[go: up one dir, main page]

WO2013182073A1 - 鉴定文件安全性的方法、系统及存储介质 - Google Patents

鉴定文件安全性的方法、系统及存储介质 Download PDF

Info

Publication number
WO2013182073A1
WO2013182073A1 PCT/CN2013/076883 CN2013076883W WO2013182073A1 WO 2013182073 A1 WO2013182073 A1 WO 2013182073A1 CN 2013076883 W CN2013076883 W CN 2013076883W WO 2013182073 A1 WO2013182073 A1 WO 2013182073A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
security
threshold
activity
module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2013/076883
Other languages
English (en)
French (fr)
Inventor
张玉
陈起儒
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Publication of WO2013182073A1 publication Critical patent/WO2013182073A1/zh
Priority to US14/560,016 priority Critical patent/US20150089662A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present invention relates to Internet security technologies, and more particularly to a method, system and storage medium for authenticating file security.
  • the process of traditionally identifying file security is as follows: First, after discovering a suspicious executable file, upload the file information and the executable sample program to the security center. A simple match is performed to compare the file features with the feature codes in the existing sample library. If the file features correspond to the existing black and white list feature codes, the black and white is directly judged. If it does not correspond, it will perform automatic analysis and enter the Trojan analysis pipeline. After the document characteristics, behavior characteristics, and intelligent inspiration, it will be analyzed and judged again. For documents that still cannot be judged black or white, manual analysis is performed, and regular retrace and manual analysis are used.
  • a method of identifying file security including the following steps:
  • the file security is judged based on the activity level.
  • the present invention also provides a system for authenticating file security, the system comprising:
  • a receiving module configured to obtain a file identifier of the file
  • An access module configured to acquire application data of the file according to the file identifier
  • a processing module configured to obtain an activity of the file according to the application data
  • an authentication module configured to determine the file security according to the activity level.
  • the file security is judged based on the activity level.
  • the above method for identifying file security, obtaining a file identifier of a file, and obtaining application data of the file according to the file identifier The activity of the file is obtained based on the application data, and the file security is judged according to the activity level.
  • the application data of the file can be obtained through real-time feedback from the user. After the activity data is obtained according to the application data, the security of the file can be judged by using the activity degree according to the statistical principle, so that it is not necessary to take a long time for automatic analysis and manual analysis. Therefore, by the above method, the efficiency of obtaining file security can be improved.
  • the present invention also provides a system and storage medium for authenticating file security.
  • storing the files judged to be safe directly into the sample library can further improve the white list in the sample library, and increase the probability that the security of the file can be directly obtained through simple matching in the subsequent authentication process, thereby further improving the security of the obtained file.
  • sexual efficiency can further improve the white list in the sample library, and increase the probability that the security of the file can be directly obtained through simple matching in the subsequent authentication process, thereby further improving the security of the obtained file.
  • FIG. 1 is a schematic flow chart of a method for identifying file security in an embodiment
  • FIG. 2 is a schematic flow chart of a method for identifying file security in another embodiment
  • FIG. 3 is a block diagram showing a system for identifying file security in an embodiment
  • FIG. 4 is a block diagram showing a system for identifying file security in another embodiment
  • FIG. 5 is a schematic flow chart of a method for causing a computer to execute a storage medium in an embodiment
  • FIG. 6 is a structural block diagram of a system for authenticating file security in another embodiment.
  • a method of authenticating file security includes the following steps:
  • Step S110 obtaining a file identifier of the file.
  • each piece of security software requires a client to be installed on each user's computer.
  • the client monitors the files on the user's computer in real time.
  • an authentication command is issued to determine whether the suspicious file is a virus.
  • the file identifier of the suspicious file is obtained.
  • the file identifier is the unique identifier of the file.
  • the file is identified as a message digest value (Md5 value) for the file.
  • Step S120 Acquire application data of the file according to the file identifier.
  • the application data includes a percentage of the number of file machines, a percentage of file growth, a proportion of the time of use of the files, and a proportion of the time of use of the files.
  • the number of file machines is the ratio of the number of file machines to the total number of machines.
  • the increase in file week percentage is the percentage of file machine weekly growth to the number of machines before file growth.
  • the proportion of file usage time is the proportion of file usage time to boot time.
  • the percentage of file week usage is the percentage of the file week usage time to the boot week duration.
  • the number of file machines indicates the number of computers on which the file is installed; the total number of machines indicates the number of registered computers, that is, the number of computers on which a certain security software is installed; the number of files per week increases indicates that a computer with the file is newly added within one week.
  • the number of machines before file growth refers to the number of registered computers a week ago, that is, the total number of machines a week ago; the length of time the file is used is the length of time the file is run; the length of the boot is the length of time when the computer on which the file is installed is powered on; The duration of the file week is the length of time during which the file is run within one week; the boot week length refers to the length of time that the computer on which the file is installed is powered on within one week.
  • the application data is not limited to the foregoing data, and the application data may also include the proportion of the file machine, the percentage of the file growth, the proportion of the file usage time, and the file usage time. Any combination of one or several.
  • the above method for authenticating file security further includes the step of counting and uploading application data for each file corresponding to the file identification.
  • the client monitors the files on the computer in real time, and counts and uploads the application data of each file.
  • the server stores the application data and the file identifier.
  • the corresponding application data is queried according to the file identifier. If the related record is queried, the application data is updated and the application data is obtained; if the related record is not found, the file is a new file, a new record is created, and the application data of the file is counted.
  • Step S130 obtaining the activity of the file according to the application data.
  • Activity is obtained on the basis of statistical principles.
  • the activity level of a file indicates the popularity of the file, which reflects the coverage, frequency of use, trend, etc. of the file.
  • Coverage is the percentage of users who use the file among a specific range of computer users. For example, if 5,000 users are randomly selected, and 4000 of them use a certain file, the coverage of the file is 80%.
  • the frequency of use refers to the proportion of computer users who use the file in the process of using the computer.
  • Trends refer to whether the number of computer users using a file is increasing or decreasing, and increasing or decreasing.
  • the activity of the file can be obtained by linear combination according to the coverage, frequency and trend of the file and the corresponding normalization constant, or can be determined only by one or two of coverage, frequency of use and trend.
  • the activity of the file can be obtained according to the following manner:
  • Activity the number of file machines accounted for * a + file week growth ratio * b + file usage time ratio * c + file week usage time ratio * d.
  • a, b, c, and d are all parameters, and their values can be selected according to actual conditions.
  • a is 0.8; b is 0.1; c is 0.08; and d is 0.02.
  • the activity of obtaining a file is not limited to the above manner, and the activity of the file may be only used by the number of file machines, the percentage of file growth, the proportion of file usage time, and the file week.
  • the combination of one or any of the duration ratios and the corresponding parameters are obtained.
  • the parameters are not limited to the above values.
  • step S140 file security is determined according to the activity level.
  • the above step S140 is to determine that the file is a secure file or an unsecure file according to the activity level. Specifically, at least one threshold is obtained; the activity is compared with the threshold to judge the security of the file.
  • the threshold may be only one.
  • the threshold is set by the programmer based on the experience summarized in the actual work. When the activity of the file is below the threshold, the file is judged to be an unsafe file. When the activity of the file is higher than the threshold, the file is judged to be a secure file.
  • the threshold is one.
  • the file is judged to be a secure file.
  • the file is judged to be a suspicious file. As shown in FIG. 2, after determining that the file is suspicious, the security of the file is determined according to any one or more of steps S210 to S240.
  • Step S210 verifying the file signature of the file to determine the security of the file.
  • a file When a file is a suspicious file, its security is verified by verifying the signature. Specifically, since the signed file cannot be changed, the signature of the file is invalidated when the file is modified. Therefore, when the verification file signature is trustworthy, it indicates that the file has not been modified and there is no possibility of being implanted with a virus, so the file can be judged to be a security file. When the verification file signature is untrustworthy, it indicates that the file has been modified, and there is a possibility that the virus is implanted, so the file is judged to be an unsafe file or a suspicious file.
  • step S220 the file information of the file is simply matched with the data in the sample library to determine the security of the file.
  • the file characteristics of the file are matched with the black and white list feature codes in the sample library.
  • the signature code also known as the computer virus signature, is produced by an anti-virus company. It is generally determined by the anti-virus company to have only a binary string that the virus may have, and the string is generally the address of the corresponding code or assembly instruction in the file. .
  • the file characteristics of the file are compared with the feature codes in the black and white lists. If there is a corresponding record, the security of the file can be directly judged.
  • step S230 the file information of the file is automatically analyzed to determine the security of the file.
  • the file information also includes the behavior characteristics of the file.
  • Automated analysis is to perform intelligent heuristic analysis and judgment on the file characteristics and behavior characteristics of the file, so as to obtain the security of the file.
  • step S240 the file is periodically rewound and transferred to a manual analysis to determine the security of the file.
  • steps S210-S240 may be performed sequentially, or any of the steps may be performed, and any one of them may be selected for execution. When any one of them is selected, the file is directly judged to be a secure file or an unsafe file.
