Malicious file detection
Malicious file detection is a file security detection service provided by Security Center. It is used to detect malicious files such as ransomware, mining programs, and web shells that may be introduced in business scenarios such as file uploads, code releases, and data sharing, preventing threats to the security of your business systems and data. Built on the multi-engine detection platform, this service can detect malicious files in Object Storage Service (OSS) and server-side files, and provides multiple detection methods such as console operations and SDK integration. Agentic malicious file detection activated on a Pay-as-you-go basis additionally supports AI large language model detection, Skill file detection, and NAS file detection. This topic is intended to help users with different roles quickly select the most appropriate detection method based on their business scenarios.
Before you begin
You have activated malicious file detection. The detection capabilities that you can use vary based on the billing method used to activate the service.
If you activate malicious file detection on a Subscription basis, you can use basic capabilities such as multi-engine detection, compressed file detection, and encrypted file detection. AI large language model detection, Skill file detection, and NAS file detection are not supported.
If you activate Agentic malicious file detection on a Pay-as-you-go basis, you can additionally use AI large language model detection, Skill file detection, and NAS file detection on top of the malicious file detection capabilities.
Scope
Supported file types
Compressed file detection: Supports decompressing and scanning unencrypted compressed packages. The decompression level and file count are configurable. This configuration applies only to OSS files.
Encrypted file detection: Supports automatically decrypting and scanning data encrypted with OSS server-side encryption (SSE-KMS, SSE-OSS). This applies only to OSS files.
NAS file detection (Pay-as-you-go only): Supports detecting files in Apsara File Storage NAS. The supported file system types, zones, and limits are subject to the console display.
Skill file detection (Pay-as-you-go only): Provides specialized detection capabilities for Skill files, covering more file formats and attack scenarios.
Supported file formats:Multiple file types are supported, such as compressed packages, scripts/web shells, images, and executables/binary files. Only common types are listed here. For the complete list of supported types, see the console display.
Compressed packages:
.7z,.zip,.rar,.tar,.gz,.bz2,.xz,.lzma,.ar,.tar.gz, and more.Scripts/WebShell:
.php,.jsp,.jspx,.asp,.aspx,.sh,.py,.ps1,.pl,.bat,.html, and more.Documents:
.doc,.pdf,.ppt,.xsl,.rtf,.hta,.chm,.docx, and more.Images:
.jpg,.jpeg,.png, and more.Executables and binaries:
.apk,.exe,.dll,.ocx,.com,.so,.sys,.ko,.obj, and more.
Supported virus types:Supports detecting reverse shell backdoors, DDoS Trojans, mining programs, and other virus files. For more information, see Supported virus types.
Storage class restrictions:Only files stored in OSS with the storage class of Standard or Infrequent Access can be detected. The Archive storage class is not supported.
Supported regions:
China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab)
China (Hangzhou), China (Shanghai)
China (Shenzhen), China (Heyuan), China (Guangzhou)
China (Chengdu), China (Hong Kong)
Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), Japan (Tokyo), South Korea (Seoul), US (Silicon Valley), US (Virginia), Germany (Frankfurt), UK (London)
Configure and run detection tasks
Security Center provides two methods to perform detection tasks: console operations and SDK integration.
Feature | Console operation | SDK integration |
How to use | Log on to the Security Center console and perform operations in a graphical interface. | Integrate and call the SDK in your business code. Java and Python are supported. |
Supported files | Supports Object Storage Service (OSS) files and Apsara File Storage NAS files. Different tabs display the corresponding resource lists, and the operations are the same. Note NAS file detection is supported only when you use Pay-as-you-go (Agentic malicious file detection). |
|
Console operations
If the files to be detected are stored in OSS buckets, you can directly scan the files in the target OSS buckets in batches or on a periodic basis in the Security Center console.
Manual detection: This method is applicable to one-time scanning of existing files. It supports full detection and incremental detection.
Automatic detection: This method is applicable to continuous automatic scanning of newly added files.
Manual detection (existing files)
Go to the file detection page
Access the Security Center console - Risk Governance - Malicious File Detection. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
Start a detection task
OSS File Check
Click the OSS File Check tab.
Synchronize files (optional): If the bucket is not in the list of OSS File Check, click Synchronize Buckets to synchronize the latest bucket list.
Create a detection task:
Full detection:
Description: Detects all files in one or more buckets.
Operation entry:
Single detection: In the Actions column of the target bucket, click Check.
Batch detection: Select multiple buckets and click Batch Check below the list.
Incremental detection
Description: For buckets that have been detected and have file updates since the last detection, only detects files that have been added or changed since the last task.
Operation entry: In the Actions column of the target bucket, click Incremental Check.
Configure detection parameters: In the dialog box that appears, configure the following parameters.
File Check Type: Select the file extensions to be scanned. By default, all file types are detected.
Decompression Level and Max Files per Archive: If you want to scan the contents of compressed packages, set the decompression level (up to 5 levels) and the number of files in a single compressed package (up to 1,000). By default, decompression is disabled.
File Decryption Type: If the OSS files use server-side encryption (SSE-OSS or SSE-KMS), select the corresponding decryption method so that Security Center can decrypt and detect the files.
Detection file scope: Select the date and time range for detection. Only files within this range are scanned.
Scan Path:
Match by Prefix: Enter a file name prefix to scan specified files.
Configure for Entire Bucket: Scan all files in the bucket.
NAS File Detection (Pay-as-you-go only)
Click the NAS File Detection tab.
Synchronize files (optional): If the file system is not in the list of NAS File Detection, click Synchronize File System to synchronize the latest file system list.
Create a detection task:
Full detection:
Description: Detects all files in one or more file systems.
Operation entry:
Single detection: In the Actions column of the target file system, click Check.
Batch detection: Select multiple file systems and click Batch Check below the list.
Incremental detection
Description: For file systems that have been detected and have file updates since the last detection, only detects files that have been added or changed since the last task.
Operation entry: In the Actions column of the target file system, click Incremental Check.
Configure detection parameters: In the dialog box that appears, configure the following parameters.
File Check Type: Select the file extensions to be scanned. By default, all file types are detected.
Detection File Scope: Select the date and time range for detection. Only files within this range are scanned.
Wait for the detection task to complete: You can view the target File Check Status on the bucket or file system list page. When the status changes from Not Checked to Checked, the detection is complete.
NoteAfter a detection task is complete, data statistics and synchronization are performed in the background. The results are usually delayed by 1 to 2 hours. Please wait patiently.
