Computer virus detection method, client, server, computer equipment

Abstract

The present application provides a computer virus detection method, client, server, computer equipment and storage medium, which relates to the field of network security technology and is used for the defense effect of network attacks, thereby improving network security. The method mainly includes: obtaining target data, the target data includes a source process body file and an operated file type, and the number of file operations of the source process body file on the operated file type exceeds a preset value; sending the target data to a server so that the server executes the source process body file in a sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result; receiving the virus file information sent by the server, the virus file information includes the operation behavior information and file attribute information corresponding to the determined source process body file.

Description

Technical Field

[0001] The application relates to the field of network security technology, and in particular to a computer virus detection method, device, computer equipment and storage medium. Background Art

[0002] With the popularization of computer networks, computer viruses are also constantly evolving. In various fields, as long as computers are used, there is a certain possibility of being invaded by computer viruses. At present, the main method for detecting computer viruses is the virus signature code method. The signature code is stored in the virus database. When detecting viruses, the target file is opened and the known virus signature code is searched in the virus database. If the known virus signature code is hit, the target file is determined to be a virus.

[0003] However, the continuous emergence of viral variants and new viruses cannot be detected by known virus characteristic codes. Therefore, how to discover virus variants and new viruses has become a problem that needs to be solved. Summary of the invention

[0004] The embodiment of the present application provides a computer virus detection method, device, computer equipment and storage medium for improving the detection accuracy of computer viruses and timely discovering virus variants and new viruses.

[0005] First aspect, an embodiment of the present invention provides a computer virus detection method, the method is applied to a client, and the method comprises:

[0006] Acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of operations of the source process main body file on the file of the operated file type exceeds a preset value;

[0007] Sending the target data to a server so that the server executes the source process body file in a sandbox to obtain an operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result;

[0008] The virus file information sent by the server is received, and the virus file information includes the operation behavior information and file attribute information corresponding to the source process body file determined.

[0009] Second, an embodiment of the present invention provides another computer virus detection method, the method is applied to a server, the method comprises:

[0010] Receive target data sent by a client, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value;

[0011] Executing the source process body file in the sandbox to obtain an operation result of the source process body file on a file of the operated file type, wherein the file of the operated file type is a generated copy file;

[0012] Determine whether the source process ontology file is a virus file based on the operational behavior results;

[0013] The virus file information sent to the client includes the operation behavior information and file attribute information corresponding to the source process body file determined.

[0014] In a third aspect, an embodiment of the present invention provides a client, the client comprising:

[0015] An acquisition module is used to acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of operations of the source process main body file on the file of the operated file type exceeds a preset value;

[0016] A sending module, used for sending the target data to a server, so that the server executes the source process body file in a sandbox to obtain an operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result;

[0017] The receiving module is used to receive the virus file information sent by the server, and the virus file information includes the determined operation behavior information and file attribute information corresponding to the source process body file.

[0018] In a fourth aspect, an embodiment of the present invention provides a server, the server comprising:

[0019] A receiving module, configured to receive target data sent by a client, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value;

[0020] An acquisition module, used for executing the source process main body file in a sandbox to obtain an operation result of the source process main body file on a file of the operated file type, wherein the file of the operated file type is a generated copy file;

[0021] The determination module is used to determine whether the source process ontology file is a virus file based on the results of the operation behavior;

[0022] The sending module is used to send virus file information to the client, and the virus file information includes the determined operation behavior information and file attribute information corresponding to the source process body file.

[0023] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer virus detection method is implemented when the processor executes the computer program.

[0024] A computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the computer virus detection method described above is implemented.

[0025] The present invention provides a computer virus detection method, client, server, computer equipment and storage medium, which obtains target data, including source process body files and operated file types; sends the target data to the server so that the server executes the source process body file in a sandbox to obtain the operation behavior results of the source process body file on the file type of the operated file, and determines whether the source process body file is a virus file according to the operation behavior results; receives the virus file information sent by the server, and the virus file information includes the operation behavior information and file attribute information corresponding to the determined source process body file. Therefore, the present invention can timely discover mutant viruses and new viruses, thereby improving the detection accuracy of computer viruses. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A flow chart of a computer virus detection method provided for this application;

[0027] Figure 2 Another computer virus detection method flowchart provided for this application;

[0028] Figure 3 Structural diagram of the client provided for this application;

[0029] Figure 4 Schematic diagram of the structure of the server provided for this application;

[0030] Figure 5 A schematic diagram of the computer device provided for the present application. DETAILED DESCRIPTION

[0031] In order to better understand the above-mentioned technical scheme, the technical scheme of the embodiments of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the embodiments of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

[0032] See also Figure 1 , a computer virus detection method provided for an embodiment of the present invention, is explained by the interaction between a client and a server, and the method specifically includes steps S101 to S106:

[0033] Step S101: The client obtains target data.

[0034] The target data includes the source process main body file and the operated file type. In the target data, the number of operations of the source process main body file on the file of the operated file type exceeds a preset value. The source process main body file is a program file, and the operated file type is a file type operated by the source process. The file type can be a Word file type, an Excel file type, a picture file type, an audio file type, a video file type, etc. This embodiment does not make specific limitations.

[0035] In an alternative embodiment provided by the present invention, the client acquires the target data, including:

[0036] Step S1011: Obtain monitoring data for all files in the client in real time.

[0037] The monitoring data includes operation source process information, operated file type, and operation behavior information. The operation behavior information may specifically be behavior information such as opening, modifying, deleting, reading, copying, pasting, etc. This embodiment limits the specific operation behavior information.

[0038] Step S1012: count the number of monitoring data belonging to the same type.

