Method and system for non-complete flow detection and complete flow detection in switchable mode

Abstract

The invention discloses a method and system for non-complete flow detection and complete flow detection in a switchable mode. The method comprises the steps that firstly, a preset number of data packages on the front portion of a network data flow are obtained and restored and then virus detection is conducted on a part of the restored data; the data packages of the data flow are obtained continuously, if the data packages receiving fails or reception of the data packages of the data flow is accomplished, all the received data packages are restored, and virus detection is conducted on the received data packages. When the complete flow cannot be obtained, non-complete flow detection can be conducted and when the non-complete flow detection fails or if necessary, complete flow detection is conducted, so that system occupation is reduced, the detection efficiency is improved, and the detection ratio is guaranteed.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a switchable incomplete flow and complete flow detection method and system. Background technique [0002] At present, the anti-virus engine obtains network data packets, restores the network data packets completely, and performs virus signature detection on files. Since the data packets transmitted on the network have a certain probability of being lost, and the same data stream may come from different data sources, it will not be possible to obtain all the data packets, so that the file cannot be restored completely. [0003] Moreover, the characteristics of some malicious codes have already begun to appear at the beginning of the data stream and can be detected correctly. If the complete data stream is still restored before detection in this case, it will not only waste system resources, but also affect detection efficiency. At the same time, if only the init...

AI Technical Summary

Problems solved by technology

Since the data packets transmitted on the network have a certain probability of being lost, and the same data flow may come from different data sources, it will not be possible to obtain all the data packets, so that the file cannot be restored completely.

[0003] Moreover, the characteristics of some malicious codes have already begun to appear at the beginning of the data stream and can be detected correctly. If the complete data stream is still restored and then detected in this case, it will not only waste system resources, but also affect the detection efficiency.

At the same time, if only the initial part of the data stream is detected, the initial part may not contain characteristic fragments that can be used for detection, which affects the detection rate

Images