WO2008098495A1 - Method and device for determing object file - Google Patents

Abstract

A method for determining object file is disclosed, which is based on a storage unit for storing a characteristic character string universal set. The method includes: selecting the characteristic character string universal set for determining a object file in the storage unit (11), the universal set comprises at least one characteristic character string for determining the object file; according to the rule, looking up the characteristic character string of the universal set in the file which waits to be detected and obtaining the result (12), and judging whether the lookup result satisfies the first condition or not (13), if yes, determining the file which waits to be detected is the object file (14). A device for determining object file is further provided.

Description

 Method and device for determining target file

 The present invention relates to a method and apparatus for determining whether a data set is a desired data set.

Background technique

 In order to determine whether a data set that has been obtained is the desired data set, or to determine whether a obtained file is a desired file, or to search for a target data or a data set to be searched from a large amount of original data, usually To determine at least one feature data string in advance, and to use the obtained data set as the detected object, by searching whether the feature data string exists in the data set, it can be known whether the data set is the expected data. set. However, when the feature data string is large and in a discrete state, on the one hand, if the detected data set is large or the feature data string is large and/or large, it will consume more time and make it operable. Sexuality is poor; on the other hand, if the location of the feature data string that may appear in the detected data set is predetermined, the probability of successful retrieval will become very small.

 For example, if the image represented by the simulated portrait is found in the face image database, it is an attempt to determine whether there is a target image to be searched in the face image database; if a feature command or data of a virus is found in a suspicious program, it is an attempt. Determine if the suspicious program is a virus program. Since the image or feature instruction represented by the simulated portrait is involved in many feature data and is in a discrete state, the existing method is difficult to realize fast and efficient search and determination of the target data set. There is also a case in practice, assuming that a feature set of a virus program contains 10 features, that is, a combination of feature sets of various virus programs or variant virus programs in various known virus programs of the virus program. There are 10 features in the set, and the features contained in the feature set of each specific virus program or variant virus program may be only a part of the feature set of the virus program. In this situation, it is more difficult to determine a program sample with a virus signature, and thus it is difficult to effectively judge whether a suspicious program is a virus program.

Summary of the invention

The problem to be solved by the present invention is to provide a method and apparatus for determining an object file capable of quickly and accurately determining a detected data set, thereby realizing quick and accurate determination of whether the detected file is As the target file.

 The method for determining an object file according to the embodiment of the present invention, based on storing the storage unit of the feature string complete set, includes: selecting, in the storage unit, a feature string set for determining the target file, where the set includes at least one for determining The characteristic string of the target file;

 Searching for the character string in the set in the file to be detected according to the rule, obtaining the search result, and determining whether the search result satisfies the first condition, and if yes, determining that the file to be detected is the target file.

 The following steps may be used to find the string in the set in the file to be detected according to the rule:

 Each time a feature string in the set is selected until each feature string in the set is selected once, for each feature string selected, the file to be detected is scanned, and the feature string is obtained. The valid position in the file is detected, and the position of all the feature strings in the file to be detected is used as the search result.

 The following step may also be used to search for the character string in the set in the file to be detected according to the rule: selecting an unselected feature string in the set until the accumulated result satisfies the first rule, for selecting Each of the feature strings scans the file to be detected, obtains a valid position of the feature string in the file to be detected, accumulates the valid position, and obtains a cumulative result. After the search for the detected file ends, the accumulated result is used as a search result. result.

 The first rule is: in the cumulative result, the sum of the found feature strings in the valid position in the file to be detected reaches a set value; or, in the cumulative result, the feature string that is effectively found in the file to be detected The number of the characters reaches the set value; or, in the cumulative result, the positional relationship of the feature string that is effectively found in the file to be detected satisfies the set sequence feature and/or the interval feature.

 The first condition is: in the search result, the number of feature strings that are effectively found in the file to be detected reaches a set value; or, the search result is effectively found in the file to be detected. The positional relationship of the feature strings satisfies the set sequential features and/or spacing features.

The method further includes: determining a feature character of each feature string and a second rule for constructing a corresponding feature string according to the feature character; and scanning the file to be detected according to the following steps: in the file to be detected, Finding the feature character until the file to be detected is searched, and for each of the found feature characters, constructing a corresponding feature string according to the second rule, if The feature string is successfully built, and the feature string position of the successful construction is taken as a valid position. Moreover, if the character of the feature string constructed according to the second rule is identical or the same as the character of the feature string as the basis of the search reaches the set value, it is determined that the feature string is successfully constructed.