Automatic detection (incremental files)
Go to the policy management page
Access the Security Center console - Risk Governance - Malicious File Detection. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
Click Policy Management in the upper-right corner.
Create or modify a detection policy
Create a new policy: In the Policy Management panel, click Create Policy.
Modify an existing policy: In the Actions column of the target policy, click Edit to add the target bucket or file system to the effective scope of the policy.
Configure basic information: On the Policy Configuration page, configure the basic information of the policy.
Effective Products: Select OSS.
Policy Name: Enter a policy name.
Policy Status: Enable or disable the policy.
Effective product: Select OSS/NAS.
Configure policy details: The configuration items vary based on the effective product. Configure the parameters based on the product you selected.
OSS policy
Increment Real-time Detection:
NoteReal-time incremental detection can be configured only in Chinese Mainland regions. It is not supported in Outside Chinese Mainland regions.
Enable: When a new file is uploaded to the specified bucket, detection is immediately triggered.
Disable: Scans newly added files based on the configured detection cycle (such as every day or every 3 days) and file detection time (such as 02:00-04:00).
Scan Path: Select prefix matching or apply to the entire bucket.
Detection file scope: Select the date and time range for detection. Only files within this range are scanned.
File Check Type: Select the file extensions to be scanned. By default, all file types are detected.
Decompression Level and Max Files per Archive: If you want to scan the contents of compressed packages, set the decompression level (up to 5 levels) and the number of files in a single compressed package (up to 1,000). By default, decompression is disabled.
File Decryption Type: If the OSS files use server-side encryption (SSE-OSS or SSE-KMS), select the corresponding decryption method so that Security Center can decrypt and detect the files.
Effective Bucket: Select one or more buckets to which this policy applies. If the target bucket is already used by another policy, it cannot be selected again.
WarningAfter the policy takes effect, files in newly added buckets are not automatically detected. If you need to detect them, manually edit the policy and add them to the Effective Bucket list.
NAS policy (Pay-as-you-go only)
Detection Cycle: Select the execution cycle for the detection task.
Check Time: Select the execution time for the detection task. The interval cannot be less than 1 hour.
WarningIf the detection task exceeds the configured detection time, it is automatically paused and restarted in the next detection cycle.
Detection File Scope: Select the date and time range for detection. Only files within this range are scanned.
File Check Type: Select the file extensions to be scanned. By default, all file types are detected.
Effective File System: Select one or more NAS file systems to which this policy applies. If the target file system is already used by another policy, it cannot be selected again.
After you complete the configuration, click OK.
SDK integration
Integrate the malicious file detection service in your business code to obtain malicious file information from the returned results and implement file detection. Agentic malicious file detection activated on a Pay-as-you-go basis additionally provides AI large language model detection, Skill file detection, and other capabilities.
Step 1: Prepare access credentials and permissions
Create an access key
To ensure account security, do not use the AccessKey of your Alibaba Cloud account. We recommend that you create a dedicated RAM user for API access and grant it the minimum required permissions. For more information, see Create a RAM user and Create an AccessKey.
Create a new account
Log on to the RAM console by using your Alibaba Cloud account or a RAM administrator account. On the Users page, click Create User.
Complete the configuration based on the following information:
User Account Information: Enter a logon name, tags, and other information.
Direct Access: Select Use Permanent AccessKey to Access.
Complete security verification. The system automatically generates an AccessKey ID and an AccessKey Secret for the RAM user. Keep the key information secure.
NoteYou can download the key CSV file or copy the content and save it locally. For more information, see Create an AccessKey pair.
Existing RAM account
Log on to the RAM console by using your Alibaba Cloud account or a RAM administrator account, and go to the details page of the target user.
On the Logon-free Configuration tab, in the AccessKey Pair section, click Create AccessKey.
Select a usage scenario based on your business needs, select I confirm that I must create an AccessKey pair, and then click Continue to Create.
Complete security verification. The system automatically generates an AccessKey ID and an AccessKey Secret for the RAM user. Keep the key information secure.
NoteYou can download the key CSV file or copy the content and save it locally. For more information, see Create an AccessKey.
Configure permission policies
On the Users page, click the target RAM user. In the Actions column, click Grant permissions to the user..
In the Policy section, select AliyunYundunSASFullAccess, and then click Confirm Authorization.
NoteFor more information, see Grant permissions to a RAM user.
Configure environment variables
Alibaba Cloud SDKs support creating default access credentials by defining the
ALIBABA_CLOUD_ACCESS_KEY_IDandALIBABA_CLOUD_ACCESS_KEY_SECRETenvironment variables. When you call an API, the program directly accesses the credentials, reads the access key (AccessKey), and automatically completes authentication. For more information, see Configure environment variables.Linux/macOS
Configure the AccessKey ID and press Enter.
# Replace yourAccessKeyID with your AccessKey ID. export ALIBABA_CLOUD_ACCESS_KEY_ID=yourAccessKeyIDConfigure the AccessKey secret and press Enter.
# Replace yourAccessKeySecret with your AccessKey secret. export ALIBABA_CLOUD_ACCESS_KEY_SECRET=yourAccessKeySecretVerify the configuration.
Run the
echo $ALIBABA_CLOUD_ACCESS_KEY_IDcommand. If the command returns the correct AccessKey ID, the configuration is successful.
Windows
Use the graphical user interface (GUI)
Procedure
The following steps describe how to set environment variables using the GUI in Windows 10.
On your desktop, right-click This PC and choose Properties > Advanced system settings > Environment Variables > New under System variables or User variables. Then, complete the configuration.
Variable
Example value
AccessKey ID
Variable name: ALIBABA_CLOUD_ACCESS_KEY_ID
Variable value: yourAccessKeyID
AccessKey secret
Variable name: ALIBABA_CLOUD_ACCESS_KEY_SECRET
Variable value: yourAccessKeySecret
Test the configuration
Click Start (or use the Win+R keyboard shortcut), click Run, enter `cmd`, and then click OK (or press Enter) to open the command prompt. Run the
echo %ALIBABA_CLOUD_ACCESS_KEY_ID%andecho %ALIBABA_CLOUD_ACCESS_KEY_SECRET%commands. If the commands return the correct AccessKey, the configuration is successful.
