Secure file processing method, equipment and system

Abstract

The invention relates to a secure file processing method. The secure file processing method comprises the following steps: a terminal collects file attribute information of a local target PE (portable execute) file when the terminal starts the anti-virus function, and calculates a file feature code of the target PE file; the terminal transmits the feature information of the target PE file to a server; the server compares the received feature information with a preset standard file feature library to determine whether the target PE file is infected by virus, generates different processing strategies according to the determination result, and transmits the processing strategies to the terminal; and the terminal processes the target PE file according to the received processing strategies. The invention also relates to a secure file processing system, a terminal, a server and probe equipment. According to the invention, the method can clean file-type viruses and repair the infected files based on the cloud computing environment without frequently upgrading the virus feature library, can clean unknown viruses and repair the infected files, and has the advantage of less user terminal resource occupied.

Description

technical field [0001] The invention relates to Internet application technology and communication technology, in particular to a file security processing method, device and system in a cloud computing environment. Background technique [0002] With the in-depth development of the informatization process in all walks of life, the application of the Internet in various fields is becoming more and more extensive. With the development of network technology and the prosperity of network economy, while people use the Internet to obtain various software resources and useful information, some people also use these resources to spread various viruses among computers on the Internet, including various file-type viruses. , network worms, etc., in order to achieve their ulterior purposes such as stealing useful data or information, destroying services or data, and consuming system resources. [0003] Currently, there are methods for detecting and identifying network worms based on netw...

AI Technical Summary

Problems solved by technology

[0006] (1) The virus signature database needs to be frequently updated: the detection and killing of viruses by the terminal depends on the virus code in the program body and the local pre-stored virus signature database. The virus code base also requires frequent upgrades;

[0007] (2) It is difficult to identify unknown viruses: the core part of the anti-virus engine's work is code comparison, and when a virus with no corresponding code in the preset virus signature database is infected, the anti-virus engine can only Try to kill the actual virus code in the computer; today, the traditional antivirus software is struggling to cope with the increasingly diverse virus variants;

[0008] (3) Files that are likely to cause infection are unavailable: due to the complexity and encryption of viruses, even if antivirus software recognizes the virus code in the program body, it is difficult to decrypt the recovery program file due to the complexity of the encryption technology used by the virus code The required effective data; usually anti-virus software can only isolate or delete the entire original file in order to prevent the virus from re-infecting;

[0009] (4) Occupies a lot of system resources: Since the detection, comparison, analysis and processing of viruses are all completed on the user terminal, it consumes a lot of CPU and RAM resources of the user terminal

Images