Abstract: Examples of extracting a message format are disclosed. Extracting the message format may include capturing an execution trace of a malicious program client and identifying and analyzing a processing procedure of a message in the execution trace. An input message format is identified based on the analysis, where the input message format is of a communication protocol used by a malicious program. The examples of identifying the message format provide increase extraction efficiency, accurate analysis and positioning, and a reduced rate of false positives.

Abstract: A safe input method and system are provided. The method includes: starting a virtual machine mode of a central processing unit when safe input is to be performed; in the virtual machine mode, switching a guest operating system into a non-root mode, and switching a virtual machine monitor allocated for a safe input protection program into a root mode; receiving, by the guest operating system, input data of a user, and transmitting the input data of the user to the virtual machine monitor; encrypting and saving, by the virtual machine monitor, the input data to be retrieved by an authorized program; generating, by the virtual machine monitor, false input data, and returning the false input data to the guest operating system; and shutting down the virtual machine mode of the central processing unit when it is confirmed that the safe input is completed.

Abstract: Examples of extracting a message format are disclosed. Extracting the message format may include capturing an execution trace of a malicious program client and identifying and analyzing a processing procedure of a message in the execution trace. An input message format is identified based on the analysis, where the input message format is of a communication protocol used by a malicious program. The examples of identifying the message format provide increase extraction efficiency, accurate analysis and positioning, and a reduced rate of false positives.

Abstract: A method and device for processing data in the field of data process are disclosed. The method includes: sorting samples according to primary keys, wherein the primary key includes a feature serial number and a sample serial number, and wherein a column value corresponding to the primary key is used as a feature value for the sample; acquiring a statistic of each feature in each category by taking the primary key and the feature value as an input key-value pair and calculating with a first algorithm model, and outputting the feature serial number and the statistic as an output key-value pair; and acquiring a contribution value of each feature to the category by performing calculation on the output key-value pair with a second algorithm model, and selecting a feature based on the contribution value. The device includes a sorting module, a first processing module and a second processing module.

Abstract: A data processing method is provided, which includes: performing a fingerprint calculation for each data element of a set of data elements to obtain fingerprint information of the data elements; grouping the data elements into data groups in accordance with the fingerprint information, including by grouping data elements with the same fingerprint information into a same data group; and selecting a particular data element from each of the data groups for modeling calculation. A corresponding device is described. With the technical solutions according to the present method, data processing amount for modeling calculation may be reduced, which may thereby reduce data processing time and improve the data processing efficiency.

Abstract: A method for analyzing spyware and a computer system that relates to communication technology are provided. A trace of an executed spyware process is captured by the computer system. The spyware process includes a data packet returning operation that transmits a data packet to a control host as a result of executing the spyware process. The data packet returning operation has a subprogram which is extracted from the execution trace. The subprogram includes at least one call interface. Semantic information from each component of information of the at least one call interface is analyzed and output. In this manner a specific format of a data packet returned to the control host is determined, a communication protocol of the spyware is obtained, and a user may rewrite control commands of the spyware according to the obtained communication protocol, to control execution of the spyware.