Use the command prompt (CMD)
Procedure
Open the command prompt as an administrator and run the following commands to add new environment variables to the system.
setx ALIBABA_CLOUD_ACCESS_KEY_ID yourAccessKeyID /M setx ALIBABA_CLOUD_ACCESS_KEY_SECRET yourAccessKeySecret /MThe
/Mparameter indicates a system environment variable. You can omit this parameter when you set a user environment variable.Test the configuration
Click Start (or use the Win+R keyboard shortcut), click Run, enter `cmd`, and then click OK (or press Enter) to open the command prompt. Run the
echo %ALIBABA_CLOUD_ACCESS_KEY_ID%andecho %ALIBABA_CLOUD_ACCESS_KEY_SECRET%commands. If the commands return the correct AccessKey, the configuration is successful.
Use Windows PowerShell
In PowerShell, you can set new environment variables that are valid for all new sessions:
[System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_ID', 'yourAccessKeyID', [System.EnvironmentVariableTarget]::User) [System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_SECRET', 'yourAccessKeySecret', [System.EnvironmentVariableTarget]::User)To set environment variables for all users, you must have administrative permissions:
[System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_ID', 'yourAccessKeyID', [System.EnvironmentVariableTarget]::Machine) [System.Environment]::SetEnvironmentVariable('ALIBABA_CLOUD_ACCESS_KEY_SECRET', 'yourAccessKeySecret', [System.EnvironmentVariableTarget]::Machine)You can set temporary environment variables that are valid only for the current session:
$env:ALIBABA_CLOUD_ACCESS_KEY_ID = "yourAccessKeyID" $env:ALIBABA_CLOUD_ACCESS_KEY_SECRET = "yourAccessKeySecret"In PowerShell, run the
Get-ChildItem env:ALIBABA_CLOUD_ACCESS_KEY_IDandGet-ChildItem env:ALIBABA_CLOUD_ACCESS_KEY_SECRETcommands. If the commands return the correct AccessKey, the configuration is successful.
Step 2: Install the SDK
Select the installation method based on your development language. Currently, only Java and Python are supported.
Java
Prerequisite: JDK 1.8 or later.
Installation:
Go to the Java SDK repository to download the latest version of the Java SDK file.
Add the downloaded SDK file to your project.
Python
Prerequisite: Python 3.6 or later.
Installation:
Online installation: Install quickly using pip.
<BASH> pip install -U alibabacloud_filedetectOffline installation:
In a networked environment, go to the Python SDK repository to download the latest version of the Python SDK.
Upload the downloaded source package to your project environment and decompress it.
Go to the decompressed SDK root directory and run the installation command:
<BASH> # Change to the Python SDK root directory # The directory name may vary by version, e.g., alibabacloud_filedetect-1.0.0 cd alibabacloud_filedetect-x.x.x/ # Install using your Python version python setup.py install
Step 3: Write code and run detection
After the environment is configured, refer to the following Python and Java code examples to write your code.
Replace the path, URL, and MD5 parameters in the sample code with your actual values.
package com.aliyun.filedetect.sample;
import java.io.File;
import java.util.HashMap;
import java.util.Map;
import com.aliyun.filedetect.*;
public class Sample {
/**
* Synchronous file detection interface
* @param detector Detector object
* @param path Path of the file to be detected
* @param timeout_ms Set the timeout period in milliseconds
* @param wait_if_queuefull If the detection queue is full, false indicates returning an error immediately without waiting, while true indicates waiting until the queue has space.
* @throws InterruptedException
*/
public static DetectResult detectFileSync(OpenAPIDetector detector, String path, int timeout_ms, boolean wait_if_queuefull) throws InterruptedException {
if (null == detector || null == path) return null;
DetectResult result = null;
while(true) {
result = detector.detectSync(path, timeout_ms);
if (null == result) break;
if (result.error_code != ERR_CODE.ERR_DETECT_QUEUE_FULL) break;
if (!wait_if_queuefull) break;
detector.waitQueueAvailable(-1);
}
return result;
}
/**
* Asynchronous file detection interface
* @param detector Detector object
* @param path Path of the file to be detected
* @param timeout_ms Set the timeout period in milliseconds
* @param wait_if_queuefull If the detection queue is full, false indicates returning an error immediately without waiting, while true indicates waiting until the queue has space.
* @param callback Callback function for the result
* @throws InterruptedException
*/
public static int detectFile(OpenAPIDetector detector, String path, int timeout_ms, boolean wait_if_queuefull, IDetectResultCallback callback) throws InterruptedException {
if (null == detector || null == path || null == callback) return ERR_CODE.ERR_INIT.value();
int result = ERR_CODE.ERR_INIT.value();
if (wait_if_queuefull) {
final IDetectResultCallback real_callback = callback;
callback = new IDetectResultCallback() {
public void onScanResult(int seq, String file_path, DetectResult callback_res) {
if (callback_res.error_code == ERR_CODE.ERR_DETECT_QUEUE_FULL) return;
real_callback.onScanResult(seq, file_path, callback_res);
}
};
}
while(true) {
result = detector.detect(path, timeout_ms, callback);
if (result != ERR_CODE.ERR_DETECT_QUEUE_FULL.value()) break;
if (!wait_if_queuefull) break;
detector.waitQueueAvailable(-1);
}
return result;
}
/**
* Synchronous URL file detection interface
* @param detector Detector object
* @param url URL of the file to be detected
* @param md5 MD5 hash of the file to be detected
* @param timeout_ms Set the timeout period in milliseconds
* @param wait_if_queuefull If the detection queue is full, false indicates returning an error immediately without waiting, while true indicates waiting until the queue has space.
* @throws InterruptedException
*/
public static DetectResult detectUrlSync(OpenAPIDetector detector, String url, String md5, int timeout_ms, boolean wait_if_queuefull) throws InterruptedException {
if (null == detector || null == url || null == md5) return null;
DetectResult result = null;
while(true) {
result = detector.detectUrlSync(url, md5, timeout_ms);
if (null == result) break;
if (result.error_code != ERR_CODE.ERR_DETECT_QUEUE_FULL) break;
if (!wait_if_queuefull) break;
detector.waitQueueAvailable(-1);
}
return result;
}
/**
* Asynchronous URL file detection interface
* @param detector Detector object
* @param url URL of the file to be detected
* @param md5 MD5 hash of the file to be detected
* @param timeout_ms Set the timeout period in milliseconds
* @param wait_if_queuefull If the detection queue is full, false indicates returning an error immediately without waiting, while true indicates waiting until the queue has space.
