Multi-engine contrast scanning dynamic adjustment method and system based on hardware resources

Abstract

The invention provides a multi-engine contrast scanning dynamic adjustment method and system based on hardware resources. According to the method, multiple entity machines are adopted, multiple virtual machines are installed on each entity machine by use of a virtualization technology, and a detection engine is installed in each virtual machine to perform contrast scanning; a to-be-detected sampleis acquired and distributed to a task queue of each detection engine; the task queue of each detection engine is monitored in real time, whether a detection engine with the quantity of to-be-scannedtasks being zero exists is judged, and if yes, the detection engine with the largest quantity of to-be-scanned tasks in the corresponding task queue is acquired at the same time; and whether the virtual machine corresponding to the detection engine with the quantity of to-be-scanned tasks being zero is in an idle state is confirmed, and if yes, the virtual machine is shut down, and the virtual machine corresponding to the detection engine with the largest quantity of to-be-scanned tasks is increased. Through the multi-engine contrast scanning dynamic adjustment method and system, system resources can be dynamically adjusted, and overall scanning speed is increased; and meanwhile, by the adoption of unified queue management, all the detection engines of the system are low in coupling degree, and clustering distributed deployment is easy.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a method and system for dynamically adjusting multi-engine comparison scanning based on hardware resources. Background technique [0002] Today, with the rapid development of information technology, network security is facing new challenges. With the rapid growth of traditional malicious codes, especially Trojan horses, new families and new variants are constantly appearing to fight against antivirus software. [0003] In order to cope with the constantly mutating and upgrading malicious codes, it is an effective technical means to deal with malicious codes by developing a comparative scanning analysis system based on multiple malicious code detection engines, and using multiple domestic and foreign mainstream engines to conduct static comparative scanning and analysis of malicious codes. [0004] At present, malicious code multi-engine comparative analysis sys...

AI Technical Summary

Problems solved by technology

[0004] At present, malicious code multi-engine comparative analysis systems have been developed successively at home and abroad, such as foreign VirusTotal and domestic VirusBook. These comparison systems usually use distributed clustered antivirus engines for concurrent scanning. Generally, the following two methods are used for scanning. First, use a large number of physical machines to form a scanning cluster, and then directly install an antivirus engine in each physical machine; second, use a small number of physical machines to form a scanning cluster, but install multiple virtual machines on each physical machine, and install multiple virtual machines in each virtual machine Install an antivirus engine; both of the above two comparison scanning systems have waste of system resources (CPU and memory)

Since the scanning speed of each antivirus engine is inconsistent, for the same batch of samples, the fast scanning engine will inevitably enter the idle state (CPU and memory are idle), and the idle resources cannot be used by the slow scanning engine

Images