A system and method with active virus automatic prevention and control

Abstract

The utility model discloses an active automatic anti-virus system and the method, comprising a virus judgment unit and a virus replication unit, a controlled virus operating unit, a behavior monitor unit, an analytical unit, a virus report analytical unit and a virus feature library unit, as well as a malicious network crawling unit and a reporting unit. The utility model has the advantages that the system and method overcome the neglect of a plurality of important information of the virus in the prior art of virus analysis, and deeply analyzes and utilize the neglected important information to realize a more active and automatic virus control.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an active automatic virus prevention and control system and method. Background technique [0002] A computer virus is a software program deliberately designed to interfere with computer operations, record, destroy or delete data, or to spread itself to other computers and throughout the Internet. [0003] Computer viruses are different from medical "viruses" in that they do not exist naturally. Some people use the inherent vulnerability of computer software and hardware to compile programs with special functions. It lurks in the computer storage medium (or program) through a certain way, and is activated when a certain condition is met, and puts an exact copy or possibly evolved form of itself into other programs by modifying other programs, thereby infecting They are a set of programs or sets of instructions that cause damage to computer resources. [0004] E...

AI Technical Summary

Problems solved by technology

[0004] Existing anti-virus technology, in the contest between virus and anti-virus, anti-virus is generally in a passive position, because the emergence of virus first, there is the generation of security solutions for anti-virus, which has certain influence on the generation of virus. Hysteresis

Moreover, there is some delay between the virus outbreak and the virus analyst getting the virus. The virus analyst gets the virus sample, then replicates it, extracts the characteristics, upgrades the virus database, and then updates the user's antivirus software method, and finally kills it. Viruses, this process has a great delay, and the existing statistics on viruses also show that there are certain space and time limitations in finding the source of the virus. Generally, in this process, even the existing Even the best antivirus companies have huge delays in virus processing

[0005] Moreover, the security service of the existing traditional anti-virus software method has certain limitations, and it simply builds a safe environment for users, and because of the hysteresis and delay of the above-mentioned anti-virus, therefore, the existing anti-virus software There is no better way to prevent and kill viruses in the method

[0006] Chinese patent application 200510036269.6 discloses an active detection virus protection system and its protection method in the field of network virus protection. The external access management system in the present invention solves the defect that the existing local area network virus protection system cannot prevent virus attacks between the local area network subnets, and can be widely used in e-government, financial and intranet network environments with high security

[0007] However, this method of killing viruses is limited to the intranet behind the firewall, and only provides monitoring and access control for network data flow, and does not provide content-based hazard identification. The only security solution is to close the port and Security threats cannot be eliminated from the root. At the same time, its platform is on the third layer switch. Large-scale analysis, filtering, control and other system overhead will reduce the throughput of the network.

[0008] Moreover, because computer viruses have widely used packing and encryption technology, plus the application of polymorphic engines and instruction interference, a large number of virus variants have been produced, making it difficult for existing antivirus software methods to cope with a large number of changing viruses. After its various variants are produced, it is an important direction for anti-virus research to detect and remove viruses as soon as possible

[0009] At the same time, due to the drive of economic interests, non-infectious and highly hidden malicious viruses such as Trojan horses, worms, and backdoors have become popular, and their main purpose is to steal users' bank accounts. Account passwords, business secrets and other important information to achieve the purpose of profit, which may eventually cause serious losses to users

Images