Patent ID: 9166998
Filing Date: 2015-10-20
Classification: G06F,H04L

Abstract:
1. A method for determining security information of an unknown file, comprising: receiving, by a cloud security serving end, file security querying information reported by a cloud client end when a preconfigured monitoring point is triggered, wherein the file security querying information comprises identifier information and behavior information of a file; and creating, by the cloud security serving end, a behavior sequence of the file within a lifecycle according to the file security querying information of the file, analyzing the behavior sequence of the file within the lifecycle, and determining file security information of the file according to an analyzed result; wherein the analyzing the behavior sequence of the file within the lifecycle and determining file security information of the file according to the analyzed result comprises: analyzing the behavior sequence of the file within the lifecycle according to a file behavior sequence model created based on at least one of file behavior sequences of safe files and file behavior sequences of unsafe files, to obtain a security level of the file; if the security level is higher than a first threshold, determining the file security information of the file to be a safe file; if the security level is lower than a second threshold, determining the file security information to be an unsafe file; if the security level is lower than the first threshold and higher than the second threshold, the cloud security serving end inquiring a statistic information database to obtain a statistical result of feedback information of the file, and determining the file security information of the file according to the security level and the statistical result of the feedback information.