* @param callback Callback function for the result
* @throws InterruptedException
*/
public static int detectUrl(OpenAPIDetector detector, String url, String md5, int timeout_ms, boolean wait_if_queuefull, IDetectResultCallback callback) throws InterruptedException {
if (null == detector || null == url || null == md5 || null == callback) return ERR_CODE.ERR_INIT.value();
int result = ERR_CODE.ERR_INIT.value();
if (wait_if_queuefull) {
final IDetectResultCallback real_callback = callback;
callback = new IDetectResultCallback() {
public void onScanResult(int seq, String file_path, DetectResult callback_res) {
if (callback_res.error_code == ERR_CODE.ERR_DETECT_QUEUE_FULL) return;
real_callback.onScanResult(seq, file_path, callback_res);
}
};
}
while(true) {
result = detector.detectUrl(url, md5, timeout_ms, callback);
if (result != ERR_CODE.ERR_DETECT_QUEUE_FULL.value()) break;
if (!wait_if_queuefull) break;
detector.waitQueueAvailable(-1);
}
return result;
}
/**
* Format the detection result
* @param result Detection result object
* @return Formatted string
*/
public static String formatDetectResult(DetectResult result) {
if (result.isSucc()) {
DetectResult.DetectResultInfo info = result.getDetectResultInfo();
String msg = String.format("[DETECT RESULT] [SUCCEED] %s", formatDetectResultInfo(info));
if (info.compresslist != null) {
int idx = 1;
for (DetectResult.CompressFileDetectResultInfo comp_res : info.compresslist) {
msg += String.format("\n\t\t\t [COMPRESS FILE] [IDX:%d] %s", idx++, formatCompressFileDetectResultInfo(comp_res));
}
}
return msg;
}
DetectResult.ErrorInfo info = result.getErrorInfo();
return String.format("[DETECT RESULT] [FAIL] md5: %s, time: %d, error_code: %s, error_message: %s"
, info.md5, info.time, info.error_code.name(), info.error_string);
}
private static String formatDetectResultInfo(DetectResult.DetectResultInfo info) {
String msg = String.format("MD5: %s, TIME: %d, RESULT: %s, SCORE: %d", info.md5, info.time, info.result.name(), info.score);
if (info.compresslist != null) {
msg += String.format(", COMPRESS_FILES: %d", info.compresslist.size());
}
DetectResult.VirusInfo vinfo = info.getVirusInfo();
if (vinfo != null) {
msg += String.format(", VIRUS_TYPE: %s, EXT_INFO: %s", vinfo.virus_type, vinfo.ext_info);
}
return msg;
}
private static String formatCompressFileDetectResultInfo(DetectResult.CompressFileDetectResultInfo info) {
String msg = String.format("PATH: %s, \t\t RESULT: %s, SCORE: %d", info.path, info.result.name(), info.score);
DetectResult.VirusInfo vinfo = info.getVirusInfo();
if (vinfo != null) {
msg += String.format(", VIRUS_TYPE: %s, EXT_INFO: %s", vinfo.virus_type, vinfo.ext_info);
}
return msg;
}
/**
* Synchronously detect a directory or file
* @param path The specified path can be a file or a directory. If it is a directory, its content is recursively traversed.
* @param is_sync Specifies whether to use the synchronous interface. We recommend using the asynchronous interface. true: synchronous, false: asynchronous
* @throws InterruptedException
*/
public static void detectDirOrFileSync(OpenAPIDetector detector, String path, int timeout_ms, Map<String, DetectResult> result_map) throws InterruptedException {
File file = new File(path);
String abs_path = file.getAbsolutePath();
if (file.isDirectory()) {
String[] ss = file.list();
if (ss == null) return;
for (String s : ss) {
String subpath = abs_path + File.separator + s;
detectDirOrFileSync(detector, subpath, timeout_ms, result_map);
}
return;
}
System.out.println(String.format("[detectFileSync] [BEGIN] queueSize: %d, path: %s, timeout: %d", detector.getQueueSize(), abs_path, timeout_ms));
DetectResult res = detectFileSync(detector, abs_path, timeout_ms, true);
System.err.println(String.format(" [ END ] %s", formatDetectResult(res)));
result_map.put(abs_path, res);
}
/**
* Asynchronously detect a directory or file
* @param path The specified path can be a file or a directory. If it is a directory, its content is recursively traversed.
* @param is_sync Specifies whether to use the synchronous interface. We recommend using the asynchronous interface. true: synchronous, false: asynchronous
* @throws InterruptedException
*/
public static void detectDirOrFile(OpenAPIDetector detector, String path, int timeout_ms, IDetectResultCallback callback) throws InterruptedException {
File file = new File(path);
String abs_path = file.getAbsolutePath();
if (file.isDirectory()) {
String[] ss = file.list();
if (ss == null) return;
for (String s : ss) {
String subpath = abs_path + File.separator + s;
detectDirOrFile(detector, subpath, timeout_ms, callback);
}
return;
}
int seq = detectFile(detector, abs_path, timeout_ms, true, callback);
System.out.println(String.format("[detectFile] [BEGIN] seq: %d, queueSize: %d, path: %s, timeout: %d", seq, detector.getQueueSize(), abs_path, timeout_ms));
}
/**
* Start detecting a file or directory
* @param path The specified path can be a file or a directory. If it is a directory, its content is recursively traversed.
* @param is_sync Specifies whether to use the synchronous interface. We recommend using the asynchronous interface. true: synchronous, false: asynchronous
* @throws InterruptedException
*/
public static void scan(final OpenAPIDetector detector, String path, int detect_timeout_ms, boolean is_sync) throws InterruptedException {
System.out.println(String.format("[SCAN] [START] path: %s, detect_timeout_ms: %d, is_sync: %b", path, detect_timeout_ms, is_sync));
long start_time = System.currentTimeMillis();
final Map<String, DetectResult> result_map = new HashMap<>();
if (is_sync) {
detectDirOrFileSync(detector, path, detect_timeout_ms, result_map);
} else {
detectDirOrFile(detector, path, detect_timeout_ms, new IDetectResultCallback() {
public void onScanResult(int seq, String file_path, DetectResult callback_res) {
System.err.println(String.format("[detectFile] [ END ] seq: %d, queueSize: %d, %s", seq, detector.getQueueSize(), formatDetectResult(callback_res)));
result_map.put(file_path, callback_res);
}
});
// Wait for the task to complete.
detector.waitQueueEmpty(-1);
}
long used_time = System.currentTimeMillis() - start_time;
System.out.println(String.format("[SCAN] [ END ] used_time: %d, files: %d", used_time, result_map.size()));
int fail_count = 0;
int white_count = 0;
int black_count = 0;
for (Map.Entry<String, DetectResult> entry : result_map.entrySet()) {
DetectResult res = entry.getValue();
if (res.isSucc()) {
if (res.getDetectResultInfo().result == DetectResult.RESULT.RES_BLACK) {
black_count ++;
} else {
white_count ++;
}
} else {
fail_count ++;
}
}
System.out.println(String.format(" fail_count: %d, white_count: %d, black_count: %d"
, fail_count, white_count, black_count));
}
public static void main(String[] args_) throws Exception {
// Get the detector instance.