  • the threshold may include a first threshold and a second threshold, and the first threshold is less than the second threshold. Specifically, in one embodiment, the first threshold is 60% and the second threshold is 90%. It should be noted that in other embodiments, the first threshold and the second threshold are changeable, and may be adjusted according to the calculation manner of the activity and the parameter.
  • the file When the activity level is higher than the second threshold, the file is judged to be a security file. That is, in one embodiment the activity is above 90%. It means that the file has a wide coverage rate and a high frequency of use. Such files are generally system files. Therefore, the file can be judged as a security file directly by the activity level.
  • the activity is between the first threshold and the second threshold, that is, between 60% and 90% in one embodiment. It means that the file has a certain coverage and frequency of use, such files are generally installed popular software. At this time, the security cannot be determined by the activity alone, and the file signature needs to be verified. If the file signature is trustworthy, the file is judged to be a secure file.
  • the file is an uncommon software, or when the activity level is between the first threshold and the second threshold, and if the file signature is untrustworthy, the following steps are sequentially performed to determine the security of the file: using the file information of the file Simple matching with the data in the sample library to judge the security of the file; for files that cannot be judged by simple matching, the file information of the file is automatically analyzed to determine the security of the file; for automatic analysis, the security cannot be judged.
  • Sexual documents periodically retweet the documents and forward them to manual analysis to determine the security of the documents.
  • the method of authenticating file security further includes storing file information of a file determined to be a secure file into a sample library.
  • the reason why the security of a file cannot be quickly determined based on simple matching is that the black and white lists in the sample library are not complete enough.
  • the invention can further improve the content of the white list in the sample library by obtaining the activity of the file and directly storing the file information of the file determined to be the security file by the activity degree into the sample library. Increasing the probability of obtaining the security of the file directly through simple matching in the subsequent identification process, so that no automatic analysis and manual analysis are required.
  • the present invention further provides a system for authenticating file security, the system comprising a receiving module 110, an access module 120, an access module 130, and an authentication module 140. among them:
  • the receiving module 110 is configured to obtain a file identifier of the file.
  • each piece of security software requires a client to be installed on each user's computer.
  • the client monitors the files on the user's computer in real time.
  • an authentication command is issued to determine whether the suspicious file is a virus.
  • the receiving module 110 obtains the authentication instruction, the file identifier of the suspicious file is obtained.
  • the file identifier is the unique identifier of the file.
  • the file is identified as a message digest value (Md5 value) for the file.
  • the access module 120 is configured to obtain application data of the file according to the file identifier.
  • the application data includes a percentage of the number of file machines, a percentage of file growth, a proportion of the time of use of the files, and a proportion of the time of use of the files.
  • the number of file machines is the ratio of the number of file machines to the total number of machines.
  • the increase in file week percentage is the percentage of file machine weekly growth to the number of machines before file growth.
  • the proportion of file usage time is the proportion of file usage time to boot time.
  • the percentage of file week usage is the percentage of the file week usage time to the boot week duration.
  • the number of file machines indicates the number of computers on which the file is installed; the total number of machines indicates the number of registered computers, that is, the number of computers on which a certain security software is installed; the number of files per week increases indicates that a computer with the file is newly added within one week.
  • the number of machines before file growth refers to the number of registered computers a week ago, that is, the total number of machines a week ago; the length of time the file is used is the length of time the file is run; the length of the boot is the length of time when the computer on which the file is installed is powered on; The duration of the file week is the length of time during which the file is run within one week; the boot week length refers to the length of time that the computer on which the file is installed is powered on within one week.
  • the application data is not limited to the foregoing data, and the application data may also include the proportion of the file machine, the percentage of the file growth, the proportion of the file usage time, and the file usage time. Any combination of one or several.
  • the above system for identifying file security further includes a data collection module for collecting and uploading application data of each file corresponding to the file identifier.
  • the data collection module monitors files on the computer in real time, and counts and uploads application data of each file.
  • the server stores the application data and the file identifier.
  • the corresponding application data is queried according to the file identifier. If the related record is queried, the application data is updated and the application data is obtained; if the related record is not found, the file is a new file, a new record is created, and the application data of the file is counted.
  • the processing module 130 is configured to obtain the activity of the file according to the application data.
  • Activity is obtained on the basis of statistical principles.
  • the activity level of a file indicates the popularity of the file, which reflects the coverage, frequency of use, trend, etc. of the file.
  • Coverage is the percentage of users who use the file among a specific range of computer users. For example, if 5,000 users are randomly selected, and 4000 of them use a certain file, the coverage of the file is 80%.
  • the frequency of use refers to the proportion of computer users who use the file in the process of using the computer.
  • Trends refer to whether the number of computer users using a file is increasing or decreasing, and increasing or decreasing.
  • the activity of the file can be obtained by linear combination according to the coverage, frequency and trend of the file and the corresponding normalization constant, or can be determined only by one or two of coverage, frequency of use and trend.
  • the processing module 130 may obtain the activity of the file according to the following manner:
  • Activity the number of file machines accounted for * a + file week growth ratio * b + file usage time ratio * c + file week usage time ratio * d.
  • a, b, c, and d are all parameters, and their values can be selected according to actual conditions.
  • a is 0.8; b is 0.1; c is 0.08; and d is 0.02.
  • the activity of the file obtained by the processing module 130 is not limited to the above manner, and the activity of the file may be only the proportion of the file machine, the percentage of the file growth, the proportion of the file usage time, and A combination of one or any of a few minutes of the file usage time and the corresponding parameters are obtained.
  • the parameters are not limited to the above values.
  • the authentication module 140 is configured to determine file security based on the activity level.
  • the authentication module 140 is configured to determine that the file is a secure file or an unsecure file according to the activity level. Specifically, the authentication module 140 acquires at least one threshold; compares the activity with the threshold, and determines the security of the file.
  • the threshold may be only one.
  • the threshold is set by the programmer based on the experience summarized in the actual work.
  • the authentication module 140 determines that the file is an unsafe file.
  • the authentication module 140 determines that the file is a security file.
  • the threshold is one.
  • the authentication module 140 determines that the file is a secure file.
  • the authentication module 140 determines that the file is a suspicious file.
  • the system for authenticating file security further includes a signature verification module 150, a matching module 160, an automatic analysis module 170, and a flyback forwarding module 180. among them:
  • the signature verification module 150 is used to verify the file signature of the file to determine the security of the file.
  • the signature verification module 150 determines its security by verifying the signature. Specifically, since the signed file cannot be changed, the signature of the file is invalidated when the file is modified. Therefore, when the verification file signature is trustworthy, indicating that the file has not been modified and there is no possibility of being implanted with a virus, the signature verification module 150 can determine that the file is a security file. When the verification file signature is untrustworthy, it indicates that the file has been modified, and there is a possibility that the virus is implanted, so the signature verification module 150 determines that the file is an unsafe file or a suspicious file.
  • the matching module 160 is configured to perform simple matching between the file information of the file and the data in the sample library to determine the security of the file.
  • the matching module 160 uses the file features of the file to match the black and white list signatures in the sample library.
  • the signature code also known as the computer virus signature, is produced by an anti-virus company. It is generally determined by the anti-virus company to have only a binary string that the virus may have, and the string is generally the address of the corresponding code or assembly instruction in the file. .
  • the file feature of the file is compared with the feature code in the black and white list. If there is a corresponding record, the matching module 160 can directly determine the security of the file.
  • the automatic analysis module 170 is configured to automatically analyze the file information of the file to determine the security of the file.
  • the file information also includes the behavior characteristics of the file.
  • the automatic analysis module 170 performs intelligent heuristic analysis and judgment on the file features and behavior characteristics of the file, thereby obtaining the security of the file.
  • the retrace transfer module 180 is used to periodically retrace the file and forward it to the manual analysis to determine the security of the file.
  • the flyback forwarding module 180 needs to periodically scan, monitor its operational status, and forward the file to the manual processing platform. Therefore, the staff can manually analyze the files sent to the manual processing platform to obtain the security of the file.
  • the threshold may include a first threshold and a second threshold, and the first threshold is less than the second threshold. Specifically, in one embodiment, the first threshold is 60% and the second threshold is 90%. It should be noted that in other embodiments, the first threshold and the second threshold are changeable, and may be adjusted according to the calculation manner of the activity and the parameter.
  • the system for authenticating file security further includes a signature verification module 150, a matching module 160, an automatic analysis module 170, and a flyback forwarding module 180.
  • the authentication module 140 is configured to determine that the file is secure when the activity level is higher than the second threshold.
  • the signature verification module 150 is called to verify the signature of the file, and if the signature of the file is trustworthy, the file is determined to be secure.
  • the matching module 160, the automatic analysis module 170, and the flyback forwarding module 180 are sequentially called to determine the file. Security.
  • the system for authenticating file security further includes a sample management module for storing file information of a file determined to be a secure file into a sample library.
