交换的计算机程序，其中，上述计算机程序使得计算机执行如本申请实施例第一方面中所描述的部分或全部步骤。
第五方面，本申请实施例提供了一种计算机程序产品，其中，上述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，上述计算机程序可操作来使计算机执行如本申请实施例第一方面中所描述的部分或全部步骤。该计算机程序产品可以为一个软件安装包。
附图说明
下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1A是本申请实施例提供的一种电子设备的结构示意图；
图1B本申请实施例提供的实施异常文件检测方法的架构示意图；
图1C是本申请实施例公开的一种异常文件检测方法的流程示意图；
图1D是本申请实施例公开的一种访问关系图的演示示意图；
图1E是本申请实施例公开的另一种访问关系图的演示示意图；
图1F是本申请实施例公开的朴素贝叶斯分类流程的流程示意图；
图2是本申请实施例公开的另一种异常文件检测方法的流程示意图；
图3是本申请实施例公开的另一种电子设备的结构示意图；
图4是本申请实施例公开的一种异常文件检测装置的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其他步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
本申请实施例所涉及到的电子设备可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备(智能手表、无线耳机)、计算设备或连接到无线调制解调器的其他处理设备，以及各种形式的用户设备(user equipment，UE)，移动台(mobile station，MS)，终端设备(terminal device)等等。为方便描述，上面提到的设备统称为电子设备。电子设备还可以为服务器、网关或者智能家居设备。
智能家居设备可以为以下至少一种：智能音箱、智能摄像头、智能电饭煲、智能轮椅、智能按摩椅、智能家具、智能洗碗机、智能电视机、智能冰箱、智能电风扇、智能取暖器、智能晾衣架、智能灯、智能路由器、智能交换机、智能开关面板、智能加湿器、智能空调、智能门、智能窗、智能灶台、智能消毒柜、智能马桶、扫地机器人等等，在此不做限定。
下面对本申请实施例进行详细介绍。
请参阅图1A，图1A是本申请实施例公开的一种电子设备的结构示意图，电子设备100可以包括控制电路，该控制电路可以包括存储和处理电路110。该存储和处理电路110可以存储器，例如硬盘驱动存储器，非易失性存储器(例如闪存或用于形成固态驱动器的其它电子可编程只读存储器等)，易失性存储器(例如静态或动态随机存取存储器等)等，本申 请实施例不作限制。存储和处理电路110中的处理电路可以用于控制电子设备100的运转。该处理电路可以基于一个或多个微处理器，微控制器，基带处理器，功率管理单元，音频编解码器芯片，专用集成电路，显示驱动器集成电路等来实现。
存储和处理电路110可用于运行电子设备100中的软件，例如互联网浏览应用程序，互联网协议语音(voice over internet protocol,VOIP)电话呼叫应用程序，电子邮件应用程序，媒体播放应用程序，操作系统功能等。这些软件可以用于执行一些控制操作，例如，基于照相机的图像采集，基于环境光传感器的环境光测量，基于接近传感器的接近传感器测量，基于诸如发光二极管的状态指示灯等状态指示器实现的信息显示功能，基于触摸传感器的触摸事件检测，与在多个(例如分层的)显示器上显示信息相关联的功能，与执行无线通信功能相关联的操作，与收集和产生音频信号相关联的操作，与收集和处理按钮按压事件数据相关联的控制操作，以及电子设备100中的其它功能等，本申请实施例不作限制。
电子设备100还可以包括输入-输出电路150。输入-输出电路150可用于使电子设备100实现数据的输入和输出，即允许电子设备100从外部设备接收数据和也允许电子设备100将数据从电子设备100输出至外部设备。输入-输出电路150可以进一步包括传感器170。传感器170可以包括环境光传感器，基于光和电容的接近传感器，触摸传感器(例如，基于光触摸传感器和/或电容式触摸传感器，其中，触摸传感器可以是触控显示屏的一部分，也可以作为一个触摸传感器结构独立使用)，加速度传感器，重力传感器，和其它传感器等。
输入-输出电路150还可以包括一个或多个显示器，例如显示器130。显示器130可以包括液晶显示器，有机发光二极管显示器，电子墨水显示器，等离子显示器，使用其它显示技术的显示器中一种或者几种的组合。显示器130可以包括触摸传感器阵列(即，显示器130可以是触控显示屏)。触摸传感器可以是由透明的触摸传感器电极(例如氧化铟锡(ITO)电极)阵列形成的电容式触摸传感器，或者可以是使用其它触摸技术形成的触摸传感器，例如音波触控，压敏触摸，电阻触摸，光学触摸等，本申请实施例不作限制。
音频组件140可以用于为电子设备100提供音频输入和输出功能。电子设备100中的音频组件140可以包括扬声器，麦克风，蜂鸣器，音调发生器以及其它用于产生和检测声音的组件。
通信电路120可以用于为电子设备100提供与外部设备通信的能力。通信电路120可以包括模拟和数字输入-输出接口电路，和基于射频信号和/或光信号的无线通信电路。通信电路120中的无线通信电路可以包括射频收发器电路、功率放大器电路、低噪声放大器、开关、滤波器和天线。举例来说，通信电路120中的无线通信电路可以包括用于通过发射和接收近场耦合电磁信号来支持近场通信(near field communication，NFC)的电路。例如，通信电路120可以包括近场通信天线和近场通信收发器。通信电路120还可以包括蜂窝电话收发器和天线，无线局域网收发器电路和天线等。
电子设备100还可以进一步包括电池，电力管理电路和其它输入-输出单元160。输入-输出单元160可以包括按钮，操纵杆，点击轮，滚动轮，触摸板，小键盘，键盘，照相机，发光二极管和其它状态指示器等。
用户可以通过输入-输出电路150输入命令来控制电子设备100的操作，并且可以使用输入-输出电路150的输出数据以实现接收来自电子设备100的状态信息和其它输出。
相关技术中，webshell的检测方法主要可分为三大类：静态检测、动态检测和日志分析。静态检测通过匹配特征码、特征值、危险函数等文件的静态属性来判断是否为webshell。常见测静态检测方法为规则匹配，比如yara匹配，规则的完善情况会很大程度影响检测的准确率与漏报率。目前在大型企业中，静态检测常用的思路是采用强弱特征匹配：命中强 特征规则就认为必然是webshell，命中弱特征规则就交由人工判断是误判还是webshell。动态检测是将文件上传到服务器，文件执行时表现出来的特征被称为动态特征，服务器通过监控各种动态特征来判断该文件是否为webshell。日志检测的原理是webshell会在web日志中留下webshell的访问数据和数据提交记录，可以通过大量日志文件建立请求模型从而检测出异常文件。
