System and method for detecting file in virtual environment

Abstract

The invention relates to a system and a method for detecting a file in a virtual environment. The method comprises the steps of sending file data with a front preset number of bytes of a to-be-searched and killed file to a scanning server by a light agent client, wherein the light agent client is arranged in a virtual machine; determining the file type of the to-be-searched and killed file according to the file data with the front preset number of bytes, and indicating the light agent client to extract a specific fragment in the file data according to the file type; extracting and sending the specific fragment in the file data to the scanning server according to the indication by the light agent client; receiving the specific fragment by the scanning server, searching and killing the specific fragment, and feeding back a searching and killing result to the light agent client. According to the technical scheme, file detection in the virtual environment can be rapidly and efficiently realized, the safety detection efficiency is increased, and the resource occupation rate of a physical computer is reduced.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a file detection system used in a virtualized environment and a file detection method used in a virtualized environment. Background technique [0002] Virtualization refers to virtualizing a computer into multiple logical computers through virtualization technology. Run multiple logical computers on one computer at the same time, each logical computer can run a different operating system, and the application programs can run in independent spaces without affecting each other, thereby significantly improving the work efficiency of the computer. [0003] In the file detection scheme in the existing virtualization environment, if there are multiple virtual logical computers (virtual machines) on the same physical machine, when performing security detection on the information in multiple virtual machines, most of the small files are detected through the local The scanning ...

AI Technical Summary

Problems solved by technology

[0003] In the file detection scheme in the existing virtualization environment, if there are multiple virtual logical computers (virtual machines) on the same physical machine, when performing security detection on the information in multiple virtual machines, most of the small files are detected through the local The scanning engine performs security detection of files, and for larger files, through the antivirus server set in each virtual machine, the files in each virtual machine are inspected in their respective antivirus servers, whether it is The security detection of small files by the local scanning engine or the security detection of large files by the killing server in each virtual machine requires an overall scan of the entire file. The larger the file, the longer the scanning time, resulting in a large amount of time spent on the file detection process. , which affects the efficiency of security detection. If multiple virtual machines perform file security detection at the same time, it will inevitably increase the resource occupation of the physical machine where multiple virtual machines are located, and then affect the system performance and work efficiency of the entire virtualization environment of the computer.

Images