  • the reason why the traditional system for authenticating file security cannot quickly judge the security of a file according to the matching module 160 is that the black and white lists in the sample library are not complete enough.
  • the invention can further improve the content of the white list in the sample library by obtaining the activity of the file and directly storing the file information of the file determined to be the security file by the activity degree into the sample library. Increasing the probability that the matching module 160 can directly perform the simple matching to obtain the security of the file in the subsequent authentication process, thereby eliminating the need for automatic analysis and manual analysis.
  • the above method and system for identifying file security the above method for identifying file security, obtaining a file identifier of a file, and acquiring application data of the file according to the file identifier.
  • the activity of the file is obtained based on the application data, and the file security is judged according to the activity level.
  • the application data of the file can be obtained through real-time feedback from the user. After the activity data is obtained according to the application data, the security of the file can be judged by using the activity degree according to the statistical principle, so that it is not necessary to take a long time for automatic analysis and manual analysis. Therefore, the efficiency of obtaining file security can be improved by the above method and system.
  • storing the files judged to be safe directly into the sample library can further improve the white list in the sample library, and increase the probability that the security of the file can be directly obtained through simple matching in the subsequent authentication process, thereby further improving the security of the obtained file.
  • sexual efficiency can further improve the white list in the sample library, and increase the probability that the security of the file can be directly obtained through simple matching in the subsequent authentication process, thereby further improving the security of the obtained file.
  • the present invention also provides a computer storage medium containing computer executable instructions for performing a method of authenticating file security, the method comprising the steps of:
  • Step S310 obtaining a file identifier of the file.
  • Step S320 acquiring application data of the file according to the file identifier.
  • Step S330 obtaining the activity of the file according to the application data.
  • step S340 file security is determined according to the activity level.
  • the steps S310, S320, S330, and S340 are the same as the steps S110, S120, S130, and S140, and are not described here.
  • the method further includes: storing file information of the file determined to be a secure file into the sample library.
  • the method further includes: counting and uploading application data of each file corresponding to the file identifier.
  • the present invention also provides another system for identifying the security of a file.
  • FIG. 6 for the convenience of description, only parts related to the embodiment of the present invention are shown.
  • the terminal can be a mobile phone, a tablet, a PDA (Personal) Digital Assistant, personal digital assistant), POS (Point of Sales), on-board computer and other terminal devices, taking the terminal as a mobile phone as an example:
  • FIG. 6 is a block diagram showing a partial structure of a mobile phone related to a terminal provided by an embodiment of the present invention.
  • the mobile phone includes: radio frequency ( Radio Frequency , RF ) Circuit 610, memory 620, input unit 630, display unit 640, sensor 650, audio circuit 660, wireless fidelity (wireless Fidelity, WiFi) module 670, processor 680, and power supply 690 and the like.
  • radio frequency Radio Frequency , RF
  • RF Radio Frequency
  • memory 620 input unit 630
  • display unit 640 sensor 650
  • audio circuit 660 includes a wireless fidelity (wireless Fidelity, WiFi) module 670, processor 680, and power supply 690 and the like.
  • wireless fidelity wireless Fidelity, WiFi
  • the RF circuit 610 can be used for transmitting and receiving information or during a call, and receiving and transmitting the signal. Specifically, after receiving the downlink information of the base station, the processor 680 processes the data. In addition, the uplink data is designed to be sent to the base station.
  • RF circuits include, but are not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low) Noise Amplifier, LNA), duplexer, etc.
  • RF circuitry 610 can also communicate with the network and other devices via wireless communication.
  • the above wireless communication may use any communication standard or protocol, including but not limited to the global mobile communication system (Global System of Mobile communication, GSM), General Packet Radio (General Packet Radio) Service, GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (Wideband Code) Division Multiple Access, WCDMA), Long Term Evolution (Long Term Evolution, LTE)), email, Short Messaging Service (SMS), etc.
  • GSM Global System of Mobile communication
  • GSM Global System of Mobile communication
  • GSM Global System of Mobile communication
  • GSM Global System of Mobile communication
  • GSM Global System of Mobile communication
  • General Packet Radio General Packet Radio
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • SMS Short Messaging Service
  • the memory 620 can be used to store software programs and modules, and the processor 680 executes various functional applications and data processing of the mobile phone by running software programs and modules stored in the memory 620.
  • the memory 620 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to Data created by the use of the mobile phone (such as audio data, phone book, etc.).
  • memory 620 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 630 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function controls of the handset.
  • the input unit 630 may include a touch panel 631 and other input devices 632.
  • the touch panel 631 also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like on the touch panel 631 or near the touch panel 631. Operation), and drive the corresponding connecting device according to a preset program.
  • the touch panel 631 can include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 680 is provided and can receive commands from the processor 680 and execute them.
  • the touch panel 631 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 630 may also include other input devices 632.
  • other input devices 632 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 640 can be used to display information input by the user or information provided to the user as well as various menus of the mobile phone.
  • the display unit 640 can include a display panel 641, and optionally, a liquid crystal display can be used (Liquid Crystal Display, LCD), Organic Light-Emitting Diode,
  • the display panel 641 is configured in the form of an OLED or the like.
  • the touch panel 631 can cover the display panel 641. When the touch panel 631 detects a touch operation on or near it, the touch panel 631 transmits to the processor 680 to determine the type of the touch event, and then the processor 680 according to the touch event. The type provides a corresponding visual output on display panel 641.
  • the touch panel 631 and the display panel 641 are two independent components to implement the input and input functions of the mobile phone, in some embodiments, the touch panel 631 may be integrated with the display panel 641. Realize the input and output functions of the phone.
  • the handset can also include at least one type of sensor 650, such as a light sensor, motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 641 according to the brightness of the ambient light, and the proximity sensor may close the display panel 641 and/or when the mobile phone moves to the ear. Or backlight.
  • the accelerometer sensor can detect the magnitude of acceleration in all directions (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity.
  • Other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like that can be configured in the mobile phone are not described herein.
  • Audio circuit 660, speaker 661, and microphone 662 provide an audio interface between the user and the handset.
  • the audio circuit 660 can transmit the converted electrical data of the received audio data to the speaker 661 for conversion to the sound signal output by the speaker 661; on the other hand, the microphone 662 converts the collected sound signal into an electrical signal by the audio circuit 660. After receiving, it is converted into audio data, and then processed by the audio data output processor 680, sent to the other mobile phone via the RF circuit 610, or outputted to the memory 620 for further processing.
  • WiFi is a short-range wireless transmission technology
  • the mobile phone can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 670, which provides users with wireless broadband Internet access.
  • FIG. 6 shows the WiFi module 670, it can be understood that it does not belong to the essential configuration of the mobile phone, and can be omitted as needed within the scope of not changing the essence of the invention.
  • the processor 680 is the control center of the handset, and connects various portions of the entire handset using various interfaces and lines, by executing or executing software programs and/or modules stored in the memory 620, and invoking data stored in the memory 620, executing The phone's various functions and processing data, so that the overall monitoring of the phone.
  • the processor 680 may include one or more processing units; preferably, the processor 680 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications. It will be appreciated that the above described modem processor may also not be integrated into the processor 680.
  • the handset also includes a power source 690 (such as a battery) that supplies power to the various components.
  • a power source 690 such as a battery
  • the power source can be logically coupled to the processor 680 through a power management system to manage functions such as charging, discharging, and power management through the power management system.
  • the mobile phone may further include a camera, a Bluetooth module, and the like, and details are not described herein again.
  • the processor 680 included in the terminal further has the following functions: performing a method for authenticating file security, including:
  • the file security is judged based on the activity level.
  • the processor 680 of the terminal further has the following functions: the manner of obtaining the activity of the file according to the application data is:
  • Activity the number of file machines accounted for * a + file week growth ratio * b + file usage time ratio * c + file week usage time ratio * d, where a, b, c, d are parameters.
  • the processor 680 of the terminal further has the following functions: the step of determining the security of the file according to the activity level is:
  • the activity is compared with the threshold to judge the security of the file.
  • the processor 680 of the terminal further has the following function: the step of judging the security of the file is to determine that the file is a security file or a suspicious file according to the activity level, and if the file is determined to be a suspicious file according to the activity level, the method further includes At least one of the following steps:
  • the files are periodically retraced and forwarded to manual analysis to determine the security of the files.
  • the processor 680 of the terminal further has the following functions: the threshold includes a first threshold and a second threshold, and the first threshold is smaller than the second threshold, and the activity is compared with the threshold to judge the security of the file.
  • the steps include:
  • the file signature is verified, and if the file signature is trustworthy, the file is determined to be secure;
  • the files are periodically retraced and forwarded to manual analysis to determine the security of the files.
  • the processor 680 of the terminal further has the function of storing the file information of the file determined as the secure file into the sample library.
  • the processor 680 of the terminal further has the following functions: corresponding to the file identifier, statistics and upload application data of each file.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Description

