WO2021243716A1 - Suspicious software detection method and apparatus, and computer readable medium - Google Patents

Abstract

Embodiments of the present invention relate to the technical field of security, and in particular to a suspicious software detection method and apparatus, and a computer readable medium, for achieving fast and effective detection of suspicious software. A suspicious software detection method (200) comprises: determining (S201) at least one file (40) that is changed in one device (30); searching for (S202) executable files (41) from the at least one file (40); for each searched executable file (41), performing the following operations: determining (S203) first information (51), the first information comprising information of an operation enabling the executable file (41) to change; determining (S204) second information (52), the second information being used for indicating attributes of the executable file (41); and according to the first information (51) and the second information (52), determining (S205) a suspicious degree of the executable file (41).

Description

Suspicious software detection method, device and computer readable medium Technical field

The embodiments of the present invention relate to the field of security technologies, and in particular, to a method, device, and computer-readable medium for detecting suspicious software.

Background technique

One task of the security analysis is to detect suspicious software installed on the device. Attackers can maliciously install such software to tamper with sensitive data, modify configuration files, etc. Therefore, these suspicious software should be fully and effectively detected.

However, with the development of computer technology, the capacity of device storage media is getting larger and larger. Finding suspicious software from it is like finding a needle in a haystack. Therefore, it is urgent to find an effective method for detecting suspicious software.

At present, when detecting suspicious software, whitelists and blacklists are mainly used. Among them, the software whitelist is a method that only allows specific software and applications to run to maintain security. It is a collection of trusted software. In other words, software that is not on the whitelist is considered untrustworthy, at least suspicious. The software blacklist is a method that only prohibits certain software and applications from running to maintain security. It is a collection of untrusted software, even very suspicious software or malware. Using whitelists and blacklists to detect suspicious software through signatures requires the maintenance of a huge signature database, and for the detection of a specific device, a large amount of information in the signature database is redundant.

Summary of the invention

Consider that most of the data on the device is clean. If the clean data can be filtered out as much as possible, the detection range can be narrowed, and the amount of detection data can be reduced, thereby realizing quick and effective detection of suspicious software. Therefore, the embodiments of the present invention provide a suspicious software detection method, device, and computer readable medium. By adopting the solution provided by the embodiment of the present invention, the detection range of suspicious software can be effectively reduced, and the detection efficiency is higher.

In the first aspect, a method for detecting suspicious software is provided. The method may include:

-Determine at least one file that has changed in a device;

-Find an executable file from the at least one file;

-For each executable file found, perform the following operations: determine the first information, the first information includes the information of the operation that causes the executable file to change; determine the second information, the second information is used for Indicate the attribute of the executable file; determine the suspicious degree of the executable file according to the first information and the second information.

In a second aspect, a suspicious software detection device is provided, which may include:

-A search module configured to determine at least one file that has changed in a device, and search for an executable file from the at least one file;

-A detection module configured to perform the following operations for each executable file found: determine first information, where the first information includes information about operations that cause the executable file to change; determine second information, The second information is used to indicate the attributes of the executable file; the suspicious degree of the executable file is determined according to the first information and the second information.

In a third aspect, a suspicious software detection device is provided, including: at least one memory configured to store computer-readable code; at least one processor configured to call the computer-readable code to execute the software provided in the first aspect step.

In a fourth aspect, a computer-readable medium has computer-readable instructions stored on the computer-readable medium, and when the computer-readable instructions are executed by a processor, the processor executes what is provided in the first aspect step.

Among them, by obtaining the file change information on the device to be detected, the executable file is searched from the changed file, and the suspicious software is detected from the executable file. It can effectively reduce the detection range of suspicious software and improve detection efficiency.

For any of the above aspects, optionally, the third information used to record the file status in the device at each time point in a time period can be obtained, and the third information at each time point can be compared to determine The at least one file that has changed in the device during the time period. In this way, the existing third information can be used to quickly and easily determine the changed file, effectively reducing the detection access of suspicious software. For example: by comparing the VSS snapshot files at different points in time to determine the changed files. VSS snapshot files are designed for data recovery. Here, VSS snapshot files at different points in time are used cleverly to obtain file change information, and accordingly to narrow the detection range of suspicious software, which is convenient and efficient.