相关技术中，三大类检测方法都存在较明显的不足。静态检测的质量极大依赖规则，漏报率、误报率高，且对于0day型webshell，经过加密、混淆、变形的webshell几乎没有检测能力，对于目前大型企业采用的强弱特征匹配方案，会占用大量人力。动态检测在文件运行的过程中对其进行监测，优点是准确率有所提高，缺点是会占用较多的CPU和内存，检测速度较静态检测也慢很多。动态检测常对主机目录进行实时监控，这对于经常有大量文件变更的目录来说，需要上传大量文件，不仅消耗的资源大大增加，也会导致更多误报。日志检测在网站访问量达到一定量级时，这种检测方法的结果具有较大参考价值，但也存在一定误报，以及对于大量的访问日志，检测的处理能力和效率都比较低。
基于此，请参阅图1B，以电子设备为服务器为例，图1B提供了实施本申请实施例所涉及的方法的系统架构，本申请实施例所涉及的方法可以应用于服务器，服务器与主机侧之间可以进行通信，进而，获取电子设备上传的可疑文件(webshell目标文件)，该服务器可以包括可疑文件分离引擎、opcode提取引擎和机器学习引擎，其中，可疑文件分离引擎可以用于分离出可疑文件，opcode提取引擎可以用于从可疑文件中提取出机器码(opcode)，机器学习引擎可以对机器码进行运算，得到最终的检测结果。
本申请实施例可以应用在主机安全产品哨兵中，分为主机端和服务端两个大部分(如图1B所示)。主机端可以运行一个文件上传模块，用于接收服务器传回的指令并上传指定的文件，服务器端可以包含三个部分：可疑文件分离引擎、opcode提取引擎和机器学习引擎。
具体实现中，可疑文件检测流程可以通过服务器串行检测。
可疑文件分离引擎，可部署在单独的服务器上，可以从网关获取所有主机的进出流量数据，提取文件与文件，文件与IP之间的访问关系，绘制成访问关系图，并从访问关系图中分离可出可疑文件，向可疑文件的主机端发送指令，提示主机端将可疑文件发送到服务器端。主机端只负责接收服务器端的指令并上传指定目录下的文件到服务器，该方式对主机端资源的占用基本为0，最大限度的保证主机业务的正常运行。服务器接收到主机端发来的可疑文件后，opcode提取引擎获取这部分文件并提取可执行文件的opcode，发送到机器学习引擎，机器学习引擎对其进行判断并得出最后结果。
具体地，本申请实施例提供了一种异常文件检测方法，应用于电子设备，可以包括如下步骤：
获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
依据所述目标访问关系确定访问关系图；
依据所述访问关系图提取出目标可疑文件；
对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
可以看出，本申请实施例中所描述的异常文件检测方法，应用于电子设备，获取预设范围内的所有主机的进出流量数据，并从进出流量数据中提取出目标访问关系，目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系，依据目标访问关系确定访问关系图，依据访问关系图提取出目标可疑文件，对目标可疑文件进行检测，得到检测结果，并输出所述检测结果，由于通过访问关系，梳理出访问关系图， 通过访问关系图可以快速查找异常文件，并对该异常文件进行异常检测，如此，可以提升异常文件检测效率。
请参阅图1C，图1C是本申请实施例提供的一种异常文件检测方法的流程示意图，本实施例中所描述的异常文件检测方法，应用于如图1A的电子设备或者图1B所示的系统架构，该异常文件检测方法包括：
101、获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系。
其中，预设范围可以由用户自行设置或者系统默认，例如，一个局域网，电子设备与所有主机处于同一个局域网，又例如，一个城市，即所有主机处于同一个城市。电子设备为服务器时，其可以通过网关获取预设范围内的所有主机的进出流量数据，当电子设备不为服务器时，例如，电子设备为网关时，可以获取预设范围内的所有主机的进出流量数据。
具体实现中，电子设备可以获取预设范围内的所有主机的进出流量数据，并从进出流量数据中提取出目标访问关系，该目标访问关系可以为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系，例如，设备可以通过IP地址与其他设备之间进行连网或者交互，举例说明下，可以进入某个网页，点击该网页下面的某个链接，进而，可以提取文件与文件、文件与IP地址之间的访问顺序，得到目标访问关系。
在一个可能的示例中，上述步骤101，获取预设范围内的所有主机的进出流量数据，可以包括如下步骤：
11、在显示屏上展示主机分布地图；
12、获取触控轨迹，并确定所述触控轨迹所形成的闭合区域；
13、获取所述闭合区域范围内的所有主机的所述进出流量数据。
其中，电子设备的显示屏上可以展示主机分布地图，该主机分布地图用于展示主机的分布情况，电子设备可以接收触控轨迹，触控轨迹可以由用户进行触控操作得到，例如，触控笔实现触控，又或者手指进行触控，该触控轨迹可以形成一个闭合区域，进而，电子设备可以获取主机分布地图中闭合区域范围内的所有主机的进出流量数据。
102、依据所述目标访问关系确定访问关系图。
其中，由于访问有一定的方向性，例如，A访问B，又或者B访问A，电子设备则可以依据访问关系生成访问关系图，该访问关系图可以为一个有向图。假设v、w为访问关系图的两个顶点，则v->w表示一条由v指向w的边，在一副有向图中，两个顶点的关系可能有以下四种情况：
1、没有边相连；
2、存在一条从v到w的边：v->w；
3、存在一条由w到v的边：w->v；
4、既存在v->w，也存在w->v，也就是一条双向边。
进一步地，如图1D所示，图1D提供了一种访问关系图，访问关系图的每个顶点可以为文件或者IP地址，a1、a2、…、a10为该访问关系图的顶点。
在一个可能的示例中，上述步骤102，依据所述目标访问关系确定访问关系图，可以包括如下步骤：
21、提取所述目标访问关系中的第一文件标识、第一IP地址以及访问方向；
22、对所述第一文件标识以及所述第一IP地址进行筛选，得到第二文件标识和第二IP地址；
23、依据所述第二文件标识、所述第二IP地址以及所述访问方向确定所述访问关系图。
其中，具体实现中，电子设备可以提取目标访问关系中的第一文件标识、第一IP地址以及访问关系，当然，由于文件标识中可能存在一些安全的文件标识，或者，一些安全IP地址，可以对这些文件标识或者IP地址进行筛选，得到第二文件标识和第二IP地址，电子设备可以依据第二文件标识、第二IP地址以及访问方向确定访问关系图，即依据访问方向对第二文件标识以及第二IP进行箭头连接，得到访问关系图。
103、依据所述访问关系图提取出目标可疑文件。
其中，具体实现中，以服务器为例，服务器可以通过可疑文件分离引擎依据访问关系图提取目标可疑文件，目标可疑文件可以位于上述所有主机的至少一个主机中。目标可疑文件可以为webshell文件。
