Virus detection method and virus detection device

Abstract

The invention discloses a virus detection method and a virus detection device. The method includes the following steps: extracting a structural information constitution feature vector of a to-be-detected executable file; calculating a feature Hash value of the feature vector according to a Hash algorithm; comparing the feature Hash value with sample files in a feature library to acquire a comparison sample with similarity, higher than a preset value, to the feature Hash value; determining a virus detection result of the to-be-detected executable file according to an analysis result of the comparison sample. The virus detection method and the virus detection device have the advantages that file virus detection is performed according to similarity matching of file structure types of virus samples instead of conventional feature codes and filtering rules; multiple sample files are stored in the feature library in a Hash value storage mode, the Hash value of the feature vector of the to-be-detected executable file is compared with a Hash value of a known sample to acquire the similar comparison file, and the virus detection result of the to-be-detected executable file is acquired according to the analysis result of the comparison file, so that calculation speed is high, and the generated feature library is small.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a virus detection method and device. Background technique [0002] In 2014, the number of malicious software showed explosive growth. According to the statistics of virus samples collected from January to December, an average of more than 3 million samples were found every month, which brought great difficulties to virus detection. Because traditional virus detection mainly uses methods such as signatures and filtering rules. The feature code generally selects binary data or strings that only certain types of viruses have, and engineers analyze and extract virus samples from them; filtering rules dynamically obtain various information of virus samples to summarize the common characteristics of all types of viruses, and engineers write corresponding ones. filter script. Due to the large number of newly collected samples every day, the efficiency of virus sample process...

AI Technical Summary

Problems solved by technology

[0003] Based on this, it is necessary to solve the problem that the traditional virus detection technology is greatly affected by the increase in the number of virus samples, which greatly increases the workload of virus detection and affects the efficiency of virus detection, and proposes a virus detection with fast virus scanning speed and small data storage capacity. method and device

Images