 The apparatus for determining an object file provided by the embodiment of the present invention includes a storage unit that stores a complete set of feature strings, and further includes:

 a feature string selection unit that selects, in the storage unit, a set of feature strings for determining the target file, the set including at least one feature string for determining the target file;

 a file scanning unit, configured to search for a string in the set in the file to be detected according to a rule, and obtain a search result;

 a determining unit, configured to determine whether the result satisfies the first condition, and,

 The target file determining unit determines that the file to be detected is a target file when the result satisfies the first condition.

 According to the method and apparatus for determining an object file according to an embodiment of the present invention, a feature string set for determining a target file needs to be selected, and a string in the set is searched for in the file to be detected according to a rule, and after the search result is obtained, And determining whether the search result satisfies the first condition, thereby determining that the to-be-detected file is a target file. Since the search rules and the judgment conditions are adopted in the determination process, the rules and conditions can be used to constrain the feature string search, such as fuzzy search and the nature of the detected file, and the purpose of detection, so that the search judgment is more targeted, and thus can Quickly and accurately determine the set of detected data.

 Other advantages of the invention are described in detail in the following text.

DRAWINGS

 Figure 1 is a flow chart of a first embodiment of the method of the present invention;

 2 is a flow chart of searching for a set of feature characters in a file to be detected, which is used in the embodiment of FIG. 1;

 3 is a database structure diagram of a storage feature string used in the embodiment of FIG. 1. FIG. 4 is a block diagram of an embodiment of the apparatus according to the present invention.

detailed description

In practical applications, determine whether a file (or determine a data set) is desired. The method of finding the target file has a very wide range of applications. By searching for features, the method can determine whether a file is a duplicate of another file, or whether a file is infected by a virus program, and the like. Whether it is a copy of a file or a file infected by a virus program, it contains features of the active file or infected features. These features usually have the characteristics of large amount of data, uncertainty, and large data dispersion. Therefore, it is difficult to determine which of these features will appear in the file to be detected, and it is more difficult to determine the existence of these features in the file to be detected. Form and specific location. For example, a suspicious program has an instruction feature to delete data, but what parameters the instruction feature carries and what additional conditions are available to determine that the suspicious program is a virus program is uncertain. Therefore, the use of existing methods to quickly find a large number of such suspicious programs takes a lot of time, or has a lower detection success rate at the same time and separately.

 Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

 BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a flow chart of a first embodiment of the method of the present invention. In this embodiment, since any data or file can be converted or boiled into a character string having a certain encoding rule, such as a string encoded by ASCI I, the present embodiment takes the lookup of the character string as . The output of Fig. 1 is a file to be detected which is obtained in advance.

 According to Figure 1, the set of feature strings is first determined in step 11, which is a pre-processing step and is the basis for subsequent steps. In many applications, the feature string is also referred to as a "fingerprint." The set of feature strings contains a feature string for determining the target file, which is the basis for finding the same or similar files. For a simpler case, sometimes a feature string can be used to determine whether the file to be detected is the target file, but more often it requires a lot of feature strings to determine whether the target file is to be detected. And the feature string included in the set of feature strings is at least one or more. The set uses a data part feature string in the form of a two-dimensional table and its corresponding auxiliary data in this embodiment. Of course, the database can also be replaced by other data structures, such as a linear queue.

A typical database structure is shown in Figure 3. Among them, the fields "number", "character string" and "length" are the most basic. If the length of the selected feature string is equal, the length can also be removed. Other fields are used for Figure 1. Further improvements of the described embodiments or other embodiments can be seen as auxiliary data to improve the performance of the methods described in the embodiments. It should be noted that the step 11 selects, in the database, a set of feature strings for determining the target file, and is a feature string that is used in determining a certain object file, and the feature strings are for different target files. The judgment is different. For example, if it is judged whether the file B is a copy of the file A, it is necessary to extract the complete set of these features in the file A, and then select or determine the feature for the specific judgment from the feature set in the judgment of the specific object file. A collection of strings. For another example, if it is determined whether a file is a virus program or a virus program, it is necessary to extract the complete set of the characteristics of the virus program in advance, and then select or determine from the feature set for the specific target file. A collection of feature strings that are evaluated. However, there are many ways to extract the complete set of these features in a file A, and how to obtain a complete set of virus programs or certain virus program features. A detailed description of similar methods is also found in other applicant patents. In the database of the structure shown in FIG. 3, it is used to store such a complete set of feature strings for detecting a certain target file, and if used to store the complete set of feature strings for detecting all of the various target files, only You need to add a field to identify the number or name of the target file that a feature string is used for detection. For the detection of different items of one of the target files, the feature group field management can be used. and many more.

