Program file classification method, program file classification apparatus, and program file classification system

A program file classification apparatus, comprising:

• a network interface configured to obtain behavior information respectively corresponding to at least two behaviors executed by a program file at runtime, wherein each piece of behavior information comprises a behavior identifier and a path related during execution of a corresponding behavior, wherein the path in each piece of behavior information comprises M levels of directories of a file, and wherein M is a positive integer;
• a memory coupled to the network interface and configured to store instructions;
• at least one processor coupled to the network interface and the memory, wherein the instructions cause the at least one processor to be configured to:
• perform normalization processing on the path in each piece of behavior information, wherein the normalization processing reduces path diversity, and wherein performing the normalization processing on the path in each piece of behavior information comprises:
• replacing first N levels of directories in the M levels of directories with a first identifier and replacing remaining M-N levels of directories in the M levels of directories with a number M-N when the M levels of directories meet a first regular expression, wherein N is a positive integer less than or equal to M, wherein a mapping relationship between the first regular expression and the first identifier belongs to one of first-type mapping relationships, and wherein the first-type mapping relationships comprise at least one mapping relationship between a set of regular expressions and an identifier;
• and
• reserving first L levels of directories in the M levels of directories and replacing remaining M-L levels of directories in the M levels of directories with a number M-L when the M levels of directories do not meet any mapping relationship in the first-type mapping relationships, wherein L is a positive integer less than or equal to M;
• generate a feature vector according to at least two pieces of behavior information obtained after the path normalization processing, wherein each element in the feature vector corresponds to one piece of behavior information obtained after the path normalization processing, wherein values of elements corresponding to same behavior information obtained after the path normalization processing are the same, and wherein the same behavior information comprises a same behavior identifier and a same path obtained after the normalization processing;
• and
• determine, according to the feature vector generated, a category to which the program file belongs.

A program file classification method, comprising:

• obtaining, by a classification server, behavior information respectively corresponding to at least two behaviors executed by a program file at runtime, wherein each piece of behavior information comprises a behavior identifier and a path related during execution of a corresponding behavior, wherein the path in each piece of behavior information comprises M levels of directories of a file, and wherein M is a positive integer;
• performing, by the classification server, normalization processing on the path in each piece of behavior information, wherein the normalization processing reduces path diversity, and wherein performing the normalization processing on the path in each piece of behavior information comprises reserving, by the classification server, first L levels of directories in the M levels of directories and replacing remaining M-L levels of directories in the M levels of directories with a number M-L when the M levels of directories do not meet any mapping relationship in first-type mapping relationships, wherein the first-type mapping relationships comprise at least one mapping relationship between a set of regular expressions and an identifier wherein L is a positive integer less than or equal to M;
• generating, by the classification server, a feature vector according to at least two pieces of behavior information obtained after the path normalization processing, wherein each element in the feature vector corresponds to one piece of behavior information obtained after the path normalization processing, wherein values of elements corresponding to same behavior information obtained after the path normalization processing are the same, and wherein the same behavior information comprises a same behavior identifier and a same path obtained after the normalization processing;
• and
• determining, by the classification server, according to the feature vector, a category to which the program file belongs.