鉴定文件安全性的方法、系统及存储介质
【技术领域】
本发明涉及互联网安全技术，特别是涉及鉴定文件安全性的方法、系统及存储介质。
【背景技术】
在互联网中，电脑病毒随处可见，电脑病毒可损坏用户的系统，窃取用户的数据，对于网络安全构成严重的威胁。因此，鉴定可行执行文件的安全性在现有互联网领域中显得尤为重要。
传统鉴定文件安全性的流程如下：首先，在发现可疑的执行文件后，上传文件信息与可执行样本程序到安全中心。进行简单匹配，将文件特征与现有样本库中的特征码进行比对，若文件特征与现有的黑、白名单中特征码对应，直接判断黑白。若不能对应，则进行自动分析，进入木马分析流水线，经过文件特征，行为特征，智能启发进行再次分析判断。对于仍不能判断黑或白的文件，进行人工分析，采用定期回扫与人工分析解决。
然而，由于样本库中黑名单和白名单不够完备，文件的安全性往往不能根据简单匹配而确定，一般需要进行自动分析和人工分析后才能最终确定。自动分析和人工分析得到的结果虽然准确，但是，自动分析和人工分析耗时长、响应慢，并最终导致获得文件安全性的效率不高。
【发明内容】
基于此，有必要提供一种能够提高获得文件的安全性效率的鉴定文件安全性的方法。
一种鉴定文件安全性的方法，包括以下步骤：
获取文件的文件标识；
根据所述文件标识，获取所述文件的应用数据；
根据所述应用数据获得所述文件的活跃度；
根据所述活跃度判断所述文件安全性。
此外，本发明还提供一种鉴定文件安全性的系统，所述系统包括：
接收模块，用于获取文件的文件标识；
存取模块，用于根据所述文件标识，获取所述文件的应用数据；
处理模块，用于根据所述应用数据获得所述文件的活跃度；
鉴定模块，用于根据所述活跃度判断所述文件安全性。
此外，还有必要提供一种包含计算机可执行指令的计算机存储介质，所述计算机可执行指令用于执行鉴定文件安全性的方法，上述方法包括以下步骤：
获取文件的文件标识；
根据所述文件标识，获取所述文件的应用数据；
根据所述应用数据获得所述文件的活跃度；
根据所述活跃度判断所述文件安全性。
上述鉴定文件安全性的方法，获取文件的文件标识，并根据文件标识获取文件的应用数据。根据应用数据获得文件的活跃度，并根据活跃度判断文件安全性。文件的应用数据可通过用户实时反馈获取，根据应用数据得到活跃度后，根据统计学的原理，利用活跃度便可判断文件的安全性，从而不必经过耗时长的自动分析和人工分析。因此，通过上述方法，可提高获得文件安全性的效率。此外，本发明还提供一种鉴定文件安全性的系统及存储介质。
而且，将判断为安全的文件直接存入到样本库，可进一步完善样本库中的白名单，增大后续的鉴定过程中可直接通过简单匹配得到文件的安全性的概率，进一步提高获得文件安全性的效率。
【附图说明】
图1为一个实施例中鉴定文件安全性的方法的流程示意图；
图2为另一个实施例中鉴定文件安全性的方法的流程示意图；
图3为一个实施例中鉴定文件安全性的系统的模块示意图；
图4为另一个实施例中鉴定文件安全性的系统的模块示意图；
图5为一个实施例中存储介质使计算机所执行方法的流程示意图；
图6为另一个实施例中鉴定文件安全性的系统的结构框图。
【具体实施方式】
如图1所示，在一个实施例中，鉴定文件安全性的方法包括以下步骤：
步骤S110，获取文件的文件标识。
在一个实施例中，每款安全软件都需要在各个用户的计算机上安装客户端。客户端对用户计算机上的文件进行实时监控，当发现可疑文件时，则发出鉴定指令，以判断该可疑文件是否为病毒。当获得鉴定指令后，便获取可疑文件的文件标识。文件标识为文件的唯一标示。在一个实施例中，文件标识为文件的信息摘要值（Md5值）。
步骤S120，根据文件标识，获取文件的应用数据。
在一个实施例中，应用数据包括文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比。文件机器数占比为文件机器数对总机器数的占比。文件周增长占比为文件机器周增长数对文件增长前机器数的占比。文件次使用时长占比为文件使用时长对开机时长的占比。文件周使用时长占比为文件周使用时长对开机周时长的占比。
其中，文件机器数表示安装有该文件的计算机数量；总机器数表示注册计算机数量，即安装有某款安全软件的计算机数量；文件机器周增长数表示一周内新增加装有该文件的计算机数量；文件增长前机器数指的是一周前注册计算机的数量，即一周前的总机器数；文件使用时长即运行该文件的时长；开机时长指安装有该文件的计算机处于开机状态的时长；文件周使用时长即一周内运行该文件的时长；开机周时长指安装有该文件的计算机在一周内处于开机状态的时长。
需要指出的是，在其他实施例中，应用数据不限于上述数据，且应用数据也可以包含文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比中任意一种或几种的组合。
在一个实施例中，上述鉴定文件安全性的方法还包括对应于文件标识，统计并上传每个文件的应用数据的步骤。
具体的，客户端实时监控计算机上的文件，统计并上传每个文件的应用数据。服务器在获得上述应用数据后，将应用数据与文件标识对应存储。当收到鉴定指令并获取文件的文件标识后，根据文件标识查询对应的应用数据。若查询到相关记录，则更新应用数据并获取该应用数据；若未查找到相关的记录，则表示该文件为新文件，创建新的记录，并统计该文件的应用数据。
步骤S130，根据应用数据获得文件的活跃度。
活跃度根据统计学的原理获得。文件的活跃度表示文件的流行程度，可反映该文件的覆盖率、使用频率、趋势等。覆盖率是指在特定范围的计算机用户中，使用该文件的用户所占的比例。例如，随机抽取5000个用户，其中有4000用户使用某一文件，则表示该文件的覆盖率为80%。使用频率是指计算机用户使用文件的时间在使用计算机的过程中所占的比例。趋势即指使用某一文件的计算机用户是增多还是在减少，以及增加或减少的速度。例如，随机抽取5000个用户，其中有4000用户使用某一文件，下一周统计时有4200个用户使用该文件，则该文件的趋势为增加，且增加速度为4%。文件的活跃度可根据文件的覆盖率、使用频率和趋势以及对应的归一化常数通过线性组合获得，也可仅由覆盖率、使用频率和趋势中的一个或两个确定。
在一个实施例中，获得文件的应用数据后，可根据下列方式获得文件的活跃度：
活跃度=文件机器数占比*a+文件周增长占比*b+文件次使用时长占比*c+文件周使用时长占比*d。
其中，a、b、c、d均为参数，其数值可以根据实际情况进行选择。在一个实施例中，a为0.8；b为0.1；c为0.08；d为0.02。
需要指出的是，在其他实施例中，获得文件的活跃度不限于上述方式，文件的活跃度可仅由文件机器数占比、文件周增长占比、文件次使用时长占比和文件周使用时长占比中的一个或任意几个的组合以及对应的参数获得。而且，参数不限于为上述数值。
步骤S140，根据活跃度判断文件安全性。
在一个实施例中，上述步骤S140为根据活跃度判断文件为安全文件或不安全文件。具体地，获取至少一阈值；将活跃度与阈值进行对比，对文件的安全性做判断。
在一个实施例中，阈值可仅为一个。阈值由编程人员根据实际工作中总结的经验进行设定。当文件的活跃度低于该阈值时，则判断该文件为不安全文件。当文件的活跃度高于该阈值时，则判断该文件为安全文件。
在另一个实施例中，阈值为一个。当文件的活跃度低于该阈值时，则判断该文件为安全文件。当文件的活跃度低于该阈值时，判断该文件为可疑文件。如图2所示，在判断为可疑文件后，依据步骤S210至步骤S240中的任何一种或几种判断文件的安全性。
步骤S210，验证文件的文件签名判断文件的安全性。
当文件为可疑文件时，通过验证签名判断其安全性。具体的，由于被签名的文件不可更改，文件被修改时，其签名便失效。因此，当验证文件签名可信赖时，表示文件未被修改，没有被植入病毒的可能，故可判断该文件为安全文件。当验证文件签名不可信赖时，表示文件被修改过，存在被植入病毒的可能，故判断该文件为不安全文件或可疑文件。
步骤S220，利用文件的文件信息与样本库中的数据进行简单匹配，判断文件的安全性。
具体地，利用文件的文件特征与样本库中黑、白名单的特征码进行匹配。特征码又称为电脑病毒特征码，由反病毒公司制作，一般为被反病毒公司确定只有该病毒才可能会有的二进制字符串，而且该字符串一般为文件中对应代码或汇编指令的地址。在进行简单匹配时，将文件的文件特征与黑、白名单中的特征码进行对比，若有对应的记录，则可直接判断出文件的安全性。
步骤S230，对文件的文件信息进行自动分析，判断文件的安全性。
具体地，文件信息中还包含文件的行为特征。自动分析即对文件的文件特征、行为特征进行智能启发分析判断，从而得到文件的安全性。
步骤S240，定期回扫文件，并将其转送至人工分析判断所述文件的安全性。
具体地，对于不确定其安全性的文件，需要定期进行扫描，监控其运行状态，并将该文件转送到人工处理平台。因此，工作人员便可对被发送至人工处理平台的文件进行人工分析，进而得到该文件的安全性。
需要指出的是，上述步骤S210~S240可以依次执行，也可选择其中任意几种步骤执行，还可以选择其中任意一种执行。当选择其中任意一种执行时，直接判断文件为安全文件或不安全文件。
在一个实施例中，阈值可包括第一阈值及第二阈值，且第一阈值小于第二阈值。具体地，在一个实施例中，第一阈值为60%，第二阈值为90%。需要指出的是，在其他实施例中，第一阈值和第二阈值是可变化的，可根据活跃度的计算方式和参数的不同而进行调整。
当活跃度高于第二阈值时，则判断文件为安全文件。即在一个实施例中活跃度高于90%。则表示该文件的覆盖率广、使用频率高，这种文件一般为系统文件。因此，可直接通过活跃度判断该文件为安全文件。
当活跃度介于第一阈值与第二阈值之间时，即在一个实施例中介于60%与90%之间。则表示该文件有一定的覆盖率和使用频率，这样的文件一般为装机流行软件。此时，单凭活跃度不能确定其安全性，需要验证其文件签名。若文件签名可信赖，则判断文件为安全文件。