Therefore, it is necessary to analyze and obtain characteristic information of a typical kind of target file type in advance. For simple cases, such as finding a simple search such as a replica, you can automatically analyze the source file by multi-pattern matching, etc. For complex situations, such as determining whether a virus file, or a virus-infected file, etc. The characteristic string may also require manual participation. For example, whether analyzing illegal network access feature information or analyzing virus feature information, there are various methods and processes for analyzing, and there are also various ways to analyze the attribute or type of feature information, and the analysis process This can be done manually or by computer. The feature string determined according to the feature information can be selected and stored according to actual conditions and needs. In the present embodiment, an example of analyzing and obtaining a character string of a virus program using a computer tool is provided. This example uses a tool program such as DEBUG, PR0VIEW, and a special test system to analyze the characteristic information of the virus. The reason why the dedicated test system is used is because the object of analysis may be a virus, and it is very likely that it will continue to spread or even attack at the stage of analysis. The specific analysis process can use DEBUG or other disassembly tool program to print the virus code into a disassembled program list, analyze the code segment of the virus with characteristic information, and also use the dynamic analysis of the virus components. What calls or actions to the system, and what actions are taken Ways and processes to analyze a series of operational behaviors of the virus. The characteristic information corresponding to the above-mentioned virus or the characteristic string corresponding to the operational behavior of the virus is stored in a database manner, so that it is further used to identify and determine whether other programs to be detected are virus programs.

 The determination of the feature string should generally satisfy the following conditions: uniqueness, length as short as possible, and so on. Step 11 determines the set of feature strings, mainly considering the discreteness of the feature data and the uncertainty of the position in the file to be detected, and decomposing the feature data into different feature character subsets with smaller number of characters. , that is, the feature string. Based on the set of feature strings determined in step 11, the string in the set is searched in the file to be detected according to the rule in step 12, and the search result is obtained. The rules described here are different for different target files, mainly considering the speed of search and the accuracy of the search, and the search strategy based on the nature of the target file being looked up. The simplest rule is to retrieve each feature string in the feature set in the file to be tested. In this embodiment, the following steps are used to search for the feature string in the set in the file to be detected according to the rule: each time a feature string in the set is selected, until each feature string in the set After being selected once, for each feature string selected, the file to be detected is scanned, the effective position of the feature string in the file to be detected is obtained, and the position of all the feature strings in the file to be detected is used as the search result. Refer specifically to Figure 2.

 Step 13 determines whether the search result satisfies a preset condition. If yes, it determines in step 14 that the file to be detected is a target file, and then performs subsequent processing. Otherwise, the determining operation ends in step 15.

 A specific example of scanning a file to be detected as described in step 12 is shown in FIG. In the steps

21: reading an unselected feature string from the set of feature strings, and then scanning the file to be detected in step 22 by using the feature string, that is, searching for the feature string in the file to be detected; In step 23, it is determined whether the feature string is scanned or found. When it is not determined that the character portion that has been scanned contains the feature string, the process returns to step 22 to continue the subsequent scan; if it is determined in step 23 that the character portion that has been scanned includes the In the case of the feature string, the result of the scan is recorded in step 24. For example, in this example, the effective position of the feature string in the file to be detected is recorded, and the effective position includes the offset of the feature string in the file to be detected. , length, etc. The valid position refers to a position when the feature string is completely included in the file to be detected, when the feature string does not completely contain the file in the file to be detected, and the file is not found in the file to be detected. Characteristic String, there is no valid position of the feature string. However, due to the need for subsequent management and judgment, "empty" is also recorded in the valid location field in the management table, and the identifier is not found in the file to be detected.

 For example, suppose a scan result table contains three fields of "feature string number" "start position" "length", for feature string ACDS numbered 1 and feature string DFS numbered 2, and file to be detected QWERTACDSYASDFGHZXCVB , based on the result of the scan of the characteristic string ACDS, that is, the description of the scan result table is: "1" "6" "4"; the result of the scan of the feature string DFS is: "2" "0" " 3" , where "0" in the middle of the scan result of DFS means "empty", that is, the feature string DFS is not scanned.

 In this example, the step 23 further includes another judgment content, that is, whether the scan is finished, and if it is finished, the scan operation is terminated, and the process proceeds to step 26 to determine and obtain the final search result (because the branch is obvious, the figure 2 is not Draw).

 Step 25 is used to determine whether each feature string in the feature string set is completely scanned. If not all the scans are completed, then step 21 is performed to select the next unselected feature string to continue the scanning operation, otherwise it is determined in step 26. And get the final search results. Mode selection, as long as the selected feature string is not repeated.