OpenAPIDetector detector = OpenAPIDetector.getInstance();
// Initialize.
ERR_CODE init_ret = detector.init(System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID"), System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET"));
System.out.println("INIT RET: " + init_ret.name());
// Set decompression parameters (optional, compressed packages are not decompressed by default).
boolean decompress = true; // Specifies whether to identify and decompress compressed files. Default is false.
int decompressMaxLayer = 5; // Maximum decompression level. Effective when decompress is true.
int decompressMaxFileCount = 1000; // Maximum number of decompressed files. Effective when decompress is true.
ERR_CODE initdec_ret = detector.initDecompress(decompress, decompressMaxLayer, decompressMaxFileCount);
System.out.println("INIT_DECOMPRESS RET: " + initdec_ret.name());
if (true) {
// Example 1: Scan a local directory or file.
boolean is_sync_scan = false; // Specifies whether to use asynchronous or synchronous detection. Asynchronous detection offers better performance. false indicates asynchronous detection.
int timeout_ms = 500000; // Detection time for a single sample, in milliseconds.
String path = "test2.php"; // The file or directory to be scanned.
// Start the scan and wait for it to finish.
scan(detector, path, timeout_ms, is_sync_scan);
}
if (true) {
// Example 2: Scan a URL file.
int timeout_ms = 500000; // Detection time for a single sample, in milliseconds.
String url = "https://xxxxxxxx.oss-cn-hangzhou-1.aliyuncs.com/xxxxx/xxxxxxxxxxxxxx?Expires=1*****25&OSSAccessKeyId=xxx"; // The URL file to be scanned.
String md5 = "a767f*************6e21d000000"; // The MD5 hash of the file to be scanned.
// Synchronous scan. To perform an asynchronous scan, call the detectUrl interface.
System.out.println(String.format("[detectUrlSync] [BEGIN] URL: %s, MD5: %s, TIMEOUT: %d", url, md5, timeout_ms));
DetectResult result = detectUrlSync(detector, url, md5, timeout_ms, true);
System.err.println(String.format("[detectUrlSync] [ END ] %s", formatDetectResult(result)));
}
// Deinitialize.
System.out.println("Over.");
detector.uninit();
}
}
# -*- coding: utf-8 -*-
import os
import sys
from typing import List
import threading
import time
import traceback
from alibabacloud_filedetect.OpenAPIDetector import OpenAPIDetector
from alibabacloud_filedetect.IDetectResultCallback import IDetectResultCallback
from alibabacloud_filedetect.ERR_CODE import ERR_CODE
from alibabacloud_filedetect.DetectResult import DetectResult
class Sample(object):
def __init__(self):
pass
"""
Synchronous file detection interface
@param detector: Detector object
@param path: Path of the file to be detected
@param timeout_ms: Set the timeout period in milliseconds
@param wait_if_queuefull: If the detection queue is full, False indicates returning an error immediately without waiting, while True indicates waiting until the queue has space.
"""
def detectFileSync(self, detector, path, timeout_ms, wait_if_queuefull):
if detector is None or path is None:
return None
result = None
while True:
result = detector.detectSync(path, timeout_ms)
if result is None:
break
if result.error_code != ERR_CODE.ERR_DETECT_QUEUE_FULL:
break
if wait_if_queuefull is False:
break
detector.waitQueueAvailable(-1)
return result
"""
Asynchronous file detection interface
@param detector: Detector object
@param path: Path of the file to be detected
@param timeout_ms: Set the timeout period in milliseconds
@param wait_if_queuefull: If the detection queue is full, False indicates returning an error immediately without waiting, while True indicates waiting until the queue has space.
@param callback: Callback function for the result
"""
def detectFile(self, detector, path, timeout_ms, wait_if_queuefull, callback):
if detector is None or path is None or callback is None:
return ERR_CODE.ERR_INIT.value
result = ERR_CODE.ERR_INIT.value
if wait_if_queuefull:
real_callback = callback
class AsyncTaskCallback(IDetectResultCallback):
def onScanResult(self, seq, file_path, callback_res):
if callback_res.error_code == ERR_CODE.ERR_DETECT_QUEUE_FULL:
return
real_callback.onScanResult(seq, file_path, callback_res)
callback = AsyncTaskCallback()
while True:
result = detector.detect(path, timeout_ms, callback)
if result != ERR_CODE.ERR_DETECT_QUEUE_FULL.value:
break
if wait_if_queuefull is False:
break
detector.waitQueueAvailable(-1)
return result
"""
Synchronous URL file detection interface
@param detector: Detector object
@param url: URL of the file to be detected
@param md5: MD5 hash of the file to be detected
@param timeout_ms: Set the timeout period in milliseconds
@param wait_if_queuefull: If the detection queue is full, False indicates returning an error immediately without waiting, while True indicates waiting until the queue has space.
"""
def detectUrlSync(self, detector, url, md5, timeout_ms, wait_if_queuefull):
if detector is None or url is None or md5 is None:
return None
result = None
while True:
result = detector.detectUrlSync(url, md5, timeout_ms)
if result is None:
break
if result.error_code != ERR_CODE.ERR_DETECT_QUEUE_FULL:
break
if wait_if_queuefull is False:
break
detector.waitQueueAvailable(-1)
return result
"""
Asynchronous URL file detection interface
@param detector: Detector object
@param url: URL of the file to be detected
@param md5: MD5 hash of the file to be detected
@param timeout_ms: Set the timeout period in milliseconds
@param wait_if_queuefull: If the detection queue is full, False indicates returning an error immediately without waiting, while True indicates waiting until the queue has space.