当活跃度低于第一阈值时，即在一个实施例中活跃度低于60%。则表示该文件为非常见的软件，或当活跃度介于所述第一阈值与第二阈值之间且若文件签名不可信赖时，依次执行如下步骤判断文件的安全性：利用文件的文件信息与样本库中的数据进行简单匹配，判断文件的安全性；针对通过简单匹配不能判断其安全性的文件，对文件的文件信息进行自动分析，判断文件的安全性；针对自动分析不能判断其安全性的文件，定期回扫文件，并将其转送至人工分析判断文件的安全性。
在一个实施例中，鉴定文件安全性的方法还包括：将判断为安全文件的文件的文件信息存储到样本库中。
在传统的鉴定文件安全性的方法中，不能根据简单匹配快速判断文件的安全性的原因是：样本库中黑、白名单不够完备。本发明通过获得文件的活跃度，并将利用活跃度判断为安全文件的文件的文件信息直接存入到样本库中，因此可进一步完善样本库中白名单的内容。增大后续的鉴定过程中可直接通过简单匹配得到文件的安全性的概率，从而不需要经过自动分析和人工分析。
如图3所示，本发明还提供一种鉴定文件安全性的系统，该系统包括接收模块110、存取模块120、存取模块130及鉴定模块140。其中：
接收模块110用于获取文件的文件标识。
在一个实施例中，每款安全软件都需要在各个用户的计算机上安装客户端。客户端对用户计算机上的文件进行实时监控，当发现可疑文件时，则发出鉴定指令，以判断该可疑文件是否为病毒。当接收模块110获得鉴定指令后，便获取可疑文件的文件标识。文件标识为文件的唯一标示。在一个实施例中，文件标识为文件的信息摘要值（Md5值）。
存取模块120用于根据文件标识，获取文件的应用数据。
在一个实施例中，应用数据包括文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比。文件机器数占比为文件机器数对总机器数的占比。文件周增长占比为文件机器周增长数对文件增长前机器数的占比。文件次使用时长占比为文件使用时长对开机时长的占比。文件周使用时长占比为文件周使用时长对开机周时长的占比。
其中，文件机器数表示安装有该文件的计算机数量；总机器数表示注册计算机数量，即安装有某款安全软件的计算机数量；文件机器周增长数表示一周内新增加装有该文件的计算机数量；文件增长前机器数指的是一周前注册计算机的数量，即一周前的总机器数；文件使用时长即运行该文件的时长；开机时长指安装有该文件的计算机处于开机状态的时长；文件周使用时长即一周内运行该文件的时长；开机周时长指安装有该文件的计算机在一周内处于开机状态的时长。
需要指出的是，在其他实施例中，应用数据不限于上述数据，且应用数据也可以包含文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比中任意一种或几种的组合。
在一个实施例中，上述鉴定文件安全性的系统还包括数据收集模块，数据收集模块用于对应于文件标识，统计并上传每个文件的应用数据。
具体的，数据收集模块实时监控计算机上的文件，统计并上传每个文件的应用数据。服务器在获得上述应用数据后，将应用数据与文件标识对应存储。当收到鉴定指令并获取文件的文件标识后，根据文件标识查询对应的应用数据。若查询到相关记录，则更新应用数据并获取该应用数据；若未查找到相关的记录，则表示该文件为新文件，创建新的记录，并统计该文件的应用数据。
处理模块130用于根据应用数据获得文件的活跃度。
活跃度根据统计学的原理获得。文件的活跃度表示文件的流行程度，可反映该文件的覆盖率、使用频率、趋势等。覆盖率是指在特定范围的计算机用户中，使用该文件的用户所占的比例。例如，随机抽取5000个用户，其中有4000用户使用某一文件，则表示该文件的覆盖率为80%。使用频率是指计算机用户使用文件的时间在使用计算机的过程中所占的比例。趋势即指使用某一文件的计算机用户是增多还是在减少，以及增加或减少的速度。例如，随机抽取5000个用户，其中有4000用户使用某一文件，下一周统计时有4200个用户使用该文件，则该文件的趋势为增加，且增加速度为4%。文件的活跃度可根据文件的覆盖率、使用频率和趋势以及对应的归一化常数通过线性组合获得，也可仅由覆盖率、使用频率和趋势中的一个或两个确定。
在一个实施例中，存取模块120获得文件的应用数据后，处理模块130可根据下列方式获得文件的活跃度：
活跃度=文件机器数占比*a+文件周增长占比*b+文件次使用时长占比*c+文件周使用时长占比*d。
其中，a、b、c、d均为参数，其数值可以根据实际情况进行选择。在一个实施例中，a为0.8；b为0.1；c为0.08；d为0.02。
需要指出的是，在其他实施例中，处理模块130获得文件的活跃度不限于上述方式，文件的活跃度可仅由文件机器数占比、文件周增长占比、文件次使用时长占比和文件周使用时长占比中的一个或任意几个的组合以及对应的参数获得。而且，参数不限于为上述数值。
鉴定模块140用于根据活跃度判断文件安全性。
在一个实施例中，鉴定模块140用于根据活跃度判断文件为安全文件或不安全文件。具体地，鉴定模块140获取至少一阈值；将活跃度与阈值进行对比，对文件的安全性做判断。
在一个实施例中，阈值可仅为一个。阈值由编程人员根据实际工作中总结的经验进行设定。当文件的活跃度低于该阈值时，鉴定模块140则判断该文件为不安全文件。当文件的活跃度高于该阈值时，鉴定模块140则判断该文件为安全文件。
在另一个实施例中，阈值为一个。当文件的活跃度低于该阈值时，鉴定模块140则判断该文件为安全文件。当文件的活跃度低于该阈值时，鉴定模块140判断该文件为可疑文件。如图4所示，鉴定文件安全性的系统还包括签名验证模块150、匹配模块160、自动分析模块170及回扫转送模块180。其中：
签名验证模块150用于验证文件的文件签名判断文件的安全性。
当文件为可疑文件时，签名验证模块150通过验证签名判断其安全性。具体的，由于被签名的文件不可更改，文件被修改时，其签名便失效。因此，当验证文件签名可信赖时，表示文件未被修改，没有被植入病毒的可能，故签名验证模块150可判断该文件为安全文件。当验证文件签名不可信赖时，表示文件被修改过，存在被植入病毒的可能，故签名验证模块150判断该文件为不安全文件或可疑文件。
匹配模块160用于利用文件的文件信息与样本库中的数据进行简单匹配，判断文件的安全性。
具体地，匹配模块160利用文件的文件特征与样本库中黑、白名单的特征码进行匹配。特征码又称为电脑病毒特征码，由反病毒公司制作，一般为被反病毒公司确定只有该病毒才可能会有的二进制字符串，而且该字符串一般为文件中对应代码或汇编指令的地址。在进行简单匹配时，将文件的文件特征与黑、白名单中的特征码进行对比，若有对应的记录，则匹配模块160可直接判断出文件的安全性。
自动分析模块170用于对文件的文件信息进行自动分析，判断文件的安全性。
具体地，文件信息中还包含文件的行为特征。自动分析模块170对文件的文件特征、行为特征进行智能启发分析判断，从而得到文件的安全性。
回扫转送模块180用于定期回扫文件，并将其转送至人工分析判断文件的安全性。
具体地，对于不确定其安全性的文件，回扫转送模块180需要定期进行扫描，监控其运行状态，并将该文件转送到人工处理平台。因此，工作人员便可对被发送至人工处理平台的文件进行人工分析，进而得到该文件的安全性。
需要指出的是，在其他实施例中，可仅包括签名验证模块150、匹配模块160、自动分析模块170及回扫转送模块180中的任意一种或几种。
在一个实施例中，阈值可包括第一阈值及第二阈值，且第一阈值小于第二阈值。具体地，在一个实施例中，第一阈值为60%，第二阈值为90%。需要指出的是，在其他实施例中，第一阈值和第二阈值是可变化的，可根据活跃度的计算方式和参数的不同而进行调整。
鉴定文件安全性的系统还包括签名验证模块150、匹配模块160、自动分析模块170及回扫转送模块180。鉴定模块140用于当活跃度高于第二阈值时，则判断文件为安全。当活跃度介于第一阈值与第二阈值之间时，调用签名验证模块150验证所述文件签名，若文件签名可信赖，则判断文件为安全。当活跃度介于所述第一阈值与第二阈值之间且若文件签名不可信赖或活跃度低于第一阈值时，依次调用匹配模块160、自动分析模块170及回扫转送模块180判断文件的安全性。
在一个实施例中，鉴定文件安全性的系统还包括样本管理模块，样本管理模块用于将判断为安全文件的文件的文件信息存储到样本库中。
传统的鉴定文件安全性的系统不能根据匹配模块160快速判断文件的安全性的原因是：样本库中黑、白名单不够完备。本发明通过获得文件的活跃度，并将利用活跃度判断为安全文件的文件的文件信息直接存入到样本库中，因此可进一步完善样本库中白名单的内容。增大后续的鉴定过程中可直接通过匹配模块160进行简单匹配得到文件的安全性的概率，从而不需要经过自动分析和人工分析。
上述鉴定文件安全性的方法和系统，上述鉴定文件安全性的方法，获取文件的文件标识，并根据文件标识获取文件的应用数据。根据应用数据获得文件的活跃度，并根据活跃度判断文件安全性。文件的应用数据可通过用户实时反馈获取，根据应用数据得到活跃度后，根据统计学的原理，利用活跃度便可判断文件的安全性，从而不必经过耗时长的自动分析和人工分析。因此，通过上述方法和系统，可提高获得文件安全性的效率。
而且，将判断为安全的文件直接存入到样本库，可进一步完善样本库中的白名单，增大后续的鉴定过程中可直接通过简单匹配得到文件的安全性的概率，进一步提高获得文件安全性的效率。
如图5所示，本发明还提供一种包含计算机可执行指令的计算机存储介质，所述计算机可执行指令用于执行鉴定文件安全性的方法，上述方法包括以下步骤：
步骤S310，获取文件的文件标识。
步骤S320，根据文件标识，获取文件的应用数据。
步骤S330，根据应用数据获得文件的活跃度。
步骤S340，根据活跃度判断文件安全性。
其中，步骤S310、步骤S320、步骤S330及步骤S340分别与步骤S110、步骤S120、步骤S130及步骤S140的执行过程相同，故在此不再赘述。