具体实现中，该可疑文件分离引擎的主要原理可以是依据文件与文件、文件与IP之间的关系绘制出有向图来筛选出可疑文件。其中，有向图与无向图的区别是，它的边是单向的，每条边所连接的两个顶点都是一个有序对，他们的邻接性是单向的。在有向图中，一条有向边由第一个顶点指出并指向第二个顶点，一个顶点的出度为由该顶点指出的边的总数；一个顶点的入度为指向该顶点的边的总数。
具体实现中，根据webshell的性质，它是由黑客植入到内网主机的可执行文件，通常不会访问web目录下的其他web文件，而直接和黑客的IP进行通信，而正常的文件通常会与web目录下的其他文件存在访问和交互关系。如果将它们和文件、IP的访问关系绘制成有向图，那么在形成的图中webshell所代表的这个点会因为只与单一的对象(黑客IP)交互从而被群体分离出来(出度入度为1)，这就实现了webshell和正常文件的分离。如下图1E所示：图中每个点代表的是文件或者IP，从图中可以看到，各个文件因为与其他文件或IP存在访问关系而形成团，存在复杂访问关系的文件形成大团，较少关系的则形成小团，由于webshell文件的独立性，那么最后webshell文件会形成只与特定少数几个IP存在访问关系的单独点，那么最后再将这些单独点(即可疑文件)上传到云端，进行进一步的检测。在现实中应用中，可能存在一个问题：当文件(比如index文件等等)的访问量可能会非常大(千万级的不同IP访问量)，那么在绘制成图的时候可能会形成巨大的访问簇，这样在数据处理上会导致计算量特别大，甚至可以导致服务器崩溃。对于这个问题，可以通过定义白点的方式来解决，比如定义主页文件为白点文件，默认与白点存在交互的文件或IP为正常文件，并且不在图上显示，那么只需要处理与白点没有关系的文件即可，对于白点的设定，可以自动设置为当某个web文件的访问量达到一定阈值，则自动转化为白点，这样就极大的减少了服务器的计算量。
在一个可能的示例中，上述步骤103，依据所述访问关系图提取出目标可疑文件，可以包括如下步骤：
31、依据所述访问关系图确定出所述访问关系图中每一顶点的交互对象数量，得到多个数值，所述访问关系图为有向图且所述访问关系图包括多个顶点；
32、从所述多个数值中选取小于预设阈值的目标数值，获取所述目标数值对应的文件作为所述目标可疑文件。
其中，上述预设阈值可以由用户自行设置或者系统默认。电子设备可以依据访问关系图确定出访问关系图中每一顶点的交互对象数量，得到多个数值，该访问关系图为有向图且访问关系图包括可以多个顶点，顶点可以为文件或者IP地址，交互对象也可以为顶点，进而，可以从多个数值中选取小于预设阈值的目标数值，并获取目标数值对应的文件作为目标可疑文件。
进一步地，在一个可能的示例中，上述步骤32，获取所述目标数值对应的文件作为所述目标可疑文件，可以包括如下步骤：
321、向所述目标数值对应的目标主机发送获取指令，所述获取指令用于获取所述进出 流量数据中与所述目标主机相关的至少一个文件；
322、接收由所述目标主机反馈的所述至少一个文件；
323、从所述至少一个文件中提取所述目标可疑文件。
具体实现中，电子设备可以向目标数值对应的目标主机发送获取指令，该获取指令可以用于获取进出流量数据中与目标主机相关的至少一个文件，目标主机可以将该至少一个文件发送给该电子设备，电子设备可以接收目标主机反馈的至少一个文件，并且可以从该至少一个文件中提取出目标可疑文件。
104、对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
其中，本申请实施例中，电子设备可以对目标可疑文件进行检测，得到检测结果，该检测结果可以为目标可疑文件为异常文件，或者，目标可疑文件不为异常文件。
在一个可能的示例中，上述步骤104，对所述目标可疑文件进行检测，得到检测结果，可以包括如下步骤：
41、获取所述目标可疑文件的目标操作码；
42、将所述目标操作码输入到预设机器学习模型，得到所述检测结果。
具体实现中，目标操作码即opcoe，opcode即为系统的操作码，解释器执行过程即是执行一个基本单位op_array内的最小优化opcode，按顺序遍历执行，执行当前opcode，会预取下一条opcode，直到最后一个RETRUN这个特殊的opcode返回退出。opcode处理引擎专门用来处理第一部分传来的文件，提取这些可执行文件的opcode，并保存传回云端。现在大多数类型的可执行文件都有相应的opcode提取插件，以php为例，php有vld扩展工具，假设当前目录下存在1.php文件，执行php-dvld.active＝1 1.php命令可生成执行代码，最后，通过opcode提取代码即可获取php文件的opcode，并将opcode上传到云端交给机器学习引擎处理。
本申请实施例中，预设机器学习模型可以为以下至少一种：神经网络模型、遗传算法模型、贝叶斯分类算法等等，在此不做限定神经网络模型可以为以下至少一种：全连接神经网络模型、循环神经网络模型、卷积神经网络模型、脉冲神经网络模型等等，在此不做限定。
具体实现中，电子设备可以获取目标可疑文件的目标操作码，具体地，可以对目标可疑文件进行解析，得到目标操作码，进而，可以将目标操作码输入到预设机器学习模型，得到检测结果。
举例说明下，预设机器学习模型可以为采用朴素贝叶斯监督算法，则电子设备可以采用朴素贝叶斯监督算法来对提取出的opcode进行检测。
贝叶斯分类算法是一类算法的统称，均以贝叶斯定理为基础，而朴素贝叶斯算法是贝叶斯分类算法中非常常用的一种。朴素贝叶斯算法的原理简而言之就是：对于给出的待分类项，求解在此项出现的条件下各个类别出现的概率，哪个最大就认为该项属于哪个类别(数学推导过程此处略过)。朴素贝叶斯分类流程可以由图1F来表示：
其中，步骤S1、S2为准备工作阶段，在这个阶段，需要确定webshell的opcode的特征，Webshell的opcode一般都是以组合的形式出现，其中，一些特定组合在正常的文件中很少见到，而在webshell中经常出现，因此，将各种opcode的组合作为特征；
进一步地，步骤S3、S4为分类器训练阶段，该阶段的任务就是计算每个类别在训练样本中出现的频率及每个特征属性划分对每个类别的概率估计，并记录结果，其输入是特征属性和训练样本，输出是分类器；
其次，步骤S5、S6则是应用阶段，将主机端上传的可疑文件提取出的opcode放入训练好的模型中，输出判断结果；
最后，opcode的判断结果则对应了原始可执行文件的判断结果，最后，将判断结果存 入数据库并报告给主机，由主机来决定是否处理这些可以文件。
其中，图1F中，X为特征属性，Y为类别，i为任一类，不同的特征可以对应不同的类。
通过这样的检测流程，可以以一个较快的速度、较低的主机资源占用和较高的准确率来识别webshell，并且处在后端的三台引擎可分布式部署在不同的服务器上，一定程度上的提高了webshell的检测效率。
进一步地，在一个可能的示例中，上述步骤41，将所述目标操作码输入到预设机器学习模型，得到所述检测结果，可以包括如下步骤：
411、对所述目标操作码进行特征提取，得到目标特征参数；
412、将所述目标特征参数输入到所述预设机器学习模型，得到所述检测结果。
