A method and device for finding virus parent

A virus daughter, virus technology, applied in the field of network security, can solve difficult virus parent search and other problems

Active Publication Date: 2015-11-04
TENCENT TECH (SHENZHEN) CO LTD
View PDF4 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0003] The prior art finds the virus parent corresponding to the virus daughter by monitoring the way the virus parent releases the virus daughter. However, because some virus mothers release the virus daughter in a more complicated way, it may include downloading, file creation, etc., or , the virus parent releases daughters by driving, modifying MBR (Master Boot Record), etc., which can evade monitoring. Therefore, it is difficult to find the virus mother by monitoring the way the virus mother releases virus daughters

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • A method and device for finding virus parent
  • A method and device for finding virus parent
  • A method and device for finding virus parent

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0059] Because the virus progeny is produced by the virus parent, the first appearance time of the virus progeny must be later than the first running time of the virus parent of the virus progeny. The present invention searches for the virus parent of the virus progeny according to this principle, which is different from the prior art In comparison, it is not limited to monitoring the way the virus parent releases the virus daughter, but determines the virus parent through the time relationship, which improves the accuracy of finding the virus parent.

[0060] refer to figure 1 , figure 1 The flow chart of the method for finding the virus parent provided by this embodiment specifically includes:

[0061] Step 101: Determine any virus file as a virus daughter.

[0062] In this embodiment, any virus file is firstly determined as a virus daughter before finding the virus parent.

[0063] In actual operation, viruses usually exist in the form of files, and the concept of virus ...

Embodiment 2

[0094] refer to image 3 , image 3 The structure diagram of the device for finding the virus parent provided by this embodiment, the device includes:

[0095] The first determination module 301 is configured to determine any virus file as a virus daughter;

[0096] The first obtaining module 302 is used to obtain the computer in which the virus progeny exists;

[0097] The second obtaining module 303 is used to obtain the first appearance time of the virus progeny in the computer;

[0098] The third obtaining module 304 is used to obtain the first running time of the virus files on the computer except the virus progeny;

[0099] The second determination module 305 is used to determine the virus file whose first running time is earlier than the first appearance time of the virus progeny by a preset time threshold as a suspected virus parent;

[0100] The second determining module 305 may include:

[0101] The first obtaining submodule is used to obtain the difference betw...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

A method and a device for searching for a parent virus are disclosed. The method includes: determining an arbitrary virus file as a child virus; obtaining a computer containing the child virus; obtaining a time when the child virus first appears in the computer; obtaining a time when each of virus files except the child virus in the computer is first executed; determining virus files, which are first executed within a preset time period before the time when the child virus first appears, as suspect parent viruses; and determining, from the suspect parent viruses, the parent viruses. Based on a principle that the time when the parent virus is executed is earlier than the time when the child virus first appears, the suspect parent viruses are determined, and the parent virus is found from the suspect parent viruses accurately.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for searching virus parent. Background technique [0002] With the development of computer technology, computer virus technology is also improving day by day, and network security is under greater threat. There are various types of computer viruses, and most viruses exist in the form of files. Among them, some virus files can release other computer virus files through downloading, file creation, etc., and the virus files that release computer viruses are called virus mothers. Yes, the released computer virus files are called virus progeny, so the virus parent has the ability to spread the virus, that is to say, only the virus parent that finds the virus progeny can completely delete this type of virus. [0003] The prior art finds the virus parent corresponding to the virus daughter by monitoring the way the virus parent releases the virus daughter. However, b...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & AuthorityPatents(China)
IPC IPC(8): G06F21/56
CPCG06F21/56
Inventor石有滴
OwnerTENCENT TECH (SHENZHEN) CO LTD