Method and apparatus for scanning virus program

Abstract

The invention relates to a method and apparatus for scanning virus program, wherein, the method comprises: acquiring file information of the file to be scanned; judging whether the file to be scanned is an executable file only using a standard dynamic database of a viewfinder operating system or not, if yes, the executable file can be performed for enlightened scanning. The apparatus comprises an acquiring module, a first judging module and a scanning module. The invention can greatly reduce the numbers of the files which need to be performed for matched scanning, thereby improving the matching lookup efficiency, increasing the scanning speed and reducing the misinformation ratios greatly.

Description

technical field [0001] The invention relates to a virus program scanning method and device, belonging to computer virus program scanning technology. Background technique [0002] The heuristic scanning technology based on behavior analysis is a commonly used technology in the existing virus program scanning technology. It forms a behavior heuristic feature library by analyzing and summarizing the characteristics of most known computer Trojan horse virus programs or backdoor virus programs. , the behavior heuristic library has features and feature groups based on program behavior types, and the purpose of virus detection and killing is achieved by matching virus programs according to these features and feature groups. [0003] However, as Trojan horse virus programs and backdoor virus programs have become a flood trend at this stage, they have caused great damage to the property of network users. and other processing methods to evade the detection and killing of anti-virus s...

AI Technical Summary

Problems solved by technology

[0003] However, as Trojan horse virus programs and backdoor virus programs have become a flood trend at this stage, they have caused great damage to the property of network users. and other processing methods to evade the detection and killing of anti-virus software, and in the existing virus program industry chain, the source code exchange method can also be used to avoid killing and thoroughly fight against anti-virus software

Therefore, the above-mentioned unfavorable factors cause anti-virus software to constantly analyze and summarize new features of virus programs, forcing the features and their feature groups in the behavior heuristic feature library to continuously increase, thus resulting in the need to match the data of features and their feature groups. In addition, the existing virus program detection and killing technology usually adopts fuzzy feature matching method, which further increases the data volume, which not only prolongs the time of virus program detection and killing, but also poses a challenge to the efficiency of the anti-virus engine of the anti-virus software. higher requirements

Images