其中，目标特征参数可以理解为操作码的特征参数，其可以用于表述操作码的特征，具体实现中，电子设备可以对目标操作码进行特征提取，得到目标特征参数，进而，可以将目标特征参数输入到预设机器学习模型，得到检测结果。
本申请实施例中，使用上述检测方法可以发挥各个引擎的优势，主要有三个较大的收益。第一、主机资源占用少，这套检测系统不需要在主机上部署较为冗杂繁琐的webshell检测系统，极大降低了无关业务对资源的占用，最大程度上保证了线上业务的正常运行，很适合大型企业使用；第二、对变形、加密、混淆的webshell具有很高的查杀率，即对webshell具有很高的检出率。主要是因为运用了opcode的检测方法，无论文件再怎么变形、混淆、加密，最终它也会执行一段具有风险的代码，而opcode是这段风险代码的产物，所以直接提取opcode，无论文件再怎么变形、加密、混淆也无济于事，故具有较高的查杀率。第三、具有较快的速度和及时性。由于是在流量端对文件进行过滤，所以webshell在刚执行的时候就会被系统检测到，立马交给检测引擎处理，避免了主机被黑客进一步入侵。
另外，本申请实施例中所提及的异常文件检测方法，其着手于静态检测准确率不高的问题和动态检测占用资源大和速度慢的问题。它可以在保持高速度、低资源使用的情况下，以较高的准确率识别webshell。针对静态检测准确率不高的问题，本申请实施例，采取提取opcode判断的方法，opcode是文件动态执行时产生的，对经过加密、混淆、变形的webshell也有较好的查杀率。针对动态检测会占用较大主机资源的问题，本申请实施例，将主要计算工作都放在服务器，服务器会根据主机流量绘制出有向图并筛选出可疑文件，主机侧只需要根据服务器的指令上传相应的可疑文件交给服务器判断，整个过程几乎不占主机资源，也就不会主机上的业务产生影响。并且由于可疑文件是经过筛选处理后再进入机器学习引擎，也能提高机器学习引擎的检测速度。
在一个可能的示例中，上述步骤102，依据所述目标访问关系确定访问关系图之后，以及步骤103，依据所述访问关系图提取出目标可疑文件之前，还可以包括如下步骤：
A1、检测所述访问关系图中是否存在孤立顶点；
A2、在所述访问关系图中存在所述孤立顶点时，执行所述依据所述访问关系图提取出目标可疑文件的步骤。
其中，电子设备可以检测访问关系图的孤立顶点情况，在访问关系图中存在孤立顶点时，则说明可能存在异常文件，则可以执行步骤103，否则，则说明系统安全，可以不执行步骤103。
在一个可能的示例中，步骤101之前，还可以包括如下步骤：
B1、进行网络环境检测，得到目标网络参数；
B2、依据所述目标网络参数确定目标安全等级；
B3、在所述目标安全等级低于预设安全等级时，执行所述获取预设范围内的所有主机的进出流量数据的步骤。
其中，预设安全等级可以由用户自行设置或者系统默认。网络参数可以为以下至少一种：网络负荷、漏洞数量、异常访问数量等等，在此不做限定，每一网络参数可以对应一个权值，具体实现中，目标网络参数中可以包括多个网络参数，进而，可以依据目标网络参数中每一网络参数以及对应的权值可以进行加权运算，得到对应的目标网络评价值，按照预设的网络评价值与安全等级之间的映射关系，确定目标网络评价值对应的目标安全等级，且在目标安全等级低于预设安全等级时，可以执行步骤101，否则，可以不执行步骤101，如此，可以在网络安全出现危机时，进行异常文件检测。
在一个可能的示例中，步骤101之前，还可以包括如下步骤：
C1、获取用户的目标生理状态参数；
C2、确定所述目标生理状态参数对应的目标情绪类型；
C3、在所述目标情绪类型为预设情绪类型时，执行所述获取预设范围内的所有主机的进出流量数据的步骤。
其中，本申请实施例中，生理状态参数可以为用于反映用户生理机能的各种参数，生理状态参数可以为以下至少一种：心率、血压、血温、血脂含量、血糖含量、甲状腺素含量、肾上腺素含量、血小板含量、血氧含量等等，在此不做限定。预设情绪类型可以由用户自行设置或者系统默认。预设情绪类型可以为以下至少一种：沉闷、哭泣、平静、暴躁、兴奋、郁闷等等，在此不做限定。
具体实现中，电子设备可以通过可该电子设备进行通信连接的可穿戴设获取用户的目标生理状态参数，不同的生理状态参数反映了用户的情绪类型，电子设备中可以预先存储生理状态参数与情绪类型之间的映射关系，进而，可以依据该映射关系确定目标生理状态参数对应的目标情绪类型，进而，可以在目标情绪类型为预设情绪类型时，执行步骤101，否则，则可以不执行步骤101。
在一个可能的示例中，在所述目标生理状态参数为指定时间段内的心率变化曲线时，上述步骤C1，确定所述目标生理状态参数对应的目标情绪类型，可以按照如下方式实施：
C11、对所述心率变化曲线进行采样，得到多个心率值；
C12、依据所述多个心率值进行均值运算，得到平均心率值；
C13、确定所述平均心率值对应的目标心率等级；
C14、按照预设的心率等级与第一情绪值之间的映射关系，确定所述目标心率等级对应的目标第一情绪值；
C15、依据所述多个心率值进行均方差运算，得到目标均方差；
C16、按照预设的均方差与第二情绪值之间的映射关系，确定所述目标均方差对应的目标第二情绪值；
C17、按照预设的心率等级与权值对之间的映射关系，确定所述目标心率等级对应的目标权值对，所述权值对包括第一权值和第二权值，所述第一权值为所述第一情绪值对应的权值，所述第二权值为所述第二情绪值对应的权值；
C18、依据所述目标第一情绪值、所述目标第二情绪值和所述目标权值对进行加权运算，得到最终情绪值；
C19、按照预设的情绪值与情绪类型之间的映射关系，确定所述目标情绪值对应的所述目标情绪类型。
其中，指定时间段可以由用户自行设置或者系统默认，电子设备中可以预先存储预设的心率等级与第一情绪值之间的映射关系，以及预设的均方差与第二情绪值之间的映射关系，以及预设的心率等级与权值对之间的映射关系，以及预设的情绪值与情绪类型之间的映射关系，上述权值对可以包括第一权值和第二权值，第一权值为第一情绪值对应的权值，第二权值为第二情绪值对应的权值，其中，第一权值与第二权值之和可以为1，且第一权 值、第二权值的取值范围均为0～1。本申请实施例中，可以通过心率变化曲线来评估情绪。
具体实现中，电子设备可以对心率变化曲线进行采样，具体采样方式可以为：均匀采样或者随机采样，得到多个心率值，并且可以依据多个心率值进行均值运算，得到平均心率值，电子设备中可以预先存储心率值与心率等级之间的映射关系，进而，可以依据该映射关系确定平均心率值对应的目标心率等级，进而，可以按照上述预设的心率等级与第一情绪值之间的映射关系，确定目标心率等级对应的目标第一情绪值，进而，还可以依据多个心率值进行均方差运算，得到目标均方差，并且可以按照预设的均方差与第二情绪值之间的映射关系，确定该目标均方差对应的目标第二情绪值。
进一步地，电子设备还可以按照上述预设的心率等级与权值对之间的映射关系，确定目标心率等级对应的目标权值对，该目标权值对可以包括目标第一权值和目标第一权值，目标第一权值为目标第一情绪值对应的权值，目标第二权值为目标第二情绪值对应的权值，进而，电子设备可以依据目标第一情绪值、目标第二情绪值、目标第一权值和目标第二权值进行加权运算，得到最终情绪值，具体计算公式如下：