In the embodiment shown in Fig. 1, the method of finding the effective position of each feature string in the file to be detected may not be very necessary, and in some cases, the efficiency of the search is lowered. For example, for a virus program, eight feature strings are included in a set of feature strings, and when four feature strings have a certain order and interval feature, it can be determined whether the file to be detected is a target. The judgment conclusion of the document. In order to solve such a problem, the second embodiment of the present invention provides another method of searching for a character string in the set in a file to be detected. The method selects an unselected feature string in the set, scans the to-be-detected file for each feature string selected, and obtains a valid position of the feature string in the file to be detected, and accumulates The effective position obtains a cumulative result. If the accumulated result satisfies a predetermined rule, it indicates that the detected file can be determined based on the current accumulated result, so that the detection of the detected file can be ended, and the cumulative result is obtained. As a result of the search, further processing is performed. The text described above contains The meaning is that if the accumulated result satisfies a predetermined rule, the search can be ended early without having to select each feature string in the feature set once, thereby improving the search for the set in the file to be detected. The efficiency of the feature string.

 In the second embodiment, even if there is no result for the search for a feature string, the result of the search should be recorded when the search result is accumulated due to management or other such as statistical needs, etc., that is, the search result is "empty", indicating that there is no Found; of course, if there is a clear search result, it is necessary to record the positional parameter of the feature string in the file to be detected.

 In the second embodiment, for a valid position of a specific feature string in the file to be detected, the first effective position may be recorded, and all valid positions may be recorded, depending on actual needs, in one This is possible when the feature string in the collection has explicit position or relationship characteristics. For example, a virus program has a full set of feature strings: Al, A2, A3, A4, A5. According to the characteristic string of the ensemble, when the feature string combination and the order relationship described in the following feature set 1 appear in a to-be-detected program, the program to be detected is regarded as a virus program; when a program to be detected appears When the feature string combination and the order relationship described in feature set 2 are described, the program to be detected is considered to be a specific virus program.

 The feature set 1 is: {A1 A3 A4 , A1 A3 A4 A5 , Al A1 A3 A4 A5 Al , A2 A4 A5 , A1 A3 A5 , A3 A4 A5 , Al A4 A5 , Al A2 A3 A4 A5};

 Feature set 2 is: {A1 A3 A5 , A3 A4 A5 , Al A4 A5 , Al A2 A3 A4 A5}; Obviously, for feature set 1, the feature string may appear multiple times in the file to be detected to be able to determine the program to be tested Whether it is a virus program, therefore, in this case, it is necessary to record all valid positions of the feature string in the file to be detected. For the feature set 1, the feature string appears once in the file to be detected to determine whether the program to be detected is a virus program. To improve the detection efficiency, only the feature string is recorded in the file to be detected for the special detection. A valid position that appears once. The effective position includes at least an offset parameter. If the length of the feature string is different, the length parameter needs to be included. In other embodiments, the setting further includes a parameter indicating a discrete relationship of the specific character allowed by the feature string, and the like. .

The feature string in the set is searched in the file to be detected in an exact matching manner, which may cause a decrease in the search accuracy in some cases. For example, a feature string for a virus program may change in its variant virus program, thereby increasing the misjudgment of a program to be tested. Possibility. In a copy of a text file copied by a different replicator, the feature string determined from the original text file also changes. This change may be due to different parameters carried or other reasons. Although the characteristic string of the virus is the most representative virus characteristic string selected after careful analysis of the virion, which is sufficient to distinguish the virus from other viruses and other variants of the virus, the virus program and the normal non-virus are used. Programs are separated to avoid processing non-virus programs as virus programs. However, due to variants of the virus program, the specific composition of the feature string may change due to differences in carrying parameters. Thus, if the program to be detected is a virus program or a variant virus program, the feature information therein may contain one to several "fuzzy" bytes. In this case, as long as the string other than the "fuzzy" byte can be perfectly matched, the feature string can also be discriminated, and then the judgment of whether the program to be detected is a virus program is obtained. For example: Given the characteristic string: "E9 7C 00 10 ? 37 CB", then "E9 7C 00 10 27 37 CB" and "E9 7C 00 10 9C 37 CB" can be recognized, for example: "E9 7C 37 CB" can match "E9 7C 00 37 CB" , "E9 7C 00 11 37 CB" and "E9 7C 00 11 22 37 CB" but does not match "E9 7C 00 11 22 33 44 37 CB" because 7C and The substring between 37 has exceeded a certain length, exceeding the limit of the spacing feature. Therefore, it is necessary to blur the search according to a predetermined rule.

