| 摘要 |
Embodiments of this application provide a file reputation acquiring method, a gateway device, and a file reputation server. The method includes: acquiring a function hash value of at least one function in an accessed file ; determining, by using a classifier obtained in advance by training, a probability distribution separately corresponding to each function hash value, where the probability distribution is used to indicate a probability that each function hash value appears in a file of a black sample set, and a probability that each function hash value appears in a file of a white sample set; and determining a reputation value of the accessed file according to the probability distribution corresponding to each function hash value. A reputation value of a file is evaluated and determined based on a probability distribution of a function hash value is an accessed file, which effectively resolves a problem in the prior art that a manner in which a characteristic value is generated based on file content causes a failure in a query for a file reputation value. |
