Malicious code type detection method based on cloud mode

Abstract

The invention discloses a malicious code type detection method based on a cloud mode. The method comprises the following steps that: a cloud terminal carries out processing and analysis on a malicious code family to generate an initial classification database, generates a representative feature set for each category of malicious code family in the initial classification database, an access or execution operation of a program is intercepted at a client, an only identity value of the intercepted program is calculated, whether the only identity value exists in a local database or not is determined, if not, a specific feature document of the intercepted program is extracted, the only identity value and a specific feature document of the intercepted program is uploaded to the cloud terminal by the client, whether the only identity value exists in a cloud terminal database or whether the feature document belongs to a classification is determined, a final determination result is returned to the client, and the only identity value and the final determination result are written into the cloud terminal database and a client database respectively. According to the method, the rapid expansion of a feature library can be slowed down, the upload of suspicious programs is reduced, and the killing prevention efficiency of cloud security is raised.

Description

technical field [0001] The invention belongs to the field of cloud computing and computer system security, and in particular relates to a method for detecting malicious code categories based on a cloud mode. Background technique [0002] With the rapid development of computer technology and network applications, people rely more and more on information technology, and computer security is becoming more and more important and popular. In the face of endless security problems and explosive growth of malicious code, it is necessary to continuously improve and improve technology. To achieve timely and accurate interception and killing. [0003] Traditional malware detection and killing mainly rely on signature matching patterns. Signature code is a piece of program code extracted from malicious code by analysis engineers, which can distinguish the difference from normal code. During the killing process, the antivirus engine will read the program code and match all the signatur...

AI Technical Summary

Problems solved by technology

[0008] However, according to Moore's theorem, the processing performance of computers doubles every eighteen months, and the total number of malicious programs doubles every ten to twelve months (even with a faster trend). It will expand rapidly, and the cloud will not be able to handle it in the end, and there will still be update lags, and the efficiency of scanning and killing will still decrease, and the upload will be more dependent on the speed of the network. It can be seen that massive data analysis and network speed have become "cloud security". Bottleneck in practical application

Images