 In the second embodiment, the predetermined rule supporting the fuzzy lookup is: the cumulative result of the positional relationship of the feature string that is effectively found in the file to be detected satisfies the set sequence feature, the interval feature, or both Sequential features and spacing characteristics are met. The sequence features include combinations and/or permutations of feature strings. The order feature and the interval feature are different for the determination of object files of different purposes and different properties. The interval feature reflects a discrete relationship of constituent characters of a feature string. For example, the interval between constituent characters of a feature string should not exceed a certain number of characters, depending on actual different purposes and targets of different natures. The documentation determines the need.

In other embodiments, the predetermined rule supporting the fuzzy search may also be: in the cumulative result, the sum of the found feature strings in the valid position in the file to be detected reaches a set value, that is, the found feature character. The number of valid positions of the string reaches the set value; or, in the cumulative result, the number of feature strings that are effectively found in the file to be detected reaches the set value. The way in which that method is used as the determination rule is also determined according to actual needs. Such rules may be different for the determination of object files of different purposes and different natures, and many such rules need to be predetermined. The "purpose" described here is often equivalent to "requirement". For example, determining whether a file to be inspected is a target file according to the probability or possibility required, thereby achieving an efficiency, false positive rate and missed rate. Comprehensive balance. The "nature" also has an impact on the determination of different object files. For example, the regularity of the distribution and/or composition of feature strings that a file has may be different from the regularity of distribution and/or composition of another file. Typical regularities are different, such as discreteness, which may be due to Different factors such as carrying different parameters or operating object data are different.

 Since the foregoing fuzzy search does not require an exact match, it is more suitable for the case where the feature string is changed in the file to be detected, and since different fuzzy rules can be selected according to specific search requirements, the present embodiment can be made relatively the first embodiment. Further improve the efficiency, the miss rate and the accuracy of determining whether a file to be detected is a target file.

 In the two embodiments mentioned above, the search result can determine whether the file to be detected is the target file only after the step 13 determines whether the predetermined condition is met. The condition described herein may be: in the search result, the number of feature strings that are effectively found in the file to be detected reaches a set value; or, the search result is valid in the file to be detected. The positional relationship of the found feature string satisfies the set sequence feature and/or interval feature. and many more. It should be noted that the "conditions" described here may be the same as or different from the "rules" described above. In the case of determining whether the file to be detected is a target file, the same may be the same. In this case, step 13 may directly use the judgment result of the foregoing steps to draw a conclusion, or simply omit step 13. In the determination of whether the more complex file to be detected is the target file, it may be different. In this case, the preferred method of the previous "rule" is to pay attention to efficiency, and the condition of the following step 13 is to focus on accuracy. This can improve the overall performance of the method embodiment. Of course, as mentioned above, the conditions described herein may also be various depending on actual needs.

 Although the first and second embodiments are capable of solving efficiency and reliability problems by fuzzy search, when the feature string is large, the method of scanning the character to be detected can still be improved to further improve the search efficiency of the feature string. .

A third embodiment of the present invention provides such an improvement. Different from the first and second embodiments, the third embodiment adds a step of: determining a feature character of each feature string and a second rule for constructing a corresponding feature string according to the feature character, This is also a step equivalent to "initialization". In practical applications, each feature string has a relatively stable part. For example, for a destructive instruction, such as a delete instruction, the instruction itself usually does not change. The change is usually the parameter of the carried parameter or the operation object data. The position in the feature string, therefore, by determining that the most stable part of each feature string is a feature character, since the number of feature characters is small, the feature string can be quickly located by the feature character search. Therefore, the feature character can also be referred to as an "anchor". For different feature strings, those specific characters that are suitable as feature characters are usually indeterminate, and the position in the feature string is also uncertain, so after the feature characters of a feature string are determined, The position of the feature character in the feature string and the composition characteristic of the feature string itself determine a second rule for constructing the corresponding feature string in accordance with the feature character. It can be seen that this embodiment attempts to provide a method for quickly locating feature strings through "anchors" and quickly "assembling" feature strings.

 For example, the feature string 1 is (represented by the ASCI I code): 23 4E 6F 55 77 09 OA 9D 34 8C, if "6F 55" is used as the feature character, the rule that the feature character constructs the corresponding feature string may be : "2, 6" , indicating that the character "6F 55" in front of the two characters "23 4E" and the following six characters "77 09 OA 9D 34 8C" can constitute the corresponding feature string; if "23 4E "As a feature character, the rule that the feature character constructs the corresponding feature string may be: "0, 8", indicating 0 characters preceding the feature character "23 4E 6F", that is, no characters and the following 7 characters" 55 77 09 OA 9D 34 8C" can form the corresponding feature string, and so on. In this way, the feature string can be quickly located in the file to be detected by the feature character, thereby quickly determining whether the located feature string is the feature string that is desired to be found.

