Back to results
US 10,757,135 B2Granted
Bot characteristic detection method and apparatus
AssigneeHuawei Technologies Co., Ltd.
InventorWu Jiang
Life of this patent
Estimating the term…
Abstract
A bot characteristic detection method and apparatus, where the apparatus obtains a first dynamic behavior file and a second dynamic behavior file, where the first dynamic behavior file is a behavior file resulting from dynamic behavior detection performed on a malicious file in a first sandbox, and the second dynamic behavior file is a behavior file resulting from dynamic behavior detection performed on the malicious file in a second sandbox. The apparatus determines a bot characteristic of the malicious file based on a common characteristic of the first dynamic behavior file and the second dynamic behavior file.
Claims20
A bot characteristic detection method, implemented by a computing device, wherein the bot characteristic detection method comprises:
- obtaining a to-be-detected file;
- separately inputting the to-be-detected file into a first sandbox and a second sandbox;
- obtaining a static behavior file and a first dynamic behavior file from the first sandbox and a static behavior file and a second dynamic behavior file from the second sandbox, wherein the static behavior file from the first sandbox is resulting from first static behavior detection performed on the to-be-detected file in the first sandbox, wherein the static behavior file from the second sandbox is resulting from second static behavior detection performed on the to-be-detected file in the second sandbox, wherein the first dynamic behavior file from the first sandbox is resulting from first dynamic behavior detection performed on the to-be-detected file in the first sandbox, and wherein the second dynamic behavior file from the second sandbox is resulting from second dynamic behavior detection performed on the to-be-detected file in the second sandbox;
- determining that the to-be-detected file is a malicious file based on the static behavior file and the first dynamic behavior file from the first sandbox and the static behavior file and the second dynamic behavior file from the second sandbox;
- determining a bot characteristic of the to-be-detected file based on a common characteristic of the first dynamic behavior file and the second dynamic behavior file, wherein the common characteristic comprises session packet data that is generated when the to-be-detected file accesses another communication object in a network;
- forming a rule entry based on the bot characteristic of the to-be-detected file;
- and
- sending the rule entry to a cyber security device.
5 more elements
A bot characteristic detection method, implemented by a computing device, wherein the bot characteristic detection method comprises:
- obtaining a to-be-detected file;
- separately inputting the to-be-detected file into a first sandbox and a second sandbox;
- obtaining a first dynamic behavior file and a second dynamic behavior file, wherein the first dynamic behavior file is resulting from first dynamic behavior detection performed on the to-be-detected file in the first sandbox, wherein the second dynamic behavior file is resulting from second dynamic behavior detection performed on the to-be-detected file in the second sandbox, and wherein the first dynamic behavior file and the second dynamic behavior file are obtained by:
- obtaining a static behavior file and a dynamic behavior file from the first sandbox and a static behavior file and a dynamic behavior file from the second sandbox, wherein the static behavior file from the first sandbox is resulting from first static behavior detection performed on the to-be-detected file in the first sandbox, wherein the static behavior file from the second sandbox is resulting from second static behavior detection performed on the to-be-detected file in the second sandbox, wherein the dynamic behavior file from the first sandbox is resulting from the first dynamic behavior detection performed on the to-be-detected file in the first sandbox, and wherein the dynamic behavior file from the second sandbox is resulting from the second dynamic behavior detection performed on the to-be-detected file in the second sandbox;
- determining that the to-be-detected file is a malicious file based on the static behavior file and the dynamic behavior file from the first sandbox and the static behavior file and the dynamic behavior file from the second sandbox;
- and
- determining that the dynamic behavior file from the first sandbox is the first dynamic behavior file and that the dynamic behavior file from the second sandbox is the second dynamic behavior file when the to-be-detected file is the malicious file;
- determining a bot characteristic of the to-be-detected file based on a common characteristic of the first dynamic behavior file and the second dynamic behavior file;
- forming a first rule entry based on the bot characteristic of the to-be-detected file;
- and
- sending the first rule entry to a cyber security device.
8 more elements
A computing device, comprising:
- a non-transitory computer-readable storage memory configured to store one or more programs, wherein the one or more programs comprise an instruction;
- and
- one of more computer hardware processors coupled to the non-transitory computer-readable storage memory, wherein when the instruction is executed by the one or more computer hardware processors, causes the computing device to be configured to:
- obtaining a to-be-detected file;
- separately inputting the to-be-detected file into a first sandbox and a second sandbox;
- obtaining a static behavior file and a first dynamic behavior file from the first sandbox and a static behavior file and a second dynamic behavior file from the second sandbox, wherein the static behavior file from the first sandbox is resulting from first static behavior detection performed on the to-be-detected file in the first sandbox, wherein the static behavior file from the second sandbox is resulting from second static behavior detection performed on the to-be-detected file in the second sandbox, wherein the first dynamic behavior file from the first sandbox is resulting from first dynamic behavior detection performed on the to-be-detected file in the first sandbox, and wherein the second dynamic behavior file from the second sandbox is resulting from second dynamic behavior detection performed on the to-be-detected file in the second sandbox;
- determining that the to-be-detected file is a malicious file based on the static behavior file and the first dynamic behavior file from the first sandbox and the static behavior file and the second dynamic behavior file from the second sandbox;
- determining a bot characteristic of the to-be-detected file based on a common characteristic of the first dynamic behavior file and the second dynamic behavior file, wherein the common characteristic comprises session packet data that is generated when the to-be-detected file accesses another communication object in a network;
- forming a rule entry based on the bot characteristic of the to-be-detected file;
- and
- sending the rule entry to a cyber security device.
8 more elements
Dependencies are inferred from the claim text.