Method, apparatus and network device for identifying virus document

Abstract

The invention provides a method for identifying viral files, which comprises: firstly, establishing a virtual system, operating a suspicious file in the virtual system, recording behavior information of the suspicious file, judging whether the suspicious file is the viral file or not according to the behavior information and a virus behavior feature library, marking the suspicious file to be the viral file if the suspicious file is the viral file, and otherwise marking the suspicious file to be a safe file. The invention also provides a device for identifying the viral files, which comprises a virtual system module which is used to establish the virtual system, to orient behaviors of the suspicious file to the virtual system, and to operate the suspicious file, a behavior information collecting module which is used to record the behavior information of the suspicious file, and a behavior characteristic analyzing module which is used to mark the suspicious file to be virus when the suspicious file is judged to be the virus according to the behavior information and the virus behavior feature library and is used to mark the suspicious file to be the safe file when the suspicious file is judged to be the safe file.

Description

technical field [0001] The invention relates to the technical field of computer anti-virus. Background technique [0002] In recent years, the viruses and Trojan horses popular on the Internet are usually not a single attack, but a large number of variants are active on the Internet, and can be upgraded frequently, so it is easy for a large number of viruses or Trojan horses to break out. This puts forward higher requirements on the upgrade cycle of anti-virus products, and the upgrade speed of anti-virus products plays an important role in whether it can effectively prevent and kill a large number of viruses and Trojan horses. [0003] One of the most mature anti-virus technologies is signature method. Signature methods generally include processes such as virus analysis, feature extraction, virus database creation and upgrade, and among these processes, the virus analysis process of identifying whether a suspicious file is a virus is one of the most time-consuming processe...

AI Technical Summary

Problems solved by technology

[0005] The weak point of above-mentioned virus analysis method is, in this method, suspicious file runs in computer system, if this suspicious file is virus, can cause damage to system, in virus analysis process, in order to reduce the harmfulness of virus, need Restart the system to restore and repair the system, and the restart action greatly prolongs the virus analysis process, thus affecting the upgrade cycle of anti-virus products; in addition, if the virus crashes the system, the system needs to be reinstalled, which will further prolong the anti-virus product upgrade cycle. Product upgrade cycle

Images