在一个实施例中，上述方法还包括：将判断为安全文件的文件的文件信息存储到样本库中。
在一个实施例中，上述方法还包括：对应于文件标识，统计并上传每个文件的应用数据。
本发明还提供另一种鉴定文件安全性的系统，如图6所示，为了便于说明，仅示出了与本发明实施例相关的部分，具体技术细节未揭示的，请参照本发明实施例方法部分。该终端可以为包括手机、平板电脑、PDA（Personal Digital Assistant，个人数字助理）、POS（Point of Sales，销售终端）、车载电脑等任意终端设备，以终端为手机为例：
图6示出的是与本发明实施例提供的终端相关的手机的部分结构的框图。参考图6，手机包括： 射频 （ Radio Frequency ， RF ） 电路610、存储器620、输入单元630、显示单元640、传感器650、音频电路660、无线保真（wireless fidelity，WiFi）模块670、处理器680、以及电源690等部件。本领域技术人员可以理解，图6中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图6对手机的各个构成部件进行具体的介绍：
RF电路610可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器680处理；另外，将设计上行的数据发送给基站。通常，RF电路包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器（Low Noise Amplifier，LNA）、双工器等。此外，RF电路610还可以通过无线通信与网络和其他设备通信。上述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统（Global System of Mobile communication，GSM）、通用分组无线服务（General Packet Radio Service，GPRS）、码分多址（Code Division Multiple Access，CDMA）、宽带码分多址（Wideband Code Division Multiple Access, WCDMA）、长期演进 （Long Term Evolution,LTE）)、电子邮件、短消息服务（Short Messaging Service，SMS）等。
存储器620可用于存储软件程序以及模块，处理器680通过运行存储在存储器620的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。存储器620可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序（比如声音播放功能、图像播放功能等）等；存储数据区可存储根据手机的使用所创建的数据（比如音频数据、电话本等）等。此外，存储器620可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元630可用于接收输入的数字或字符信息，以及产生与手机的用户设置以及功能控制有关的键信号输入。具体地，输入单元630可包括触控面板631以及其他输入设备632。触控面板631，也称为触摸屏，可收集用户在其上或附近的触摸操作（比如用户使用手指、触笔等任何适合的物体或附件在触控面板631上或在触控面板631附近的操作），并根据预先设定的程式驱动相应的连接装置。可选的，触控面板631可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器680，并能接收处理器680发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板631。除了触控面板631，输入单元630还可以包括其他输入设备632。具体地，其他输入设备632可以包括但不限于物理键盘、功能键（比如音量控制按键、开关按键等）、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元640可用于显示由用户输入的信息或提供给用户的信息以及手机的各种菜单。显示单元640可包括显示面板641，可选的，可以采用液晶显示器（Liquid Crystal Display，LCD）、有机发光二极管（Organic Light-Emitting Diode, OLED）等形式来配置显示面板641。进一步的，触控面板631可覆盖显示面板641，当触控面板631检测到在其上或附近的触摸操作后，传送给处理器680以确定触摸事件的类型，随后处理器680根据触摸事件的类型在显示面板641上提供相应的视觉输出。虽然在图6中，触控面板631与显示面板641是作为两个独立的部件来实现手机的输入和输入功能，但是在某些实施例中，可以将触控面板631与显示面板641集成而实现手机的输入和输出功能。
手机还可包括至少一种传感器650，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板641的亮度，接近传感器可在手机移动到耳边时，关闭显示面板641和/或背光。作为运动传感器的一种，加速计传感器可检测各个方向上（一般为三轴）加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用（比如横竖屏切换、相关游戏、磁力计姿态校准）、振动识别相关功能（比如计步器、敲击）等; 至于手机还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路660、扬声器661，传声器662可提供用户与手机之间的音频接口。音频电路660可将接收到的音频数据转换后的电信号，传输到扬声器661，由扬声器661转换为声音信号输出；另一方面，传声器662将收集的声音信号转换为电信号，由音频电路660接收后转换为音频数据，再将音频数据输出处理器680处理后，经RF电路610以发送给比如另一手机，或者将音频数据输出至存储器620以便进一步处理。
WiFi属于短距离无线传输技术，手机通过WiFi模块670可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图6示出了WiFi模块670，但是可以理解的是，其并不属于手机的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
处理器680是手机的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器620内的软件程序和/或模块，以及调用存储在存储器620内的数据，执行手机的各种功能和处理数据，从而对手机进行整体监控。可选的，处理器680可包括一个或多个处理单元；优选的，处理器680可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器680中。
手机还包括给各个部件供电的电源690（比如电池），优选的，电源可以通过电源管理系统与处理器680逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
尽管未示出，手机还可以包括摄像头、蓝牙模块等，在此不再赘述。
在本发明实施例中，该终端所包括的处理器680还具有以下功能：执行鉴定文件安全性的方法，包括：
获取文件的文件标识；
根据所述文件标识，获取所述文件的应用数据；
根据所述应用数据获得所述文件的活跃度；
根据所述活跃度判断所述文件安全性。
进一步的，终端的处理器680还具有以下功能：根据应用数据获得文件的活跃度的方式为：
活跃度=文件机器数占比*a+文件周增长占比*b+文件次使用时长占比*c+文件周使用时长占比*d，其中a、b、c、d为参数。
进一步的，终端的处理器680还具有以下功能：根据活跃度判断文件的安全性的步骤为：
获取至少一阈值；
将活跃度与所述阈值进行对比，对文件的安全性做判断。
进一步的，终端的处理器680还具有以下功能：对文件的安全性做判断的步骤为根据活跃度判断文件为安全文件或可疑文件，若根据活跃度判断文件为可疑文件时，上述方法还包括以下步骤中的至少一种：
验证文件的文件签名判断文件的安全性；
利用文件的文件信息与样本库中的数据进行简单匹配，判断文件的安全性；
对文件的文件信息进行自动分析，判断文件的安全性；
定期回扫文件，并将其转送至人工分析判断文件的安全性。
进一步的，终端的处理器680还具有以下功能：阈值包括第一阈值及第二阈值，且第一阈值小于第二阈值，将所述活跃度与阈值进行对比，对文件的安全性做判断的步骤包括：
当活跃度高于第二阈值时，则判断所述文件为安全；
当活跃度介于第一阈值与第二阈值之间时，则验证所述文件签名，若文件签名可信赖，则判断文件为安全；
当活跃度介于第一阈值与第二阈值之间且若文件签名不可信赖或活跃度低于第一阈值时，依次执行以下步骤判断文件的安全性：
利用文件的文件信息与样本库中的数据进行简单匹配，判断文件的安全性；
对文件的文件信息进行自动分析，判断文件的安全性；
定期回扫文件，并将其转送至人工分析判断文件的安全性。
进一步的，终端的处理器680还具有以下功能：将判断为安全文件的文件的文件信息存储到样本库中。
进一步的，终端的处理器680还具有以下功能：对应于文件标识，统计并上传每个文件的应用数据。
以上所述实施例仅表达了本发明的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对本发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干变形和改进，这些都属于本发明的保护范围。因此，本发明专利的保护范围应以所附权利要求为准。