 Therefore, in the third embodiment, the file to be detected is scanned according to the following steps:

 In the to-be-detected file, the feature character is searched until the file to be detected is searched, and for each of the found feature characters, a corresponding feature string is constructed according to the second rule, and if the feature string is successfully constructed, The feature string position that was successfully built is taken as a valid location. This method of scanning a file to be detected is suitable for finding all locations of the feature string in the file to be detected. For the case where only the location of the first feature string needs to be found, the file to be detected may be scanned according to the following steps: in the file to be detected, the feature character is searched, and if the feature character is found, according to the second The rule constructs a corresponding feature string. If the feature string is successfully constructed, the position of the successfully constructed feature string is taken as a valid position, and the search is ended.

The feature string is successfully constructed in the third embodiment, and is also referred to as an exact match, that is, if The character of the feature string constructed according to the second rule is identical to the character of the feature string that is the basis of the search. In order to achieve the fuzzy matching, when the ratio of the character of the feature string constructed according to the second rule to the character of the feature string as the basis of the search reaches a set value, it is determined that the feature string is successfully constructed. In order to achieve fuzzy matching, it is further possible to add a more specific parameter indicating the discrete relationship of the characters in the second rule in the fuzzy matching. Of course, there are many standards for constructing feature string construction as described here. As mentioned above, specific standards can be determined according to specific needs.

 For the exact match proposed above, it may take more time to use character-by-word comparison. In the embodiment provided by the present invention, further improvement can be made: after the feature string is successfully constructed, the checksum of the feature character 新 newly constructed according to the feature character is calculated, and the checksum is used in advance with the feature string as the search character. By comparing the calculated checksums, it is possible to complete the comparison of the newly constructed feature string and the feature string as a lookup. In practice, the length of a typical feature string is about 50 bytes. If the number of bits used to store the checksum is large enough, even the comparison error can be eliminated. In modern computers, this is extremely easy. It is done, and is not limited to checksums.

 4 is a block diagram of an embodiment of the apparatus of the present invention, including:

 a storage unit 41 storing a complete set of feature strings, in the storage unit 41, selecting a feature string selection unit 42 for determining a feature string set of the target file, the set including at least one feature string for determining the target file ;

 The file scanning unit 43 is configured to search a character string in the set in a file to be detected according to a rule to obtain a search result; and, a determining unit 44 for determining whether the result satisfies the first condition, and

 The target file determining unit 45 is configured to determine that the to-be-detected file is a target file when the result satisfies the first condition.

 The storage unit 41 is configured to store a complete set of feature strings, and is usually stored for other auxiliary data of a certain or

The set of feature strings includes a feature string for determining the target file, which is the basis for finding the same or similar files. The set uses a database in the form of a two-dimensional table in this embodiment to However, the database can also be replaced by other data structures, such as a linear queue. A typical database structure can be referred to Figure 3. Among them, the fields "number,", "character string" and "length" are the most basic, and other fields improve the auxiliary data of the device performance described in the embodiment. In general, the determination of a feature string should normally satisfy the following conditions: uniqueness, length as short as possible, and so on.

 The feature character string selecting unit 42 selects a feature character string for determining the target file in the storage unit 41 based on the storage unit 41, and determines the feature file type to be detected, and constitutes a feature character string set.

 The file scanning unit 43, directly operates the scanned file, and searches for the string in the set in the file to be detected according to the rule to obtain the search result. The rules described here are different for different target files, mainly considering the speed of search and the accuracy of the search, and the search strategy based on the nature of the target file being looked up. In this embodiment, the following steps are used to search for the feature string in the set in the file to be detected according to the rule: each time a feature string in the set is selected, until each feature string in the set After being selected once, for each feature string selected, the file to be detected is scanned, the effective position of the feature string in the file to be detected is obtained, and the position of all the feature strings in the file to be detected is used as the search result.

 The determining unit 44 is configured to determine whether the search result satisfies a preset condition, and if yes, the target file determining unit 45 determines that the to-be-detected file is a target file.

 A typical process for the file scanning unit 43 to scan a file to be detected is: reading an unselected feature string from the set of feature strings, and then scanning the file to be detected by using the feature string, that is, the file to be detected Finding whether the feature string exists; then determining whether the feature string is scanned or found, and continuing to perform subsequent scanning when it is determined that the scanned character portion includes the feature string; if it is determined that the scanned character portion is included In the case of the feature string, the result of the scan is recorded. For example, in this example, the effective position of the feature string in the file to be detected is recorded, and the effective position includes the offset of the feature string in the file to be detected, and the length. Wait.