@param callback: Callback function for the result
"""
def detectUrl(self, detector, url, md5, timeout_ms, wait_if_queuefull, callback):
if detector is None or url is None or md5 is None or callback is None:
return ERR_CODE.ERR_INIT.value
result = ERR_CODE.ERR_INIT.value
if wait_if_queuefull:
real_callback = callback
class AsyncTaskCallback(IDetectResultCallback):
def onScanResult(self, seq, file_path, callback_res):
if callback_res.error_code == ERR_CODE.ERR_DETECT_QUEUE_FULL:
return
real_callback.onScanResult(seq, file_path, callback_res)
callback = AsyncTaskCallback()
while True:
result = detector.detectUrl(url, md5, timeout_ms, callback)
if result != ERR_CODE.ERR_DETECT_QUEUE_FULL.value:
break
if wait_if_queuefull is False:
break
detector.waitQueueAvailable(-1)
return result
"""
Format the detection result
@param result: Detection result object
@return: Formatted string
"""
@staticmethod
def formatDetectResult(result):
msg = ""
if result.isSucc():
info = result.getDetectResultInfo()
msg = "[DETECT RESULT] [SUCCEED] {}".format(Sample.formatDetectResultInfo(info))
if info.compresslist is not None:
idx = 1
for comp_res in info.compresslist:
msg += "\n\t\t\t [COMPRESS FILE] [IDX:{}] {}".format(idx, Sample.formatCompressFileDetectResultInfo(comp_res))
idx += 1
else:
info = result.getErrorInfo()
msg = "[DETECT RESULT] [FAIL] md5: {}, time: {}, error_code: {}, error_message: {}".format(info.md5,
info.time, info.error_code.name, info.error_string)
return msg
@staticmethod
def formatDetectResultInfo(info):
msg = "MD5: {}, TIME: {}, RESULT: {}, SCORE: {}".format(info.md5, info.time, info.result.name, info.score)
if info.compresslist is not None:
msg += ", COMPRESS_FILES: {}".format(len(info.compresslist))
vinfo = info.getVirusInfo()
if vinfo is not None:
msg += ", VIRUS_TYPE: {}, EXT_INFO: {}".format(vinfo.virus_type, vinfo.ext_info)
return msg
@staticmethod
def formatCompressFileDetectResultInfo(info):
msg = "PATH: {}, \t\t RESULT: {}, SCORE: {}".format(info.path, info.result.name, info.score)
vinfo = info.getVirusInfo()
if vinfo is not None:
msg += ", VIRUS_TYPE: {}, EXT_INFO: {}".format(vinfo.virus_type, vinfo.ext_info)
return msg
"""
Synchronously detect a directory or file
@param path: The specified path can be a file or a directory. If it is a directory, its content is recursively traversed.
@param is_sync: Specifies whether to use the synchronous interface. We recommend using the asynchronous interface. True: synchronous, False: asynchronous
"""
def detectDirOrFileSync(self, detector, path, timeout_ms, result_map):
abs_path = os.path.abspath(path)
if os.path.isdir(abs_path):
sub_files = os.listdir(abs_path)
if len(sub_files) == 0:
return
for sub_file in sub_files:
sub_path = os.path.join(abs_path, sub_file)
self.detectDirOrFileSync(detector, sub_path, timeout_ms, result_map)
return
print("[detectFileSync] [BEGIN] queueSize: {}, path: {}, timeout: {}".format(
detector.getQueueSize(), abs_path, timeout_ms))
res = self.detectFileSync(detector, abs_path, timeout_ms, True)
print(" [ END ] {}".format(Sample.formatDetectResult(res)))
result_map[abs_path] = res
return
"""
Asynchronously detect a directory or file
@param path: The specified path can be a file or a directory. If it is a directory, its content is recursively traversed.
@param is_sync: Specifies whether to use the synchronous interface. We recommend using the asynchronous interface. True: synchronous, False: asynchronous
"""
def detectDirOrFile(self, detector, path, timeout_ms, callback):
abs_path = os.path.abspath(path)
if os.path.isdir(abs_path):
sub_files = os.listdir(abs_path)
if len(sub_files) == 0:
return
for sub_file in sub_files:
sub_path = os.path.join(abs_path, sub_file)
self.detectDirOrFile(detector, sub_path, timeout_ms, callback)
return
seq = self.detectFile(detector, abs_path, timeout_ms, True, callback)
print("[detectFile] [BEGIN] seq: {}, queueSize: {}, path: {}, timeout: {}".format(
seq, detector.getQueueSize(), abs_path, timeout_ms))
return
"""
Start detecting a file or directory
@param path: The specified path can be a file or a directory. If it is a directory, its content is recursively traversed.
@param is_sync: Specifies whether to use the synchronous interface. We recommend using the asynchronous interface. True: synchronous, False: asynchronous
"""
def scan(self, detector, path, detect_timeout_ms, is_sync):
try:
print("[SCAN] [START] path: {}, detect_timeout_ms: {}, is_sync: {}".format(path, detect_timeout_ms, is_sync))
start_time = time.time()
result_map = {}
if is_sync:
self.detectDirOrFileSync(detector, path, detect_timeout_ms, result_map)
else:
class AsyncTaskCallback(IDetectResultCallback):
def onScanResult(self, seq, file_path, callback_res):
print("[detectFile] [ END ] seq: {}, queueSize: {}, {}".format(seq,
detector.getQueueSize(), Sample.formatDetectResult(callback_res)))
result_map[file_path] = callback_res
self.detectDirOrFile(detector, path, detect_timeout_ms, AsyncTaskCallback())
# Wait for the task to complete.
detector.waitQueueEmpty(-1)
used_time_ms = (time.time() - start_time) * 1000
print("[SCAN] [ END ] used_time: {}, files: {}".format(int(used_time_ms), len(result_map)))
failed_count = 0
white_count = 0
black_count = 0
for file_path, res in result_map.items():
if res.isSucc():
if res.getDetectResultInfo().result == DetectResult.RESULT.RES_BLACK:
black_count += 1
else:
white_count += 1
else:
failed_count += 1
print(" fail_count: {}, white_count: {}, black_count: {}".format(
failed_count, white_count, black_count))
except Exception as e:
print(traceback.format_exc(), file=sys.stderr)
def main(self):
# Get the detector instance.
detector = OpenAPIDetector.get_instance()
# Read the AccessKey ID and AccessKey Secret from environment variables.
access_key_id = os.getenv('ALIBABA_CLOUD_ACCESS_KEY_ID')
access_key_secret = os.getenv('ALIBABA_CLOUD_ACCESS_KEY_SECRET')
# Initialize.
init_ret = detector.init(access_key_id, access_key_secret)
print("INIT RET: {}".format(init_ret.name))
# Set decompression parameters (optional, compressed packages are not decompressed by default).
decompress = True # Specifies whether to identify and decompress compressed files. Default is false.
decompressMaxLayer = 5 # Maximum decompression level. Effective when decompress is true.
decompressMaxFileCount = 1000 # Maximum number of decompressed files. Effective when decompress is true.
initdec_ret = detector.initDecompress(decompress, decompressMaxLayer, decompressMaxFileCount)
print("INIT_DECOMPRESS RET: {}".format(initdec_ret.name))
if True:
# Example 1: Scan a local directory or file.
is_sync_scan = False # Specifies whether to use asynchronous or synchronous detection. Asynchronous detection offers better performance. False indicates asynchronous detection.
timeout_ms = 500000 # Detection time for a single sample, in milliseconds.
path = "test.bin" # The file or directory to be scanned.
