Virus false alarm prevention method and device, terminal equipment and storage medium

Abstract

The invention discloses a virus false alarm prevention method and device, terminal equipment and a storage medium. The method comprises the steps of obtaining a virus searching and killing code configured for an APK virus; matching the virus searching and killing code with an application APK feature code in a preset white list database; and if at least one application APK feature code is matched,judging that virus misinformation occurs. According to the scheme, false alarm can be detected in time, the efficiency and accuracy of virus false alarm prevention are improved, and the competitiveness of antivirus manufacturers is improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method, device, terminal equipment and storage medium for anti-virus false positives. Background technique [0002] At present, many viruses use reinforcement technology to protect themselves. The virus signature code after reinforcement is very difficult to extract, and antivirus manufacturers often use a virus signature code to match a virus family (virus family) method, making the virus signature code after reinforcement more accurate. It is easy to match a safe APK (application installation file, which can be an Android application installation file) to form a false positive. [0003] Existing methods to prevent virus false positives include manual review and matching with unclassified massive APK databases collected by antivirus vendors. However, the virus false alarm rate is directly related to the brand of the antivirus manufacturer. Therefore, in order to ensure the ...

AI Technical Summary

Problems solved by technology

However, the virus false alarm rate is directly related to the brand of the antivirus manufacturer. Therefore, in order to ensure the reduction of false positives, some virus analysts reduce or even do not detect and kill viruses after reinforcement, making the detection rate low.

[0004] In addition, if the anti-false positive work is done manually by virus analysts based on past experience, the efficiency is very low, the accuracy is also very low, and there is no guarantee that the modified virus signature is effective

[0005] If the manufacturer matches the virus signature with all the APKs in the unclassified massive APK database collected by itself, the efficiency is low and the time is very long

[0006] Therefore, related technologies cannot detect the occurrence of false alarms in a timely manner, and the longer the time from the occurrence of false alarms to quick response and repair, the greater the brand damage to antivirus vendors.

Images