Claims (24)

  1. 一种鉴定文件安全性的方法，包括以下步骤：
    获取文件的文件标识；
    根据所述文件标识，获取所述文件的应用数据；
    根据所述应用数据获得所述文件的活跃度；
    根据所述活跃度判断所述文件安全性。
  2. 根据权利要求1所述的鉴定文件安全性的方法，其特征在于，所述应用数据包括文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比中的至少一种。
  3. 根据权利要求2所述的鉴定文件安全性的方法，其特征在于，根据所述应用数据获得所述文件的活跃度的方式为：
    活跃度=文件机器数占比*a+文件周增长占比*b+文件次使用时长占比*c+文件周使用时长占比*d，其中a、b、c、d为参数。
  4. 根据权利要求1所述的鉴定文件安全性的方法，其特征在于，所述根据所述活跃度判断文件的安全性的步骤为：
    获取至少一阈值；
    将所述活跃度与所述阈值进行对比，对所述文件的安全性做判断。
  5. 根据权利要求4所述的鉴定文件安全性的方法，其特征在于，所述对所述文件的安全性做判断的步骤为根据所述活跃度判断所述文件为安全文件或可疑文件，若根据所述活跃度判断所述文件为可疑文件时，所述方法还包括以下步骤中的至少一种：
    验证所述文件的文件签名判断所述文件的安全性；
    利用所述文件的文件信息与样本库中的数据进行简单匹配，判断所述文件的安全性；
    对所述文件的文件信息进行自动分析，判断所述文件的安全性；
    定期回扫所述文件，并将其转送至人工分析判断所述文件的安全性。
  6. 根据权利要求4所述的鉴定文件安全性的方法，其特征在于，所述阈值包括第一阈值及第二阈值，且所述第一阈值小于所述第二阈值，所述将所述活跃度与所述阈值进行对比，对所述文件的安全性做判断的步骤包括：
    当所述活跃度高于第二阈值时，则判断所述文件为安全；
    当所述活跃度介于所述第一阈值与第二阈值之间时，则验证所述文件签名，若所述文件签名可信赖，则判断所述文件为安全；
    当所述活跃度介于所述第一阈值与第二阈值之间且若所述文件签名不可信赖或所述活跃度低于第一阈值时，依次执行以下步骤判断所述文件的安全性：
    利用所述文件的文件信息与样本库中的数据进行简单匹配，判断所述文件的安全性；
    对所述文件的文件信息进行自动分析，判断所述文件的安全性；
    定期回扫所述文件，并将其转送至人工分析判断所述文件的安全性。
  7. 根据权利要求1所述的鉴定文件安全性的方法，其特征在于，所述方法还包括：
    将判断为安全文件的所述文件的文件信息存储到样本库中。
  8. 根据权利要求1所述的鉴定文件安全性的方法，其特征在于，所述方法还包括：
    对应于文件标识，统计并上传每个文件的应用数据。
  9. 一种鉴定文件安全性的系统，其特征在于，包括：
    接收模块，用于获取文件的文件标识；
    存取模块，用于根据所述文件标识，获取所述文件的应用数据；
    处理模块，用于根据所述应用数据获得所述文件的活跃度；
    鉴定模块，用于根据所述活跃度判断所述文件安全性。
  10. 根据权利要求9所述的鉴定文件安全性的系统，其特征在于，所述应用数据包括文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比中的至少一种。
  11. 根据权利要求10所述的鉴定文件安全性的系统，其特征在于，所述处理模块获得所述文件的活跃度的方式为：
    活跃度=文件机器数占比*a+文件周增长占比*b+文件次使用时长占比*c+文件周使用时长占比*d，其中a、b、c、d为参数。
  12. 根据权利要求9所述的鉴定文件安全性的系统，其特征在于，所述鉴定模块用于：
    获取至少一阈值；
    将所述活跃度与所述阈值进行对比，对所述文件的安全性做判断。
  13. 根据权利要求12所述的鉴定文件安全性的系统，其特征在于，所述鉴定模块用于根据所述活跃度判断所述文件为安全文件或可疑文件，所述系统还包括以下模块中的至少一种：
    签名验证模块，用于验证所述文件的文件签名判断所述文件的安全性；
    匹配模块，用于利用所述文件的文件信息与样本库中的数据进行简单匹配，判断所述文件的安全性；
    自动分析模块，用于对所述文件的文件信息进行自动分析，判断所述文件的安全性；
    回扫转送模块，用于定期回扫所述文件，并将其转送至人工分析判断所述文件的安全性。
  14. 根据权利要求12所述的鉴定文件安全性的系统，其特征在于，所述阈值包括第一阈值及第二阈值，且所述第一阈值小于所述第二阈值，所述系统还包括：
    签名验证模块，用于验证所述文件的文件签名判断所述文件的安全性；
    匹配模块，用于利用所述文件的文件信息与样本库中的数据进行简单匹配，判断所述文件的安全性；
    自动分析模块，用于对所述文件的文件信息进行自动分析，判断所述文件的安全性；
    回扫转送模块，用于定期回扫所述文件，并将其转送至人工分析判断所述文件的安全性；
    所述鉴定模块用于：
    当所述活跃度高于第二阈值时，则判断所述文件为安全；
    当所述活跃度介于所述第一阈值与第二阈值之间时，调用所述签名验证模块验证所述文件签名，若所述文件签名可信赖，则判断所述文件为安全；
    当所述活跃度介于所述第一阈值与第二阈值之间且若所述文件签名不可信赖或所述活跃度低于第一阈值时，依次调用所述匹配模块、自动分析模块及回扫转送模块判断所述文件的安全性。
  15. 根据权利要求9所述的鉴定文件安全性的系统，其特征在于，所述系统还包括样本管理模块，所述样本管理模块用于将判断为安全文件的所述文件的文件信息存储到样本库中。
  16. 根据权利要求9所述的鉴定文件安全性的系统，其特征在于，所述系统还包括数据收集模块，所述数据收集模块用于对应于文件标识，统计并上传每个文件的应用数据。
  17. 一种包含计算机可执行指令的计算机存储介质，所述计算机可执行指令用于执行鉴定文件安全性的方法，所述方法包括以下步骤：
    获取文件的文件标识；
    根据所述文件标识，获取所述文件的应用数据；
    根据所述应用数据获得所述文件的活跃度；
    根据所述活跃度判断所述文件安全性。
  18. 根据权利要求17所述的存储介质，其特征在于，所述应用数据包括文件机器数占比、文件周增长占比、文件次使用时长占比、文件周使用时长占比中的至少一种。
  19. 根据权利要求18所述的存储介质，其特征在于，根据所述应用数据获得所述文件的活跃度的方式为：
    活跃度=文件机器数占比*a+文件周增长占比*b+文件次使用时长占比*c+文件周使用时长占比*d，其中a、b、c、d为参数。
  20. 根据权利要求17所述的存储介质，其特征在于，所述根据所述活跃度判断文件的安全性的步骤为：
    获取至少一阈值；
    将所述活跃度与所述阈值进行对比，对所述文件的安全性做判断。
  21. 根据权利要求20所述的存储介质，其特征在于，所述对所述文件的安全性做判断的步骤为根据所述活跃度判断所述文件为安全文件或可疑文件，若根据所述活跃度判断所述文件为可疑文件时，所述方法还包括以下步骤中的至少一种：
    验证所述文件的文件签名判断所述文件的安全性；
    利用所述文件的文件信息与样本库中的数据进行简单匹配，判断所述文件的安全性；
    对所述文件的文件信息进行自动分析，判断所述文件的安全性；
    定期回扫所述文件，并将其转送至人工分析判断所述文件的安全性。
  22. 根据权利要求20所述的存储介质，其特征在于，所述阈值包括第一阈值及第二阈值，且所述第一阈值小于所述第二阈值，所述将所述活跃度与所述阈值进行对比，对所述文件的安全性做判断的步骤包括：
    当所述活跃度高于第二阈值时，则判断所述文件为安全；
    当所述活跃度介于所述第一阈值与第二阈值之间时，则验证所述文件签名，若所述文件签名可信赖，则判断所述文件为安全；
    当所述活跃度介于所述第一阈值与第二阈值之间且若所述文件签名不可信赖或所述活跃度低于第一阈值时，依次执行以下步骤判断所述文件的安全性：
    利用所述文件的文件信息与样本库中的数据进行简单匹配，判断所述文件的安全性；
    对所述文件的文件信息进行自动分析，判断所述文件的安全性；
    定期回扫所述文件，并将其转送至人工分析判断所述文件的安全性。
  23. 根据权利要求17所述的存储介质，其特征在于，所述方法还包括：
    将判断为安全文件的所述文件的文件信息存储到样本库中。
  24. 根据权利要求17所述的存储介质，其特征在于，所述方法还包括：
    对应于文件标识，统计并上传每个文件的应用数据。
PCT/CN2013/076883 2012-06-07 2013-06-06 鉴定文件安全性的方法、系统及存储介质 Ceased WO2013182073A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/560,016 US20150089662A1 (en) 2012-06-07 2014-12-04 Method and system for identifying file security and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210186579.6A CN102750476B (zh) 2012-06-07 2012-06-07 鉴定文件安全性的方法和系统
CN201210186579.6 2012-06-07