# Start the scan and wait for it to finish.
self.scan(detector, path, timeout_ms, is_sync_scan)
if True:
# Example 2: Scan a URL file.
timeout_ms = 500000
url = "https://xxxxxxxx.oss-cn-hangzhou-1.aliyuncs.com/xxxxx/xxxxxxxxxxxxxx?Expires=1671448125&OSSAccessKeyId=xxx" # The URL file to be scanned.
md5 = "a767ffc59d93125c7505b6e21d000000"
# Synchronous scan. To perform an asynchronous scan, call the detectUrl interface.
print("[detectUrlSync] [BEGIN] URL: {}, MD5: {}, TIMEOUT: {}".format(url, md5, timeout_ms))
result = self.detectUrlSync(detector, url, md5, timeout_ms, True)
print("[detectUrlSync] [ END ] {}".format(Sample.formatDetectResult(result)))
# Deinitialize.
print("Over.")
detector.uninit()
if __name__ == "__main__":
sample = Sample()
sample.main()
Step 4: Parse the returned results
After you call the SDK to detect malicious files, you can view the detection results in the program output. The results are also synced to the Security Center console.
Result data structure: Each detection returns a
DetectResultobject. The core fields are as follows:Field
Type
Description
md5String
The MD5 hash value of the file.
timelong
The time used for this detection (in milliseconds).
error_codeERR_CODE
Error code.
ERR_SUCCindicates success.error_stringString
Detailed error information.
resultRESULT (enum)
Detection result enum:
RES_WHITE: SafeRES_BLACK: Suspicious/MaliciousRES_PENDING: Pending.
scoreint
Detection score. Range: 0-100. A higher score indicates a higher risk.
0 ~ 60: Safe. The file is trusted and usually requires no action.
61 ~ 70: Risk (Low). The file has a minor risk. Manual review is recommended.
71 ~ 80: Suspicious (Medium). The file is likely malicious. Isolation or deletion is recommended.
81 ~ 100: Malicious (High). The file is almost certainly malicious. Isolate or delete it immediately.
virus_typeString
Virus type, such as WebShell, MalScript, Hacktool, and more.
ext_infoString
Extended information, usually a JSON string containing more detailed detection context.
compresslistList
If the detected file is a compressed file and decompression is enabled, this list contains the detection results of each file in the compressed package.
Error codes and troubleshooting
Error code
Description
Cause
Suggested solution
ERR_SUCCSuccess
Detection completed successfully.
None
ERR_INITInitialization error
The SDK needs to be initialized, or was initialized repeatedly.
Ensure that
init()has been called successfully before calling the detection interface.ERR_FILE_NOT_FOUNDFile not found
The specified local file path does not exist.
Check whether the file path is correct and whether the program has file read permissions.
ERR_CALL_APIAPI call error
An unknown error occurred when calling the cloud API.
Check the code and parameter values.
ERR_TIMEOUTTimeout
The detection time exceeded the configured
timeout_ms.Increase the
timeout_msparameter value, or check the network connection.ERR_UPLOADUpload failed
The file failed to upload to the cloud for analysis. You can retry.
Usually a network issue. We recommend adding retry logic.
ERR_ABORTTask aborted
The program exited before detection was completed. The detection file count may have exceeded the pre-paid quota, or the account balance is insufficient for pay-as-you-go billing.
Purchase additional detection counts or recharge your account.
ERR_DETECT_QUEUE_FULLDetection queue full
Detection tasks were submitted too frequently and the server-side queue is full.
This may occur during peak hours. You can call
waitQueueAvailable()to wait for the queue to become available, or retry later.ERR_TIMEOUT_QUEUEQueue timeout
The wait time in the queue was too long.
ERR_MD5MD5 format error
The provided MD5 string format is incorrect.
Correct the MD5 format.
ERR_URLURL format error
The provided URL string format is incorrect.
Correct the URL format.
View and process detection results
View results
At-risk File Overview tab:
Centrally displays all risk files detected by all detection methods (OSS detection and API calls). You can search, filter risk files, and view their risk levels, threat tags, and other information.
For compressed files, click the expand
icon before the file to view the list of risk files in the package.
OSS File Check/NAS File Detection tab:
Displays risk statistics by bucket or file system, such as the number of risk files and detection progress for each bucket or file system.
You can click the Actions column and click Details to view the associated malicious file list.
Result delivery: If you have enabled Security Center Log Analysis or Log Management features, malicious file detection logs are automatically stored in a dedicated Logstore in Security Center for deep queries and traceability analysis. For more information, see SAS log delivery and SIEM logs.
Process results: Supports operations on detection results including Add to Whitelist, Ignore, Denied Access and other operations. For specific operations, see Handle malicious file detection results.
Configure notifications (optional)
Security Center provides DingTalk robot notification features that can automatically push detected malicious file alerts to DingTalk groups for timely response to detection risks. The procedure is as follows:
Access the Security Center console - System Settings - Notifications. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
On the DingTalk Chatbot tab, click Add Chatbot.
Notify On: We recommend that you select all severity levels for malicious file detection.
Other information: See Configure DingTalk chatbot notifications.
Quotas and limits
File size limits:
Total file size per task: No limit.
Single file size limit:
SDK offline file detection: single file must not exceed 100 MB.
Console OSS file detection: single file must not exceed 1 GB.
Over-limit description:
When the file size exceeds the limit or the decompressed files exceed the quantity or size limit, the relevant files will not be detected. Undetected files are not counted toward the billing count.
When malicious file detection requests exceed the queue capacity, you need to wait or optimize the concurrency processing capability.
Compressed file detection limits: Up to 5 decompression levels, 1,000 files, and 1 GB total size.
Environment restrictions: Financial Cloud and Government Cloud environments are not supported.
Default API request rate (QPS): Trial: 10 requests/second. Paid: 20 requests/second.
NoteDetection speed is affected by network conditions, server performance, cloud product specifications, and other factors.