最终情绪值＝目标第一情绪值*目标第一权值+目标第二情绪值*目标第二权值
进而，可以按照上述预设的情绪值与情绪类型之间的映射关系，确定目标情绪值对应的目标情绪类型。其中，上述平均心率反映了用户的心率值，心率的均方差反映了心率稳定性，通过平均心率和均方差两个维度反映了用户的情绪，能够精准确定用户的情绪类型。
可以看出，本申请实施例中所描述的异常文件检测方法，应用于电子设备，获取预设范围内的所有主机的进出流量数据，并从进出流量数据中提取出目标访问关系，目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系，依据目标访问关系确定访问关系图，依据访问关系图提取出目标可疑文件，对目标可疑文件进行检测，得到检测结果，并输出所述检测结果，由于通过访问关系，梳理出访问关系图，通过访问关系图可以快速查找异常文件，并对该异常文件进行异常检测，如此，可以提升异常文件检测效率。
与上述一致地，请参阅图2，图2是本申请实施例提供的另一种异常文件检测方法的流程示意图，本实施例中所描述的异常文件检测方法，应用于如图1A的电子设备或者图1B所示的系统架构，该方法可包括以下步骤：
201、进行网络环境检测，得到目标网络参数。
202、依据所述目标网络参数确定目标安全等级。
203、在所述目标安全等级低于预设安全等级时，获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系。
204、依据所述目标访问关系确定访问关系图。
205、依据所述访问关系图提取出目标可疑文件。
206、对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
其中，上述步骤201-步骤206的具体描述可以参照图1C所示的异常文件检测方法，在此不再赘述。
可以看出，本申请实施例中所描述的异常文件检测方法，应用于电子设备，获取预设范围内的所有主机的进出流量数据，并从进出流量数据中提取出目标访问关系，目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系，依据目标访问关系确定访问关系图，依据访问关系图提取出目标可疑文件，对目标可疑文件进行检测，得到检测结果，并输出所述检测结果，由于通过访问关系，梳理出访问关系图，通过访问关系图可以快速查找异常文件，并对该异常文件进行异常检测，如此，可以提升 异常文件检测效率。
以下是实施上述异常文件检测方法的装置，具体如下：
与上述一致地，请参阅图3，图3是本申请实施例提供的一种电子设备，包括：处理器和存储器；以及一个或多个程序，所述一个或多个程序被存储在所述存储器中，并且被配置成由所述处理器执行，所述程序包括用于执行以下步骤的指令：
获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
依据所述目标访问关系确定访问关系图；
依据所述访问关系图提取出目标可疑文件；
对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
可以看出，本申请实施例中所描述的电子设备，获取预设范围内的所有主机的进出流量数据，并从进出流量数据中提取出目标访问关系，目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系，依据目标访问关系确定访问关系图，依据访问关系图提取出目标可疑文件，对目标可疑文件进行检测，得到检测结果，并输出所述检测结果，由于通过访问关系，梳理出访问关系图，通过访问关系图可以快速查找异常文件，并对该异常文件进行异常检测，如此，可以提升异常文件检测效率。
在一个可能的示例中，在所述对所述目标可疑文件进行检测，得到检测结果方面，所述程序包括用于执行以下步骤的指令：
获取所述目标可疑文件的目标操作码；
将所述目标操作码输入到预设机器学习模型，得到所述检测结果。
在一个可能的示例中，在所述将所述目标操作码输入到预设机器学习模型，得到所述检测结果方面，所述程序包括用于执行以下步骤的指令：
对所述目标操作码进行特征提取，得到目标特征参数；
将所述目标特征参数输入到所述预设机器学习模型，得到所述检测结果。
在一个可能的示例中，在所述依据所述访问关系图提取出目标可疑文件方面，所述程序包括用于执行以下步骤的指令：
依据所述访问关系图确定出所述访问关系图中每一顶点的交互对象数量，得到多个数值，所述访问关系图为有向图且所述访问关系图包括多个顶点；
从所述多个数值中选取小于预设阈值的目标数值，获取所述目标数值对应的文件作为所述目标可疑文件。
在一个可能的示例中，在所述获取所述目标数值对应的文件作为所述目标可疑文件方面，所述程序包括用于执行以下步骤的指令：
向所述目标数值对应的目标主机发送获取指令，所述获取指令用于获取所述进出流量数据中与所述目标主机相关的至少一个文件；
接收由所述目标主机反馈的所述至少一个文件；
从所述至少一个文件中提取所述目标可疑文件。
在一个可能的示例中，在所述依据所述目标访问关系确定访问关系图方面，所述程序包括用于执行以下步骤的指令：
提取所述目标访问关系中的第一文件标识、第一IP地址以及访问方向；
对所述第一文件标识以及所述第一IP地址进行筛选，得到第二文件标识和第二IP地址；
依据所述第二文件标识、所述第二IP地址以及所述访问方向确定所述访问关系图。
在一个可能的示例中，在所述获取预设范围内的所有主机的进出流量数据方面，所述程序包括用于执行以下步骤的指令：
在显示屏上展示主机分布地图；
获取触控轨迹，并确定所述触控轨迹所形成的闭合区域；
获取所述闭合区域范围内的所有主机的所述进出流量数据。
在一个可能的示例中，在所述依据所述目标访问关系确定访问关系图之后，以及所述依据所述访问关系图提取出目标可疑文件之前，所述程序还包括用于执行以下步骤的指令：
检测所述访问关系图中是否存在孤立顶点；
在所述访问关系图中存在所述孤立顶点时，执行所述依据所述访问关系图提取出目标可疑文件的步骤。
在一个可能的示例中，所述程序还包括用于执行以下步骤的指令：
进行网络环境检测，得到目标网络参数；
依据所述目标网络参数确定目标安全等级；
在所述目标安全等级低于预设安全等级时，执行所述获取预设范围内的所有主机的进出流量数据的步骤。
请参阅图4，图4是本实施例提供的一种异常文件检测装置的结构示意图。该异常文件检测装置应用于如图1A所示的电子设备或者图1B所示的系统架构，所述异常文件检测装置包括：获取单元401、确定单元402、提取单元403和检测单元404，其中，
所述获取单元401，用于获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
所述确定单元402，用于依据所述目标访问关系确定访问关系图；
所述提取单元403，用于依据所述访问关系图提取出目标可疑文件；
所述检测单元404，用于对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