Further, the third information at each point in time may be compared to determine the information about the operation that changes each executable file found within the time period. The operating information can be used to determine the degree of suspiciousness of executable files.

For any of the foregoing aspects, optionally, it is determined whether the file is an executable file according to the meta-information of each file in the at least one file.

For any of the foregoing aspects, optionally, the first information includes at least one of the following information:

-Operation information for file creation;

-Modify the operation information of the file;

-Delete file operation information.

For any of the foregoing aspects, optionally, the second information includes at least one of the following information:

-file name;

-File storage path;

-File creation time;

-file type;

-digital signature.

Description of the drawings

FIG. 1 is a schematic structural diagram of a suspicious software detection device provided by an embodiment of the present invention.

Fig. 2 is a flowchart of a suspicious software detection method provided by an embodiment of the present invention.

Fig. 3 is a flowchart of determining the suspicious degree of a file according to file operations in an embodiment of the present invention.

FIG. 4 is a flowchart of determining the suspicious degree of a file according to the file attribute in an embodiment of the present invention.

List of reference signs:

detailed description

The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand and realize the subject described herein, and is not to limit the scope of protection, applicability, or examples set forth in the claims. The function and arrangement of the discussed elements can be changed without departing from the protection scope of the content of the embodiments of the present invention. Various examples can omit, substitute, or add various procedures or components as needed. For example, the described method may be executed in a different order from the described order, and various steps may be added, omitted, or combined. In addition, features described with respect to some examples can also be combined in other examples.

As used herein, the term "including" and its variations mean open terms, meaning "including but not limited to". The term "based on" means "based at least in part on." The terms "one embodiment" and "an embodiment" mean "at least one embodiment." The term "another embodiment" means "at least one other embodiment." The terms "first", "second", etc. may refer to different or the same objects. Other definitions can be included below, whether explicit or implicit. Unless clearly indicated in the context, the definition of a term is consistent throughout the specification.

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

In the embodiment of the present invention, the device that implements suspicious software detection is called the suspicious software detection device 10. The suspicious software detection device 10 can obtain file change information on the device 30 to be detected, search for executable files from the changed files, and detect suspicious software from the executable files. By obtaining file change information, the detection range of suspicious software can be narrowed, and the detection efficiency has been greatly improved. Among them, the device to be tested 30 may be any computer device, or a device with a computer architecture, and may include a computer, a notebook computer, a tablet computer, an industrial computer, a server, an embedded device, and so on. It can be used for testing various equipment such as industrial control equipment and household equipment.

The suspicious software detection apparatus 10 may be implemented as a network of computer processors to execute the suspicious software detection method 200 in the embodiment of the present invention. The suspicious software detection apparatus 10 may also be a single computer as shown in FIG. The suspicious software detection device 10 may also include at least one memory 101, which includes a computer-readable medium, such as a random access memory (RAM). The device 10 also includes at least one processor 102 coupled with at least one memory 101. Computer-executable instructions are stored in at least one memory 101, and when executed by at least one processor 102, can cause at least one processor 102 to perform the steps described herein. The at least one processor 102 may include a microprocessor, an application specific integrated circuit (ASIC), a digital signal processor (DSP), a central processing unit (CPU), a graphics processing unit (GPU), a state machine, and the like. Examples of computer-readable media include, but are not limited to, floppy disks, CD-ROMs, magnetic disks, memory chips, ROM, RAM, ASICs, configured processors, all-optical media, all magnetic tapes or other magnetic media, or computer processors can be used from them Any other medium for reading instructions. In addition, various other forms of computer-readable media can send or carry instructions to the computer, including routers, private or public networks, or other wired and wireless transmission devices or channels. Instructions can include codes in any computer programming language, including C, C++, C language, Visual Basic, Java, and JavaScript.

When executed by at least one processor 102, the at least one memory 101 shown in FIG. 1 may contain a suspicious software detection program 20, so that at least one processor 102 executes the method 200 for suspicious software detection described in the embodiment of the present invention. . The suspicious software detection program 20 may include:

-A search module 201 configured to determine at least one file 40 that has changed in the device 30, and search for the executable file 41 from the at least one file 40;

-A detection module 202 configured to perform the following operations for each executable file 41 found:

-Determine the first information 51, the first information includes the information of the operation that causes the executable file 41 to change;

-Determine the second information 52, which is used to indicate the attributes of the executable file 41;

-Determine the degree of suspiciousness of the executable file 41 according to the first information 51 and the second information 52.

