Suspicious file processing method and system

Abstract

The invention discloses a suspicious file processing method and system, and the method comprises the steps: uploading a suspicious file to an analysis device, enabling the analysis device to open thesuspicious file in a limited environment, and feeding back the content of the suspicious file to a user in a preset format; and receiving content fed back by the analysis device, so that a user can judge whether the suspicious file is safe or not. The method has the advantages that the suspicious file is uploaded to the external device, the external device opens the suspicious file in a limited environment in a preset format and feeds the suspicious file back to the user, the user operation cannot be interrupted when the suspicious file is opened by the external device, and the user experienceis good.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a suspicious file processing method and processing system. Background technique [0002] Sandboxie (sandbox) is a virtual system program that allows a browser or other programs to be run in a sandbox environment, so that the changes produced by the operation can be deleted later. The sandbox creates an independent operating environment similar to a sandbox, and the programs running inside it cannot have a permanent impact on the hard disk. It is an isolated virtual environment that can be used to test untrusted applications or surf the web. [0003] The classic sandbox system generally intercepts system calls, monitors program behavior, and then controls and restricts the program's use of computer resources according to user-defined policies, such as rewriting the registry, reading and writing disks, and so on. [0004] The working principle of the sandbox: through...

AI Technical Summary

Problems solved by technology

Since the sandbox is a virtual system environment, it takes a certain amount of time to transfer files to the sandbox, wait for the analysis results after running, and then output the results to the local. During this period, users cannot directly process files, and the user experience is poor.

Images