可以看出，本申请实施例中所描述的异常文件检测装置，应用于电子设备，获取预设范围内的所有主机的进出流量数据，并从进出流量数据中提取出目标访问关系，目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系，依据目标访问关系确定访问关系图，依据访问关系图提取出目标可疑文件，对目标可疑文件进行检测，得到检测结果，并输出所述检测结果，由于通过访问关系，梳理出访问关系图，通过访问关系图可以快速查找异常文件，并对该异常文件进行异常检测，如此，可以提升异常文件检测效率。
在一个可能的示例中，在所述对所述目标可疑文件进行检测，得到检测结果方面，所述检测单元404具体用于：
获取所述目标可疑文件的目标操作码；
将所述目标操作码输入到预设机器学习模型，得到所述检测结果。
在一个可能的示例中，在所述将所述目标操作码输入到预设机器学习模型，得到所述检测结果方面，所述检测单元404具体用于：
对所述目标操作码进行特征提取，得到目标特征参数；
将所述目标特征参数输入到所述预设机器学习模型，得到所述检测结果。
在一个可能的示例中，在所述依据所述访问关系图提取出目标可疑文件方面，所述提取单元403具体用于：
依据所述访问关系图确定出所述访问关系图中每一顶点的交互对象数量，得到多个数 值，所述访问关系图为有向图且所述访问关系图包括多个顶点；
从所述多个数值中选取小于预设阈值的目标数值，获取所述目标数值对应的文件作为所述目标可疑文件。
在一个可能的示例中，在所述获取所述目标数值对应的文件作为所述目标可疑文件方面，所述提取单元403具体用于：
向所述目标数值对应的目标主机发送获取指令，所述获取指令用于获取所述进出流量数据中与所述目标主机相关的至少一个文件；
接收由所述目标主机反馈的所述至少一个文件；
从所述至少一个文件中提取所述目标可疑文件。
在一个可能的示例中，在所述依据所述目标访问关系确定访问关系图方面，所述确定单元402具体用于：
提取所述目标访问关系中的第一文件标识、第一IP地址以及访问方向；
对所述第一文件标识以及所述第一IP地址进行筛选，得到第二文件标识和第二IP地址；
依据所述第二文件标识、所述第二IP地址以及所述访问方向确定所述访问关系图。
在一个可能的示例中，在所述获取预设范围内的所有主机的进出流量数据方面，所述获取单元401具体用于：
在显示屏上展示主机分布地图；
获取触控轨迹，并确定所述触控轨迹所形成的闭合区域；
获取所述闭合区域范围内的所有主机的所述进出流量数据。
在一个可能的示例中，具体如下：
所述检测单元404，还用于检测所述访问关系图中是否存在孤立顶点；
由所述提取单元403在所述访问关系图中存在所述孤立顶点时，执行所述依据所述访问关系图提取出目标可疑文件的步骤。
在一个可能的示例中，具体如下：
所述检测单元404，还用于进行网络环境检测，得到目标网络参数；
所述确定单元402，还用于依据所述目标网络参数确定目标安全等级；
由所述获取单元401在所述目标安全等级低于预设安全等级时，执行所述获取预设范围内的所有主机的进出流量数据的步骤。
可以理解的是，本实施例的异常文件检测装置的各程序模块的功能可根据上述方法实施例中的方法具体实现，其具体实现过程可以参照上述方法实施例的相关描述，此处不再赘述。
本申请实施例还提供一种计算机存储介质，其中，该计算机存储介质存储用于电子数据交换的计算机程序，该计算机程序使得计算机执行如上述方法实施例中记载的任何一种异常文件检测方法的部分或全部步骤。
本申请实施例还提供一种计算机程序产品，所述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，所述计算机程序可操作来使计算机执行如上述方法实施例中记载的任何一种异常文件检测方法的部分或全部步骤。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件程序模块的形式实现。
所述集成的单元如果以软件程序模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储器中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储器中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储器包括：U盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储器中，存储器可以包括：闪存盘、ROM、RAM、磁盘或光盘等。
以上对本申请实施例进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (20)

  1. 一种异常文件检测方法，其特征在于，应用于电子设备，包括：
    获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
    依据所述目标访问关系确定访问关系图；
    依据所述访问关系图提取出目标可疑文件；
    对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
  2. 根据权利要求1所述的方法，其特征在于，所述对所述目标可疑文件进行检测，得到检测结果，包括：
    获取所述目标可疑文件的目标操作码；
    将所述目标操作码输入到预设机器学习模型，得到所述检测结果。
  3. 根据权利要求2所述的方法，其特征在于，所述将所述目标操作码输入到预设机器学习模型，得到所述检测结果，包括：
    对所述目标操作码进行特征提取，得到目标特征参数；
    将所述目标特征参数输入到所述预设机器学习模型，得到所述检测结果。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述依据所述访问关系图提取出目标可疑文件，包括：
    依据所述访问关系图确定出所述访问关系图中每一顶点的交互对象数量，得到多个数值，所述访问关系图为有向图且所述访问关系图包括多个顶点；
    从所述多个数值中选取小于预设阈值的目标数值，获取所述目标数值对应的文件作为所述目标可疑文件。
  5. 根据权利要求4所述的方法，其特征在于，所述获取所述目标数值对应的文件作为所述目标可疑文件，包括：
    向所述目标数值对应的目标主机发送获取指令，所述获取指令用于获取所述进出流量数据中与所述目标主机相关的至少一个文件；
    接收由所述目标主机反馈的所述至少一个文件；
    从所述至少一个文件中提取所述目标可疑文件。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述依据所述目标访问关系确定访问关系图，包括：
    提取所述目标访问关系中的第一文件标识、第一IP地址以及访问方向；
    对所述第一文件标识以及所述第一IP地址进行筛选，得到第二文件标识和第二IP地址；