Optionally, when the searching module 201 determines at least one file 40 that has changed in the device 30, it is configured to:

-Obtain the third information 53 used to record the status of the files in the device 30 at various points in a time period;

-Compare the third information 53 at various points in time to determine at least one file 40 that has changed in the device 30 during this time period.

Among them, the first information 51 (including the information of the operation that causes the executable file 41 to change), the second information 52 (information for indicating the attributes of the executable file 41), and the third information 53 (used in the recording device 30 The file status information) can be stored in at least one memory 101.

For example, the first information 51 may include at least one of the following information:

-Operation information 511 for file creation;

-Modify file operation information 512;

-Delete file operation information 513.

The second information 52 may include at least one of the following information:

-File name 521;

-File storage path 522;

-File processing time 523;

-File type 524;

-Digital signature 525.

It should be mentioned that the embodiment of the present invention may include a device having a structure different from that shown in FIG. 2. The foregoing architecture is only exemplary, and is used to explain the method 200 provided by the embodiment of the present invention. For example, the suspicious software detection device 10 can be implemented as a piece of software, including a suspicious software detection program 20, which can be deployed on the device 30 to be detected and used to detect suspicious software on the device 30.

In addition, the above-mentioned modules can also be regarded as various functional modules implemented by hardware, which are used to implement various functions involved in the suspicious software detection method performed by the suspicious software detection device 10, such as pre-processing the various processes involved in the method. The control logic is burned into a Field-Programmable Gate Array (FPGA) chip or a Complex Programmable Logic Device (CPLD), and these chips or devices perform the functions of the above-mentioned modules. The specific implementation method may depend on engineering practice.

As shown in FIG. 2, an exemplary method 200 according to an embodiment of the present invention includes the following steps:

-S201: Determine at least one file 40 that has changed in one device 30;

-S202: Search for the executable file 41 from the aforementioned at least one file 40, and perform the following operations for each executable file 41 found:

-S203: Determine the first information 51, the first information includes the information of the operation that causes the executable file 41 to change;

-S204: Determine the second information 52, the second information is used to indicate the attributes of the executable file 41;

-S205: Determine the suspicious degree of the executable file 41 according to the first information 51 and the second information 52.

Optionally, in step S201, the suspicious software detection device 10 may obtain the third information 53 used to record the status of the file in the device 30 at each time point in a time period, and compare the third information 53 at each time point. , To determine at least one file 40 that has changed in the device 30 during the time period; and in step S203, the third information 53 at each time point can be compared to determine each file 40 found in the time period. An executable file 41 changes operation information.

Taking the device to be tested 30 running the Volume Snapshot Service (VSS) as an example, in step S201, VSS snapshot files at various points in time within a period of time can be obtained. Sort these VSS snapshot files in chronological order, and then compare adjacent VSS snapshot files one by one, you can identify the changed files 40, and can identify the information of the operations that caused these files to change. These operations include: create, delete And modify.

In step S202, it can be determined whether the file is an executable file according to the meta information of the changed file 40, such as the format of the file. For example: In the WINDOWS operating system, different types of files have different formats, and the file type can be determined by parsing the file format. Executable files may include scripts, binary executable files, and so on. This can further narrow the detection range of suspicious software.

In step S205, the degree of suspiciousness of the executable file 41 may be determined according to the determined first information 51 and second information 52. For example, the suspicious degree of an executable file 41 can be measured by scoring. The lower the score, the higher the suspicious degree. A possible implementation manner is to score according to the first information 51 to obtain a first score value 71; to score according to the second information 52 to obtain a second score value 72. Then calculate a total score value based on the first score value 71 and the second score value 72 (such as the sum of the two score values or the weighted sum), and determine the suspiciousness of the executable file 41 based on the total score value degree.

Next, referring to FIG. 3, the sub-step S2051 of determining the first score value 71 based on the first information 51 will be described. Sub-step S2051 may further include:

-S20511: Determine the content of the first message 51. If the message 51 includes the file creation operation information 511, perform sub-step S20512; if the message 51 includes the file modification operation information 512, perform the sub-step S20513; if the message 51 includes delete For the operation information 513 of the file, sub-step S20514 is executed.