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/560,016 Continuation US20150089662A1 (en) 2012-06-07 2014-12-04 Method and system for identifying file security and storage medium

Publications (1)

Publication Number Publication Date
WO2013182073A1 true WO2013182073A1 (zh) 2013-12-12

Family

ID=47030649

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/076883 Ceased WO2013182073A1 (zh) 2012-06-07 2013-06-06 鉴定文件安全性的方法、系统及存储介质

Country Status (3)

Country Link
US (1) US20150089662A1 (zh)
CN (1) CN102750476B (zh)
WO (1) WO2013182073A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102750476B (zh) * 2012-06-07 2015-04-08 腾讯科技（深圳）有限公司 鉴定文件安全性的方法和系统
CN106934276B (zh) * 2015-12-30 2020-02-28 北京金山安全软件有限公司 一种检测移动终端系统安全性的方法、装置及移动终端
US10911452B2 (en) * 2016-11-22 2021-02-02 Synergex Group (corp.) Systems, methods, and media for determining access privileges
US11055426B2 (en) 2018-07-16 2021-07-06 Faro Technologies, Inc. Securing data acquired by coordinate measurement devices
CN112181908A (zh) * 2020-09-04 2021-01-05 北京灵汇数融科技有限公司 基于统计的电子文件鉴定方法及系统
CN115374067B (zh) * 2022-08-18 2025-12-05 腾讯云计算（北京）有限责任公司 异常文件的检测方法、装置、设备、存储介质及程序产品
CN116471123B (zh) * 2023-06-14 2023-08-25 杭州海康威视数字技术股份有限公司 针对智能设备安全威胁的智能分析方法、装置及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1900941A (zh) * 2006-04-28 2007-01-24 傅玉生 一种基于软件身份认证技术的计算机安全保护方法
CN101350049A (zh) * 2007-07-16 2009-01-21 珠海金山软件股份有限公司 鉴定病毒文件的方法、装置及网络设备
CN102346828A (zh) * 2011-09-20 2012-02-08 海南意源高科技有限公司 一种基于云安全的恶意程序判断方法
CN102750476A (zh) * 2012-06-07 2012-10-24 腾讯科技（深圳）有限公司 鉴定文件安全性的方法和系统

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4404246B2 (ja) * 2003-09-12 2010-01-27 株式会社日立製作所 データ特性に基づくバックアップシステム及び方法
US8713418B2 (en) * 2004-04-12 2014-04-29 Google Inc. Adding value to a rendered document
US9002328B2 (en) * 2004-08-23 2015-04-07 At&T Intellectual Property I, L.P. Electronic calendar for automatically scheduling a plurality of events based on a scheduling request and obtained additional information
US8135638B2 (en) * 2005-04-29 2012-03-13 International Business Machines Corporation Summarizing risk ratings to facilitate an analysis of risks
US20070033445A1 (en) * 2005-08-02 2007-02-08 Hirsave Praveen P K Method, apparatus, and program product for autonomic patch risk assessment
JP2008186176A (ja) * 2007-01-29 2008-08-14 Canon Inc 画像処理装置、文書結合方法および制御プログラム
JP4398988B2 (ja) * 2007-03-26 2010-01-13 株式会社東芝 構造化文書を管理する装置、方法およびプログラム
US8078909B1 (en) * 2008-03-10 2011-12-13 Symantec Corporation Detecting file system layout discrepancies
US20090292930A1 (en) * 2008-04-24 2009-11-26 Marano Robert F System, method and apparatus for assuring authenticity and permissible use of electronic documents
US9135442B1 (en) * 2008-05-30 2015-09-15 Symantec Corporation Methods and systems for detecting obfuscated executables
US8726391B1 (en) * 2008-10-10 2014-05-13 Symantec Corporation Scheduling malware signature updates in relation to threat awareness and environmental safety
US8769695B2 (en) * 2009-04-30 2014-07-01 Bank Of America Corporation Phish probability scoring model
US8621233B1 (en) * 2010-01-13 2013-12-31 Symantec Corporation Malware detection using file names
CN101827096B (zh) * 2010-04-09 2012-09-05 潘燕辉 一种基于云计算的多用户协同安全防护系统和方法
CN102446259B (zh) * 2010-09-30 2014-12-31 联想(北京)有限公司 组件访问控制方法及电子设备
US8590047B2 (en) * 2011-01-04 2013-11-19 Bank Of America Corporation System and method for management of vulnerability assessment
US9009819B1 (en) * 2011-01-20 2015-04-14 Symantec Corporation Method and system for detecting rogue security software that displays frequent misleading warnings
US20130179215A1 (en) * 2012-01-10 2013-07-11 Bank Of America Corporation Risk assessment of relationships

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1900941A (zh) * 2006-04-28 2007-01-24 傅玉生 一种基于软件身份认证技术的计算机安全保护方法
CN101350049A (zh) * 2007-07-16 2009-01-21 珠海金山软件股份有限公司 鉴定病毒文件的方法、装置及网络设备
CN102346828A (zh) * 2011-09-20 2012-02-08 海南意源高科技有限公司 一种基于云安全的恶意程序判断方法
CN102750476A (zh) * 2012-06-07 2012-10-24 腾讯科技（深圳）有限公司 鉴定文件安全性的方法和系统

Also Published As

Publication number Publication date
CN102750476A (zh) 2012-10-24
CN102750476B (zh) 2015-04-08
US20150089662A1 (en) 2015-03-26

Similar Documents

Publication Publication Date Title
WO2013182073A1 (zh) 鉴定文件安全性的方法、系统及存储介质
WO2020224246A1 (zh) 基于区块链的数据管理方法、装置、设备和存储介质
WO2016184330A1 (zh) 一种屏幕解锁方法、装置及存储介质
WO2014183454A1 (en) Method, terminal and computer storage medium for group sending message in instant communication
WO2017067271A1 (zh) 一种指纹识别方法、指纹识别装置和移动终端
WO2018076879A1 (zh) 数据备份方法、装置、存储介质及终端
CN107145794B (zh) 一种数据处理方法和装置及移动终端
US10454905B2 (en) Method and apparatus for encrypting and decrypting picture, and device
WO2018018772A1 (zh) 一种后台进程管理方法及终端设备
US20160142431A1 (en) Session processing method and device, server and storage medium
WO2018171534A1 (zh) 基于移动终端的双摄像头供电控制方法、系统及移动终端
CN106709340B (zh) 病毒查杀方法及装置
WO2018035930A1 (zh) 一种系统解锁方法和设备
WO2018076881A1 (zh) 数据同步方法、装置、存储介质及服务器
WO2018076890A1 (zh) 数据备份的方法、装置、存储介质、服务器及系统
WO2018145597A1 (zh) 基于移动终端的屏幕补光拍照方法及系统、移动终端
CN111209031B (zh) 一种数据获取方法、装置、终端设备及存储介质
WO2014201915A1 (zh) 软件修复方法和装置、计算机可读存储介质
WO2018076880A1 (zh) 数据备份方法、装置、存储介质及终端
CN103455751B (zh) 一种密码提示的生成方法、装置和终端设备
WO2019095156A1 (zh) 一种信息搜索的方法、终端、网络设备和系统
CN109067751B (zh) 一种非Root环境下ARP欺骗检测方法、装置及终端
CN107450952A (zh) 应用管控方法、装置、存储介质及电子设备
CN103824003B (zh) 应用程序保护方法、装置和终端
CN114745374B (zh) 文件传输方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13800535

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 13/02/2015)

122 Ep: pct application non-entry in european phase

Ref document number: 13800535

Country of ref document: EP

Kind code of ref document: A1