Malicious file detection (including Agentic malicious file detection) is built on the multi-engine detection platform of Security Center to identify and handle malicious file risks in your business. If you activate malicious file detection on a subscription basis, you can use capabilities such as multi-engine detection, compressed file detection, and encrypted file detection. If you activate Agentic malicious file detection on a pay-as-you-go basis, you can additionally use capabilities such as AI large language model detection, Skill file detection, and NAS file detection. This topic describes how to activate the service, the billing rules, and how to disable and unsubscribe from the service.
What is malicious file detection
Malicious file detection is a file security detection service provided by Security Center. It is used to detect malicious files such as ransomware, mining programs, and web shells that may be introduced in business scenarios such as file uploads, code releases, and data sharing, and prevents threats to the security of your business systems and data. Built on the multi-engine detection platform, the service supports the detection of files stored in Object Storage Service (OSS) and NAS (file storage), as well as server-side files, and provides two detection methods: console operations and SDK integration to help you identify and handle these risks. The basic and advanced detection capabilities that you can use vary based on the billing method that you activate:
Malicious file detection (Subscription): Supports basic detection capabilities such as multi-engine detection, compressed file detection, and encrypted file detection, but does not support AI large language model detection, Skill file detection, or NAS file detection.
Agentic malicious file detection (Pay-as-you-go): In addition to the capabilities of malicious file detection, it supports AI large language model detection, Skill file detection, and NAS file detection, and can identify new types of malicious files and advanced variant threats that traditional engines can hardly detect.
Core detection capabilities
Multi-engine detection: Built on the multi-engine detection platform of Security Center, it integrates anti-virus engines, deep learning engines, cloud sandboxes, and threat intelligence to detect malicious files such as ransomware, mining programs, web shells, DDoS Trojans, and backdoors.
Compressed file detection: Supports decompressing and scanning unencrypted compressed packages. The decompression level and file count are configurable.
Encrypted file detection: Supports automatically decrypting and scanning data encrypted with OSS server-side encryption (SSE-KMS, SSE-OSS).
AI large language model detection (Pay-as-you-go only): Uses large language models to deeply understand file semantics and behavioral intent, effectively identifying new types of malicious files and advanced variant threats that traditional engines can hardly detect.
NoteRisk files identified by AI models are marked with an AI detection label.
Skill file detection (Pay-as-you-go only): Provides dedicated detection capabilities for Skill files, covering more file formats and attack scenarios.
NAS file detection (Pay-as-you-go only): Supports the detection of files stored in NAS (file storage), helping detect malicious files in NAS and secure your file storage environment.
Common application scenarios
Scenario | Description |
Server attack prevention | Prevents worms, mining Trojans, and other threats to avoid server resource consumption or servers being used for DDoS attacks. |
Targeted attack defense | Detects backdoors, hacker tools, and other threats to prevent data theft and remote control of your systems. |
Office networks and file storage | Identifies documents or compressed packages that contain malicious macros or scripts to prevent phishing and credential theft. |
Full system environment detection | Detects and removes ransomware and file-infecting viruses to prevent data encryption extortion and widespread system failures. |
Related features
After you activate the malicious file detection service, you can use the following features to detect malicious files and handle alerts:
Configure custom detection rules: In addition to the built-in detection engines, you can configure custom rules for known threats (such as specific MD5 hashes, SHA256 hashes, or file paths). When a file that meets the specified conditions is detected, an alert is automatically generated, enabling precise detection of known threats. For more information, see Configure custom detection rules.
Detect malicious files: Configure manual or automatic detection tasks in the console to scan files in OSS buckets in batches or on a periodic basis. You can also integrate the SDK into your business code to call the detection capabilities. For more information, see Detect malicious files.
Handle detection results: After risk files are detected, the system generates alerts. You can add the detection results to a whitelist, ignore them, or block access to them, and complete security hardening for risk files to form a closed loop of emergency response. For more information, see Handle malicious file detection results.
Purchase and activate the service
Access the Security Center console - Risk Governance - Malicious File Detection. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
Follow the on-screen instructions to select Buy Now (Subscription) or Activate Pay-as-you-go to activate the feature.
Subscription: If you activate malicious file detection on a subscription basis, the service supports basic capabilities such as multi-engine detection, compressed file detection, and encrypted file detection, but does not support AI large language model detection, Skill file detection, or NAS file detection.
Free trial: If your Alibaba Cloud account has passed enterprise real-name verification, you can activate a free trial of malicious file detection.
Each Alibaba Cloud account is eligible for one free trial only.
The trial provides 10,000 Agentic malicious file detections.
If the free trial counts are not fully used, the remaining free trial counts can continue to be used and are deducted first after you activate the Subscription version.
Buy Now: You are redirected to the purchase page. Configure and complete the purchase based on the following descriptions.
In the Malicious File Detection section, set Purchase or Not to Yes.
Enter the required number of file detections, that is, the Quantity (minimum purchase: 100,000).
Pay-as-you-go: If you activate Agentic malicious file detection on a pay-as-you-go basis, the service supports AI large language model detection, Skill file detection, and NAS file detection in addition to the capabilities of malicious file detection.
In the pay-as-you-go activation dialog, click Activate Pay-as-you-go.
Enable Policy (Optional): If you select this option, a periodic detection policy is automatically enabled for newly uploaded files in the selected buckets. The policy takes effect immediately. To adjust the detection scope, you can modify the detection policy in Automatic detection (incremental files).
You can also go to the Security Center purchase page to complete the operations. For more information, see Purchase Security Center.
Disable and unsubscribe from the service
Subscription (malicious file detection)
On the Security Center console - Overview page Subscription section, click .
On the Order Downgrade tab, in the Malicious File Detection section, set Purchase or Not to No, and then click Order Now.
Pay-as-you-go (Agentic malicious file detection)
Method 1: On the Security Center console - Overview page Enable Pay-as-You-Go Service section, disable the Malicious File Detection switch.
Method 2:
Access the Security Center console - Risk Governance - Malicious File Detection. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
On the At-risk File Overview tab, click Used Quotas in the Suspended section.
Billing description
Malicious file detection (including Agentic malicious file detection) supports Subscription and Pay-as-you-go billing methods. For more information about billing models and billing logic, see Subscription and Pay-as-you-go.
Change billing methods:
Each Alibaba Cloud account can use only one billing method at a time. To switch the billing method, you must unsubscribe from Subscription or disable Pay-as-you-go first.
After you switch the billing method, the display of detection results and the execution of periodic policies are not affected.
Billing item: You are charged based on the number of detected files.
NoteIf compressed package detection is enabled, the quota consumed is calculated based on the number of decompressed files.
Billing methods:
Subscription: The unit price is USD 1.5 per 10,000 detections per month. Minimum purchase: 100,000 detections. The quota is valid within the selected validity period and is cleared after the quota expires.
NoteThe remaining free trial counts are deducted first, and then the purchased counts are used.
Pay-as-you-go:
File detection is billed on a natural day basis. The unit price is USD 0.0012 per file.
After you activate the Pay-as-you-go service, the system also charges the basic service fee of Security Center ( USD 0.0072 per hour).