The SDK uses an asynchronous queue mechanism to handle request peaks and improve concurrency. When the internal queue is full, new requests are paused until the queue has available space.
Billing
Malicious file detection (including Agentic malicious file detection) is billed based on the number of detected files (file detection count). Use Subscription to activate Malicious File Detection, or Pay-as-you-go to activate Agentic Malicious File Detection.
Pricing:
Subscription (Malicious File Detection): CNY 0.001 per detection per month. Subscription supports only the malicious file detection feature. AI model detection, Skill file detection, and NAS file detection are not supported.
Pay-as-you-go (Agentic Malicious File Detection): CNY 0.009 per file. Pay-as-you-go supports the full Agentic malicious file detection capabilities. In addition to the malicious file detection feature, it also supports AI model detection, Skill file detection, and NAS file detection.
NoteAfter you activate the Pay-as-you-go service, the system charges an additional base service fee (CNY 0.05 per hour).
Compressed file billing: If compressed file detection is enabled, the detection counts consumed are calculated based on the number of decompressed files.
Example: Detecting a compressed package containing 1,000 small files counts as 1,000 files and consumes 1,000 detection counts.
Process detection results: Included in the feature service fee. No additional charge.
For more information about billing models and billing logic, see Subscription and Pay-as-you-go.
Troubleshooting
Bucket list is empty or target bucket not found
Cause: The bucket region is not within the supported regions for malicious file detection.
Solution: Confirm whether the bucket region is in the Scope list of supported regions. If not supported, copy the files to a bucket in a supported region.
Cause: The bucket list has not been synced.
Solution: On the OSS File Check tab, click Synchronize Buckets to sync the latest bucket list.
Insufficient permissions or authorization failure
Cause: The Security Center service-linked role has not been created, or the permission policy is incomplete.
Solution: Ensure that the current Alibaba Cloud account has RAM management permissions. When you activate malicious file detection for the first time, the system automatically creates the service-linked role
AliyunServiceRoleForSasFileDetect. To create it manually, see Create a RAM user.
Detection task cannot be initiated or insufficient quota
Cause: The Subscription resource pack has expired, or the Pay-as-you-go account balance is insufficient.
Solution: Go to the Security Center Overview page to view the current available detection count. If the count is insufficient, see Security Center purchase page to renew or recharge.
Cause: The detection queue is full, exceeding the QPS limit.
Solution: The default QPS is 10 requests/second for the trial version and 20 requests/second for the paid version. Reduce the concurrency frequency or retry later.
Encrypted files cannot be detected
Cause: The OSS file uses an unsupported encryption method, or the decryption method is incorrectly selected.
Solution: Malicious file detection only supports OSS server-side encryption (SSE-KMS, SSE-OSS). Select the File Decryption Type that matches the file encryption method. Client-side encryption or third-party encrypted files are not supported.
FAQ
Billing and quota
Can used file detection counts be refunded?
No. Before detection, confirm the file scope and detection policy to avoid wasting detection counts due to misoperation.
Why are "Total Files" and "Detected Total Files" inconsistent on the OSS file detection tab?
Total Files: The natural number of files in the bucket (a compressed package counts as 1 ).
Detected Total Files: The actual number of files scanned. If compressed file scanning is enabled, the internal files are also counted. The total number depends on the Decompression Level and maximum decompressed file count settings. This value is the cumulative total of all historical detection tasks under the current bucket, not the count from a single detection. Even if files have been deleted, their historical detection records are still counted in the cumulative total, so the detected total may be greater than the current number of files in the bucket.
When a compressed package with a large number of files is scanned, "Detected Total Files" will be much larger than "Total Files". Billing is based on the actual number of detected files.
What should I do if the detection task is interrupted due to insufficient quota?
If you use the Subscription model, the scan task will be interrupted when the remaining detection counts are insufficient. Refer to the following solutions:
Cancel the current scan task: On the OSS File Check page, find the bucket that is being scanned, and click the Cancel Detection button in the bucket row to cancel the current scan task.
Upgrade configuration: Access the Security Center console - Overview page, in the Subscription section, click Change Configuration>Upgrade Now to purchase sufficient malicious file detection counts. For more information, see Upgrade or downgrade.
Modify detection policy: Disable compressed file decompression in the detection settings to reduce the count consumed per task, and then rerun the scan.
If you do not cancel the current task and simply renew and continue scanning, the system will still decompress and scan the files in the compressed package, which will continue to consume your quota.
Authorization management
How do I view the authorization details of the malicious file SDK (such as remaining count and expiration time)?
You can view the Personal SDK Authorization of the current account in the console, including version, activation status, authorization limits, remaining count, rate limits, and expiration time.
Access the Security Center console - Risk Governance - Malicious File Detection. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
Click SDK and Permissions in the upper-right corner.
What should I do if I receive a prompt "Malicious file detection SDK purchased but not yet used" or "Notification not configured"?
Purchased but not yet used: This means detection quota has been purchased but no detection task has been executed. Refer to the "Configure and run detection tasks" section in this topic to perform manual detection via the console or integrate the SDK to initiate detection.
Notification not configured: This means detection result notifications have not been configured, which does not affect the detection feature itself. To receive notifications when malicious files are detected, refer to the "Configure notifications (optional)" section in this topic to complete the setup. Once configured, the prompt will disappear.
Appendix
API reference
You can use the malicious file detection feature by calling API operations. Some reference documents are listed below:
GetFileDetectApiInvokeInfo: Queries the usage information about the malicious file detection SDK.
CreateFileDetectUploadUrl: Obtains the parameters used to upload a file.
CreateFileDetect: Pushes files for detection.
GetFileDetectResult: Obtains the file detection result.
ListCompressFileDetectResult: Obtains the list of detection results of files in a compressed package.
Supported virus types
Virus type (virus_type) | Virus name |
Backdoor | Reverse shell backdoor |
DDoS | DDoS Trojan |
Downloader | Downloader Trojan |
Engtest | Engine test program |
Hacktool | Hacking tool |
Trojan | High-risk program |
Malbaseware | Contaminated base software |
MalScript | Malicious script |
Malware | Malware |
Miner | Mining program |
Proxytool | Proxy tool |
RansomWare | Ransomware |
RiskWare | Riskware |
Rootkit | Rootkit |
Stealer | Stealer |
Scanner | Scanner |
Suspicious | Suspicious program |
Virus | Infectious virus |
WebShell | Web shell |
Worm | Worm |
AdWare | Adware |
Patcher | Patcher |
Gametool | Game tool |