    依据所述第二文件标识、所述第二IP地址以及所述访问方向确定所述访问关系图。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述获取预设范围内的所有主机的进出流量数据，包括：
    在显示屏上展示主机分布地图；
    获取触控轨迹，并确定所述触控轨迹所形成的闭合区域；
    获取所述闭合区域范围内的所有主机的所述进出流量数据。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，在所述依据所述目标访问关系确定访问关系图之后，以及所述依据所述访问关系图提取出目标可疑文件之前，所述方法还包括：
    检测所述访问关系图中是否存在孤立顶点；
    在所述访问关系图中存在所述孤立顶点时，执行所述依据所述访问关系图提取出目标 可疑文件的步骤。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述方法还包括：
    进行网络环境检测，得到目标网络参数；
    依据所述目标网络参数确定目标安全等级；
    在所述目标安全等级低于预设安全等级时，执行所述获取预设范围内的所有主机的进出流量数据的步骤。
  10. 一种异常文件检测装置，其特征在于，应用于电子设备，所述装置包括：获取单元、确定单元、提取单元和检测单元，其中，
    所述获取单元，用于获取预设范围内的所有主机的进出流量数据，并从所述进出流量数据中提取出目标访问关系，所述目标访问关系为以下至少一种：文件与文件之间的访问关系和文件与IP地址之间的访问关系；
    所述确定单元，用于依据所述目标访问关系确定访问关系图；
    所述提取单元，用于依据所述访问关系图提取出目标可疑文件；
    所述检测单元，用于对所述目标可疑文件进行检测，得到检测结果，并输出所述检测结果。
  11. 根据权利要求10所述的装置，其特征在于，在所述对所述目标可疑文件进行检测，得到检测结果方面，所述检测单元具体用于：
    获取所述目标可疑文件的目标操作码；
    将所述目标操作码输入到预设机器学习模型，得到所述检测结果。
  12. 根据权利要求11所述的装置，其特征在于，在所述将所述目标操作码输入到预设机器学习模型，得到所述检测结果方面，所述检测单元具体用于：
    对所述目标操作码进行特征提取，得到目标特征参数；
    将所述目标特征参数输入到所述预设机器学习模型，得到所述检测结果。
  13. 根据权利要求10-12任一项所述的装置，其特征在于，在所述依据所述访问关系图提取出目标可疑文件方面，所述提取单元具体用于：
    依据所述访问关系图确定出所述访问关系图中每一顶点的交互对象数量，得到多个数值，所述访问关系图为有向图且所述访问关系图包括多个顶点；
    从所述多个数值中选取小于预设阈值的目标数值，获取所述目标数值对应的文件作为所述目标可疑文件。
  14. 根据权利要求13所述的装置，其特征在于，在所述获取所述目标数值对应的文件作为所述目标可疑文件方面，所述提取单元具体用于：
    向所述目标数值对应的目标主机发送获取指令，所述获取指令用于获取所述进出流量数据中与所述目标主机相关的至少一个文件；
    接收由所述目标主机反馈的所述至少一个文件；
    从所述至少一个文件中提取所述目标可疑文件。
  15. 根据权利要求10-14任一项所述的装置，其特征在于，在所述依据所述目标访问关系确定访问关系图方面，所述确定单元具体用于：
    提取所述目标访问关系中的第一文件标识、第一IP地址以及访问方向；
    对所述第一文件标识以及所述第一IP地址进行筛选，得到第二文件标识和第二IP地址；
    依据所述第二文件标识、所述第二IP地址以及所述访问方向确定所述访问关系图。
  16. 根据权利要求10-15任一项所述的装置，其特征在于，在所述获取预设范围内的所有主机的进出流量数据方面，所述获取单元具体用于：
    在显示屏上展示主机分布地图；
    获取触控轨迹，并确定所述触控轨迹所形成的闭合区域；
    获取所述闭合区域范围内的所有主机的所述进出流量数据。
  17. 根据权利要求10-16任一项所述的装置，其特征在于，
    所述检测单元，还用于检测所述访问关系图中是否存在孤立顶点；
    由所述提取单元在所述访问关系图中存在所述孤立顶点时，执行所述依据所述访问关系图提取出目标可疑文件的步骤。
  18. 一种电子设备，其特征在于，包括处理器、存储器、通信接口，以及一个或多个程序，所述一个或多个程序被存储在所述存储器中，并且被配置由所述处理器执行，所述程序包括用于执行如权利要求1-9任一项所述的方法中的步骤的指令。
  19. 一种计算机可读存储介质，其特征在于，存储用于电子数据交换的计算机程序，其中，所述计算机程序使得计算机执行如权利要求1-9任一项所述的方法。
  20. 一种计算机程序产品，其特征在于，所述计算机程序产品包括存储了计算机程序的非瞬时性计算机可读存储介质，所述计算机程序可操作来使计算机执行如权利要求1-9任一项所述的方法。
PCT/CN2020/089033 2020-05-07 2020-05-07 异常文件检测方法及相关产品 WO2021223177A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2020/089033 WO2021223177A1 (zh) 2020-05-07 2020-05-07 异常文件检测方法及相关产品
CN202080099571.9A CN115398861B (zh) 2020-05-07 2020-05-07 异常文件检测方法及相关产品

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/089033 WO2021223177A1 (zh) 2020-05-07 2020-05-07 异常文件检测方法及相关产品

Publications (1)

Publication Number Publication Date
WO2021223177A1 true WO2021223177A1 (zh) 2021-11-11

Family

ID=78467766

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/089033 WO2021223177A1 (zh) 2020-05-07 2020-05-07 异常文件检测方法及相关产品

Country Status (2)

Country Link
CN (1) CN115398861B (zh)
WO (1) WO2021223177A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114363212A (zh) * 2021-12-27 2022-04-15 绿盟科技集团股份有限公司 一种设备检测方法、装置、设备和存储介质