 In this example, another judgment content is included, that is, whether the scan is finished, if it is finished, the scan operation is terminated, and then the final search result is determined and obtained (this is obvious).

 It is also determined whether each feature string in the feature string set is completely scanned. If not all of the scans are completed, the next unselected feature string is selected to continue the scan operation.

In the embodiment shown in FIG. 4, the file scanning unit 43 uses the lookup for each feature string to be treated. The method of detecting the valid position in a file may not be necessary, and in some cases, the efficiency of the search is lowered. A second embodiment of the apparatus of the present invention provides another method. The method selects an unselected feature string in the set, scans the to-be-detected file for each feature string selected, and obtains a valid position of the feature string in the file to be detected, and accumulates The effective position obtains a cumulative result. If the accumulated result satisfies a predetermined rule, it indicates that the detected file can be determined based on the current accumulated result, so that the detection of the detected file can be ended, and the cumulative result is obtained. As a result of the search, further processing is performed.

 In the second embodiment, even if there is no result for the search for a feature string, the result of the search should be recorded when the search result is accumulated due to management or other such as statistical needs, etc., that is, the search result is "empty", indicating that there is no Found; of course, if there is a clear search result, it is necessary to record the positional parameter of the feature string in the file to be detected.

 In a second embodiment of the apparatus, for a valid position of a particular feature string in the file to be detected, the first occurrence of the valid position may be recorded, or all of the valid positions may be recorded, depending on the actual It is desirable that the feature string in a collection has explicit positional or relational features.

 Finding the feature string in the set in the file to be detected by means of exact matching, which in some cases leads to a reduction in the accuracy of the search.

 In a second embodiment of the apparatus, the predetermined rule supporting the fuzzy lookup is: the cumulative result of the positional relationship of the feature string that is effectively found in the file to be detected satisfies the set sequence feature, interval Features, or both sequential and interval features. The sequence features include combinations and/or permutations of feature strings. The sequence characteristics and the interval characteristics are different for the determination of object files of different purposes and different natures.

In other embodiments, the predetermined rule supporting the fuzzy search may also be: in the cumulative result, the sum of the found feature strings in the valid position in the file to be detected reaches a set value, that is, the found feature character. The number of valid positions of the string reaches the set value; or, in the cumulative result, the number of feature strings that are effectively found in the file to be detected reaches the set value. The way in which that method is used as the determination rule is also determined according to actual needs. Such rules may be different for the determination of object files of different purposes and different natures, and many such rules need to be predetermined. In the two embodiments mentioned above, the search result can determine whether the file to be detected is the target file only after the determining unit 44 determines whether the predetermined condition is met. The condition described herein may be: in the search result, the number of feature strings that are effectively found in the file to be detected reaches a set value; or, the search result is valid in the file to be detected. The positional relationship of the found feature string satisfies the set sequence feature and/or interval feature. and many more.

 A third embodiment of the apparatus of the present invention provides an improvement in the efficiency of finding feature strings. Different from the first and second embodiments of the apparatus, in the third embodiment, the feature character string selecting unit 42 determines the feature characters of each feature string and constructs the corresponding feature string according to the feature characters. The second rule. Based on the above characteristic characters and the second rule, the file to be detected can be scanned according to the following steps:

 In the to-be-detected file, the feature character is searched until the file to be detected is searched, and for each of the found feature characters, a corresponding feature string is constructed according to the second rule, and if the feature string is successfully constructed, The feature string position that was successfully built is taken as a valid location. This method of scanning a file to be detected is suitable for finding all locations of the feature string in the file to be detected. For the case where only the location of the first feature string needs to be found, the file to be detected may be scanned according to the following steps: in the file to be detected, the feature character is searched, and if the feature character is found, according to the second The rule constructs a corresponding feature string. If the feature string is successfully constructed, the position of the successfully constructed feature string is taken as a valid position, and the search is ended.

 For the exact matching proposed above, after the feature string is successfully constructed, the checksum of the feature character 新 newly constructed according to the feature character can be calculated, and the checksum calculated in advance with the feature string as the basis of the search can be calculated. By comparing, it is faster to compare the newly constructed feature string with the feature string that is the basis of the lookup. This is an extremely easy way to do it, and in practice it is not limited to the school-risk approach.

 From the above description, various changes and modifications can be made by those skilled in the art without departing from the scope of the invention. For example, a method of distinguishing between unwanted programs may employ the following features: converting instructions and/or parameters that destroy the system into feature strings, and using all of the feature strings as a set of feature strings, the set including at least a feature string used to determine an unwanted program;

Find the feature string in the collection in the suspicious program according to the rule, and obtain the search result to And,

 Determining whether the search result satisfies the first condition, and if so, determining that the suspicious program is a harmful program.