-S20512: Determine the first score value 71 minus 2;

-S20513: Determine the first score value 71 minus 1;

-S20514: Determine the first score value 71 minus 1.

The foregoing process of determining the first score value 71 based on the first information 51 is only an example. In fact, there may be multiple determination methods. It can be seen from the foregoing methods that the executable file 41 is determined to be highly suspicious for the operation of creating a file. For the operations of modifying files and deleting files, it is determined that the suspicious degree of the executable file 41 is slightly lower, while for files that have not changed, the suspicious degree is not considered. Therefore, as long as the above judgment rules can be realized, the purpose of determining the suspicious degree of executable files according to the types of file operations can be achieved.

Next, referring to FIG. 4, the sub-step S2052 of determining the second score value 72 based on the second information 52 will be described. Sub-step S2052 may further include:

-S20521: Compare the file name 521 of the executable file 41 with the system file name 521'. If the file name judgment condition 61 is met (for example, the similarity between the two is greater than the preset threshold), it means that the two are similar, then execute the sub Step S20522, otherwise, skip the sub-step S20522 and directly execute the sub-step S20523.

-S20522: Determine the second score value 72 minus 3, and then perform sub-step S20523.

-S20523: Compare the file storage path 522 of the executable file 41 with the designated directory 522', where the designated directory 522' may include but is not limited to: system directory, user profile directory, temporary (temp) directory, etc. If the file storage path judgment condition 62 is satisfied (for example, the directories are the same), the sub-step S20524 is executed, otherwise, the sub-step S20524 is skipped and the sub-step S20525 is directly executed.

-S20524: Determine the second score value 72 minus 1, and then perform sub-step S20525.

-S20525: Compare the file processing time 523 of the executable file 41 with the creation time value range 523', if the file processing time judgment condition 63 is met (for example: the time related to a file includes: file creation time, file modification time, file Access time and MFT record change time, if the file creation time is greater than other types of file time, or all types of file time is 0, these two conditions are met either), perform sub-step S20526, otherwise, skip sub-step S20526 And directly execute the sub-step S20527.

-S20526: Determine the second score value 72 minus 2, and then perform sub-step S20527.

-S20527: Compare the file type 524 of the executable file 41 with the specified file type 524'. If the file type judgment condition 64 is met (for example: the file type is a system file, a hidden file, a read-only file or an archive file), then execute the sub Step S20528, otherwise skip the sub-step S20528 and directly execute the sub-step S20529.

-S20528: For any of system files, hidden files, read-only files and archive files, as long as the executable file 41 belongs to any of these file types, the second score value 72 is determined to be minus 1, if the executable file 41 is If it belongs to three of the above four types, the second point value 72 minus 3 is determined.

-S20529: Determine whether the digital signature 525 of the executable file 41 satisfies the digital signature judgment condition 65 (for example: the digital signature is valid), if yes, execute the sub-step S20530, otherwise, skip the sub-step S20530 and directly get the final second score The value is 72.

-S20530: Determine the second point value 72 plus 50.

The above process of determining the second score value 72 based on the second information 52 is only an example. In fact, there are many ways to determine the value. From the above methods, it can be seen that if the file name of the changed executable file 41 is similar to the system file name, the file name is similar to the system file name. The storage path is in the above designated directory 522', the file creation time meets the preset condition, and the file type is the above designated file type 524', the suspicious degree is greater, and if the digital signature is valid, the suspicious degree will be greatly reduced. Therefore, as long as the above judgment rules can be realized, the purpose of determining the suspicious degree of executable files according to the types of file operations can be achieved.

Below, give an example. A scvhost.exe file and an application.exe file are mirrored, and the first score value 71 and the second score value 72 are determined using the above process, and the total score value is determined accordingly to determine the suspicious degree of the executable file 41. The total scores of these two files are -8 and 50 respectively, indicating that scvhost.exe is more suspicious.

Table 1 shows the determination process of the second score value 72. Table 2 shows the determination process of the first score value 71 and the total score value.

Table 1

Table 2

In addition, the embodiments of the present invention also provide a computer-readable medium having computer-readable instructions stored on the computer-readable medium. When the computer-readable instructions are executed by a processor, the processor executes the aforementioned suspicious software detection. method. Examples of computer-readable media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tape, Volatile memory card and ROM. Alternatively, the computer-readable instructions can be downloaded from the server computer or the cloud via the communication network.

