Fuzzy hashing algorithm-based malicious code detection system and method

Abstract

The invention discloses a fuzzy hashing algorithm-based malicious code detection system and a fuzzy hashing algorithm-based malicious code detection method. The system consists of a client and a cloud server. The client calculates a fuzzy hash value of an object to be detected, and transmits the fuzzy hash value to the cloud server. The cloud server compares the fuzzy hash value with fuzzy hash values of known normal files, and determines that the object to be detected is a normal file if one of obtained similarities is higher than a white list threshold value. The cloud server compares the fuzzy hash value with fuzzy hash values of known malicious codes, and determines that the object to be detected is a malicious code if one of obtained similarities is higher than a blacklist threshold value. The client transmits back the whole object to be detected under other conditions, and the object to be detected is further detected by adopting the conventional cloud searching and killing method. Compared with the conventional cloud-based malicious code detection technology, the method and the system have the technical effects of larger data transmission size, lower network resource consumption and better malicious code detection effect.

Description

technical field [0001] The invention relates to a malicious code detection technology, in particular to a system and method for cooperatively detecting malicious codes by client software and a cloud server using a fuzzy hash algorithm. Background technique [0002] Malicious code is one of the most serious threats in information security. How to detect malicious code efficiently and with high quality is a core issue in this field. [0003] In recent years, tens of thousands of malicious code samples appear every day, which brings about the growth of the number of features required to detect malicious code and the increase of required hardware resources. Traditional antivirus software stores the signature database on the client, and uses the client to directly detect, occupying and consuming the disk space and computing resources of the user's computer, and there is a problem of signature database upgrade. Therefore, at present, most anti-virus vendors have launched malicio...

AI Technical Summary

Problems solved by technology

[0017] The present invention uses the fuzzy hash algorithm in the cooperative detection of malicious codes by the client software and the cloud server, and solves the dilemma of network bandwidth occupation and poor detection effect in cloud scanning and killing

Images