Cluster partitioning processing method and cluster partitioning processing device for virus files

Abstract

The invention discloses a cluster partitioning processing method and a cluster partitioning processing device for virus files. The method comprises the following steps of: (A) statically analyzing binary data of virus files to be partitioned, and analyzing portable executable (PE) structure data of the virus files from the binary data; and (B) comparing the PE structure data of the virus files to be partitioned, and partitioning the virus files with the PE structure data according with appointed similarity into the same category. The device comprises a first data analyzing module and a first cluster partitioning module, wherein the first data analyzing module is used for statically analyzing the binary data of the virus files to be partitioned and extracting the PE structure data of the virus files from the binary data; and the first cluster partitioning module is used for comparing the PE structure data of the virus files to be partitioned and partitioning the virus files with the PE structure data according with the appointed similarity into the same category. By the cluster partitioning processing method and the cluster partitioning processing device for the virus files, the cluster partitioning efficiency of the virus files of a computer can be improved, resource consumption is reduced, and the virus catching risk caused by the virus files which run dynamically is eliminated.

Description

technical field [0001] The invention relates to the technical field of computer data processing, in particular to a clustering and dividing processing method and device for clustering and dividing computer virus files. Background technique [0002] Computer viruses usually have family characteristics, and a certain computer virus will reproduce its variant virus after some evolution. The purpose of the virus change is mainly to avoid anti-virus processing for some anti-virus software. Usually such viruses and the viruses they reproduce have family characteristics. Anti-virus software will divide the virus family according to the characteristics of the virus family, and often extract the characteristic information of all viruses in the family as the basis for judging the virus, so that one record in the virus database can hit all the viruses in the family . It can be seen that an accurate virus family clustering method can greatly improve the efficiency of anti-virus softw...

AI Technical Summary

Problems solved by technology

When clustering viruses, it is necessary to dynamically run virus files to check their dynamic behavior characteristics, which not only increases the consumption of a lot of time and computing resources, but also increases the risk of infection on the local computer itself by dynamically running virus files.

Images