Malicious program judging method based on cloud security

Abstract

The invention belongs to the computer field, and particularly relates to a malicious program judging method based on cloud security. In the invention, various detection engines of different types are arranged on a cloud end to perform parallel detection on the file submitted by a user. As the detection engines are different in accuracy, the detection results are possibly different from each other. The cloud end performs comprehensive judgment on the detection results with a comprehensive judgment algorithm. In order to improve the detection efficiency, a file detection result buffer area is established locally, and a file detection result database is established at the cloud end. Generally, in the invention, the correctness of the detection result is improved by a comprehensive judgment method using multiple detection engines; and meanwhile, a client utilizes the buffer area and the cloud end utilizes buffer a database to buffer the file detection results so as to improve the high efficiency of the detection process.

Description

technical field [0001] The invention belongs to the field of computers, and in particular relates to a method for judging malicious programs based on cloud security. Background technique [0002] With the rapid development of computers and their applications and the complexity of network structures, the weaknesses and vulnerabilities of computing systems will tend to be distributed. With the improvement of the level of hacker intrusion, its attack behavior is no longer a single behavior, and a single network security defense tool appears to be very weak when dealing with distributed, coordinated, and complex patterns of attack behavior. The typical characteristics of the current network attack behavior are: [0003] (1) The number of malicious codes is growing explosively. At present, there are more than 11 million malicious programs in the world, and this data is still growing. In 2005, only about 50 malicious program signatures were added to the signature database every...

AI Technical Summary

Problems solved by technology

The mainstream anti-virus software is based on virus signatures, and the update speed of signatures is far behind the speed of new viruses.

[0004] (2) The contradiction between the limited resources of the terminal and the huge number of malicious program signatures

However, with the increase of the terminal virus database, more storage space is required, and a large amount of computing resources are consumed for antivirus, which affects the running speed of the computer.

[0005] (3) The malicious attack lasts for a long time, and the individual attack behavior is not obvious

[0006] (4) Malicious attackers are widely distributed, and the attacks are very harmful

However, each detection engine has a certain false positive rate. Although this method can improve the efficiency of detection, it cannot improve the accuracy of detection.

Also, since a single type of engine may have some inherent flaws that are very effective against some malicious programs, its detection coverage is very limited

At the same time, with the increase of the client virus database, more storage space is required, and a large amount of computing resources are consumed for antivirus, which affects the running speed of the client computer

Images