In summary, the embodiments of the present invention provide a suspicious software detection method, device, and computer-readable medium. In the traditional method, the white list and the black list are adopted, and huge and comprehensive data needs to be maintained, while the solution provided by the embodiment of the present invention does not need to maintain the database in advance. In addition, most of the data in the whitelist and blacklist is redundant for the detection of a specific device or system. In the solution provided by the embodiment of the present invention, the detection result is based on the file in the device itself, so the detection result is more accurate and can be applied to various devices and systems. Further, adopting the whitelist and blacklist methods requires frequent updating of the signature database, and the solution provided in the embodiment of the present invention can detect suspicious software as long as the file changes in the device can be detected without updating the database. Finally, the whitelist and blacklist are set based on known suspicious software, and unknown suspicious software cannot be detected. However, in the solution provided in the embodiment of the present invention, the characteristics of the suspicious software itself are summarized, and the suspicious software is detected accordingly. , So there is a chance to find all kinds of unknown suspicious software.

It should be noted that not all steps and modules in the above processes and system structure diagrams are necessary, and some steps or modules can be ignored according to actual needs. The order of execution of each step is not fixed and can be adjusted as needed. The system structure described in the foregoing embodiments may be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by multiple physical entities. Some components in independent devices are implemented together.

Claims (10)

1. A method (200) for detecting suspicious software, which is characterized in that it comprises:

   -Determine (S201) at least one file (40) that has changed in a device (30);

   -Find (S202) the executable file (41) from the at least one file (40);

   -For each executable file (41) found, perform the following operations:

   -Determine (S203) the first information (51), the first information includes the information of the operation that causes the executable file (41) to change;

   -Determine (S204) the second information (52), which is used to indicate the attributes of the executable file (41);

   -Determine (S205) the suspicious degree of the executable file (41) according to the first information (51) and the second information (52).
2. The method according to claim 1, wherein determining (S201) at least one file (40) that has changed in a device (30) comprises:

   -Obtain the third information (53) used to record the file status in the device (30) at various points in a time period;

   -Comparing the third information (53) at various points in time to determine the at least one file (40) that has changed in the device (30) during the time period.
3. The method according to claim 2, wherein said determining (S203) the first information (51) comprises:

   -Comparing the third information (53) at each time point to determine the information of the operation that changes each executable file (41) found within the time period.
4. The method according to claim 1, wherein searching (S202) an executable file (41) from the at least one file (40) comprises:

   -Determine whether the file is an executable file according to the meta-information of each file in the at least one file (40).
5. The method according to claim 1, wherein the first information (51) includes at least one of the following information:

   -Operational information for file creation (511);

   -Modify file operation information (512);

   -Delete file operation information (513).
6. The method according to claim 1, wherein the second information (52) includes at least one of the following information:

   -File name (521);

   -File storage path (522);

   -File creation time (523);

   -File type (524);

   -Digital signature (525).
7. A suspicious software detection device (10), characterized in that it comprises:

   -A search module (201) configured to determine at least one file (40) that has changed in a device (30), and search for an executable file (41) from the at least one file (40);

   -A detection module (202), configured to perform the following operations for each executable file (41) found:

   -Determine the first information (51), the first information including the information of the operation that causes the executable file (41) to change;

   -Determine second information (52), which is used to indicate the attributes of the executable file (41);

   -Determine the suspicious degree of the executable file (41) according to the first information (51) and the second information (52).
8. The apparatus according to claim 7, characterized in that, when the search module (201) determines at least one file (40) that has changed in a device (30), it is configured to:

   -Obtain the third information (53) used to record the file status in the device (30) at various points in a time period;

   -Comparing the third information (53) at various points in time to determine the at least one file (40) that has changed in the device (30) during the time period.
9. A suspicious software detection device (10), characterized in that it comprises:

   At least one memory (101) configured to store computer readable codes;

   At least one processor (102) is configured to invoke the computer readable code to execute the method according to any one of claims 1 to 6.
10. A computer-readable medium, characterized in that, computer-readable instructions are stored on the computer-readable medium, and when the computer-readable instructions are executed by a processor, the processor executes as claimed in claims 1 to 6 Any one of the methods.

Images