 That is to say, distinguishing between harmful programs is actually judging whether a program that is not known or harmful is a document that has obtained specific content, and whether there are some characteristic strings that have some destructive effect, such as destructive instructions and / Or parameters. With the solution of the present invention, such a search can be made to have a certain degree of ambiguity, thereby increasing the accuracy of the program judgment and reducing false positives and missed judgments. For example, it is possible to scan a suspicious program entering the system through the network, and if it finds a predetermined command and/or parameter that destroys the system, or finds a behavior harmful to the system in the suspicious program, it can be determined as an unwanted program. And further take measures against it.

 Also, for example, to determine whether a normal program is attacked by a virus program, and if it is attacked, one of which is to have some destructive instructions and/or parameters therein, it is obvious that the method can be completed using the method of the present invention (if The program is only the data is destroyed, and it can be easily detected whether the program is destroyed by conventional means such as checksum. For example, a program can be identified, and the identified features can be easily identified by forming the feature string by forming the feature string. and many more.

 Therefore, the technical scope of the present invention is not limited to the contents of the specification, and there are many specific technical applications determined according to the claims. The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

Rights request  A method for determining an object file, based on a storage unit storing a complete set of feature strings, wherein:  Selecting, in the storage unit, a feature string set for determining an object file, where the set includes at least one feature string for determining the target file;  Finding the feature string in the set in the file to be detected according to the rule, obtaining the search result, and,  Determining whether the search result satisfies the first condition, and if so, determining that the to-be-detected file is a target file.  2. The method according to claim 1, wherein the following steps are used to search for the feature string in the set in the file to be detected according to the rule:  Each time a feature string in the set is selected until each feature string in the set is selected once, for each feature string selected, the file to be detected is scanned, and the feature string is obtained. The valid position in the file is detected, and the position of all the feature strings in the file to be detected is used as the search result.  3. The method according to claim 1, wherein the following steps are used to search for a feature string in the set in the file to be detected according to the rule:  Selecting an unselected feature string in the set until the accumulated result satisfies the first rule, scanning the to-be-detected file for each feature string selected, and obtaining the feature string in the file to be detected The valid position in the middle, accumulate the valid position, and obtain the cumulative result. After the search for the detected file ends, the accumulated result is used as the search result.  The method according to claim 3, wherein the first rule is: in the cumulative result, the sum of the found feature strings in the valid position in the file to be detected reaches a set value; or, cumulative In the result, the number of feature strings that are effectively found in the file to be detected reaches a set value; or, in the cumulative result, the positional relationship of the feature strings that are effectively found in the file to be detected satisfies the set order Features and/or spacing characteristics. The method according to claim 1, 2, 3 or 4, wherein the first condition is: in the search result, the number of feature strings that are effectively found in the file to be detected reaches a set value; or, in the search result, a position of a feature string that is effectively found in the file to be detected The relationship satisfies the set sequence characteristics and/or spacing characteristics.  6. The method of claim 5, further comprising: determining a feature character of each feature string and a second rule for constructing a corresponding feature string according to the feature character; and scanning the site according to the following steps Describe the test file:  In the to-be-detected file, the feature character is searched until the file to be detected is searched, and for each of the found feature characters, a corresponding feature string is constructed according to the second rule, and if the feature string is successfully constructed, The feature string position that was successfully built is taken as a valid location.  7. The method according to claim 5, further comprising: determining a feature character of each feature string and a second rule for constructing a corresponding feature string according to the feature character; and scanning the site according to the following steps Describe the test file:  In the file to be detected, the feature character is searched, and if the feature character is found, a corresponding feature string is constructed according to the second rule, and if the feature string is successfully constructed, a successful feature string position is constructed. As a valid location, end the search.  8. The method according to claim 7, wherein if the character of the feature string constructed according to the second rule is identical to or the same as the character of the feature string based on the search, the set value is reached. , determining that the feature string is successfully constructed.  9. The method according to claim 6, wherein if the character of the feature string constructed according to the second rule is identical to or the same as the character of the feature string based on the search, the set value is reached. , determining that the feature string is successfully constructed.  10. An apparatus for determining an object file, comprising: a storage unit that stores a complete set of feature strings, further characterized by:  a feature string selection unit that selects, in the storage unit, a set of feature strings for determining the target file, the set including at least one feature string for determining the target file;  a file scanning unit, configured to search for a string in the set in the file to be detected according to a rule, and obtain a search result;  a determining unit, configured to determine whether the result satisfies the first condition, and,  The target file determining unit determines that the file to be detected is a target file when the result satisfies the first condition.