CN114650187A (zh) * 2022-04-29 2022-06-21 深信服科技股份有限公司 一种异常访问检测方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107135199A (zh) * 2017-03-29 2017-09-05 国家电网公司 网页后门的检测方法和装置
CN107294982A (zh) * 2017-06-29 2017-10-24 深信服科技股份有限公司 网页后门检测方法、装置及计算机可读存储介质
CN108337218A (zh) * 2017-07-20 2018-07-27 北京安天网络安全技术有限公司 一种基于页面访问量特征识别webshell的方法及系统
US20190158524A1 (en) * 2017-01-30 2019-05-23 Splunk Inc. Anomaly detection based on information technology environment topology
CN109831429A (zh) * 2019-01-30 2019-05-31 新华三信息安全技术有限公司 一种Webshell检测方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101291782B1 (ko) * 2013-01-28 2013-07-31 인포섹(주) 웹쉘 탐지/대응 시스템
CN110162973B (zh) * 2019-05-24 2021-04-09 新华三信息安全技术有限公司 一种Webshell文件检测方法及装置
CN110807194A (zh) * 2019-10-17 2020-02-18 新华三信息安全技术有限公司 一种webshell检测方法及装置
CN110855661B (zh) * 2019-11-11 2022-05-13 杭州安恒信息技术股份有限公司 一种WebShell检测方法、装置、设备及介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190158524A1 (en) * 2017-01-30 2019-05-23 Splunk Inc. Anomaly detection based on information technology environment topology
CN107135199A (zh) * 2017-03-29 2017-09-05 国家电网公司 网页后门的检测方法和装置
CN107294982A (zh) * 2017-06-29 2017-10-24 深信服科技股份有限公司 网页后门检测方法、装置及计算机可读存储介质
CN108337218A (zh) * 2017-07-20 2018-07-27 北京安天网络安全技术有限公司 一种基于页面访问量特征识别webshell的方法及系统
CN109831429A (zh) * 2019-01-30 2019-05-31 新华三信息安全技术有限公司 一种Webshell检测方法及装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114363212A (zh) * 2021-12-27 2022-04-15 绿盟科技集团股份有限公司 一种设备检测方法、装置、设备和存储介质
CN114363212B (zh) * 2021-12-27 2023-12-26 绿盟科技集团股份有限公司 一种设备检测方法、装置、设备和存储介质
CN114650187A (zh) * 2022-04-29 2022-06-21 深信服科技股份有限公司 一种异常访问检测方法、装置、电子设备及存储介质
CN114650187B (zh) * 2022-04-29 2024-02-23 深信服科技股份有限公司 一种异常访问检测方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN115398861A (zh) 2022-11-25
CN115398861B (zh) 2023-06-27

Similar Documents

Publication Publication Date Title
US20160241589A1 (en) Method and apparatus for identifying malicious website
WO2020134790A1 (zh) 一种数据异常检测方法、装置及终端设备
WO2020034710A1 (zh) 指纹识别方法及相关产品
CN105867751B (zh) 操作信息处理方法和装置
CN109947650B (zh) 脚本步骤处理方法、装置和系统
US20200301972A1 (en) Graph analysis of time-series cluster data
CN110995810B (zh) 一种基于人工智能的对象识别方法和相关装置
CN107426177A (zh) 一种用户行为聚类分析方法及终端、计算机可读存储介质
WO2021223177A1 (zh) 异常文件检测方法及相关产品
CN107357725A (zh) 应用测试方法及装置
CN103258163A (zh) 一种脚本病毒识别方法、装置及系统
CA3076319C (en) Systems and methods for device recognition
CN104063400B (zh) 数据搜索方法和装置
CN110069407B (zh) 一种应用程序的功能测试方法和装置
CN107666515A (zh) 图像处理方法和装置、计算机设备、计算机可读存储介质
CN114595124A (zh) 时序异常检测模型评估方法、相关装置及存储介质
CN105227528B (zh) 对Web服务器群的攻击的检测方法和装置
WO2022000430A1 (zh) 服务器威胁评定方法及相关产品
CN106789949B (zh) 一种语音数据的发送方法、装置及终端
CN113704008A (zh) 一种异常检测方法、问题诊断方法和相关产品
CN109450853B (zh) 恶意网站判定方法、装置、终端及服务器
CN109657469B (zh) 一种脚本检测方法及装置
CN116307394A (zh) 产品用户体验评分方法、装置、介质及设备
CN114840570A (zh) 数据处理方法、装置、电子设备及存储介质
CN108287860A (zh) 模型生成方法、垃圾文件识别方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20934376

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11/04/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20934376

Country of ref document: EP

Kind code of ref document: A1