[0039] The operation source process information and the operated file type in the monitoring data of the same type are the same. The operation source process information is used to indicate the corresponding operation source process, and the operated file type is the file type operated by the operation source process.

[0040] For example, the operation source process information is operation source process A, which operates files 1.doc, 2.doc, 3.doc, 4.doc, and files 5.pdf, 6.pdf at different time points. According to statistics, the number of operations of operation source process A on Word file type is 4, and the number of operations on PDF file type is 2.

[0041] In step S1013, the same type of monitoring data exceeding the preset value is determined as the target monitoring data.

[0042] The preset value can be determined based on historical virus data statistics. For example, if the same type of monitoring data obtained through historical virus data statistics is greater than 10, 15, or 20, there is a suspicious virus risk. The preset value can be set to 10, 15, or 20. This embodiment does not specifically limit the size of the preset value.

[0043] For example, the operation source process information includes process A and process B, the operated file types include Word file type and video file type, and the preset value is 8. Among them, the number of operations of process A on Word file type is 10, and the number of operations of process B on video file type is 2. Then it can be determined that the target monitoring data is process A and Word file type.

[0044] Step S1014: Obtain the source process ontology file corresponding to the operation source process information in the target monitoring data.

[0045] In this embodiment, different operation source process information corresponds to different source process ontology files. The operation source process information can uniquely identify the corresponding source process ontology file. Therefore, this embodiment can use the source process ontology file corresponding to the operation source process information.

[0046] In step S1015, the type of operation file in the source process body file and the target monitoring data is determined as the target data.

[0047] In an optional embodiment provided by the present invention, determining the type of the operated file in the source process body file and the target monitoring data as the target data includes: determining the type of the operated file and the operation behavior information in the source process body file and the target monitoring data as the target data. In this embodiment, the operation behavior information is used as the target data, so that the server determines the corresponding sandbox according to the operation behavior information, and then executes the source process body file according to the determined sandbox, thereby improving the efficiency of determining whether the source process body file is a virus file.

[0048] In step S102, the client sends the acquired target data to the server.

[0049] In step S103, the server executes the source process ontology file in the sandbox to obtain the operation behavior results of the source process ontology file against the file of the type of file being operated.

[0050] The file of the operated file type is a copy file generated according to the operated file type. For example, if the operated file type is a text file, multiple copies of the text file can be randomly generated, and then the generated multiple text files are stored in different locations in the sandbox, and then the source process body file is executed in the sandbox to obtain the operation behavior result of the source process body file on the generated copy file. The operation behavior result can specifically be an operation behavior such as copying, opening, reading, pasting, modifying, deleting, etc., which is not specifically limited in this embodiment.

[0051] In an optional embodiment provided by the present invention, the target data also includes operation behavior information, and the source process body file is executed in the sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type, including:

[0052] Step S1031: obtain a sandbox corresponding to the operation behavior information, and different operation behavior information corresponds to different sandboxes.

[0053] In this embodiment, corresponding sandboxes can be first created for different operation behavior information, and then after the operation behavior information is obtained, the corresponding sandbox can be determined according to the operation behavior information; if the sandbox corresponding to the operation behavior information is not obtained, a sandbox corresponding to the operation behavior information can be created to facilitate the execution of the source process body file in the sandbox in subsequent steps.

[0054] Step S1032: The source process ontology file is executed in a sandbox corresponding to the operation behavior information to obtain the operation behavior result of the source process ontology file to the file of the type of operation file.

[0055] In this embodiment, the source process file can be executed by sandboxes corresponding to different operational behavior information, and the efficiency of determining whether the source process body file is a virus file can be improved.

[0056] In step S104, the server determines whether the source process ontology file is a virus file based on the operational behavior results.

[0057] In an optional embodiment provided by the present invention, determining whether the source process body file is a virus file based on the operation behavior result includes: determining whether the operation behavior result is the same as the operation behavior information; if the operation behavior result is the same as the operation behavior information, determining that the source process body file is a virus file.

[0058] In this embodiment, if the source process file is executed through a sandbox corresponding to different operation behavior information, it can be determined whether the operation behavior result is the same as the operation behavior information corresponding to the sandbox. If the operation behavior result is the same as the operation behavior information corresponding to the sandbox, it is determined that the source process body file is a virus file.

[0059] For example, the target data includes the source process body file, the operated file type and the operation behavior information. If the operation behavior information is a deletion operation, the server first obtains the sandbox corresponding to the deletion operation, and then sends the source process body file and the operated file type in the target data to the sandbox. After receiving the above data, the sandbox creates a copy file consistent with the operated file type, executes the source process body file, and determines the execution result of the source process body file on the copy file. If the execution result is a corresponding deletion operation on the copy file, that is, the execution result is the same as the operation behavior information corresponding to the sandbox, then it can be determined that the source process body file is a virus file.

[0060] It should be noted that in this embodiment, N copy files of the same type as the operated file can be created, and then the execution results of the source process main body file on the N copy files can be checked. If M copy files are deleted in the execution results, that is, there are more than M copy files with the same operation behavior information as the sandbox, then the source process text file can be determined to be a virus file, otherwise the source process text file is determined to be a normal file. Where M is less than or equal to N.

[0061] In step S105, the server sends virus file information to the client.

[0062] The virus file information includes the operation behavior information and file attribute information corresponding to the determined source process body file. The file attribute information may be file name, file source, file size, etc., which is not specifically limited in this embodiment.

[0063] In step S106, the client receives the virus file information sent by the server.

[0064] The present invention provides a computer virus detection method, which obtains target data, including a source process body file and an operated file type; sends the target data to a server, so that the server executes the source process body file in a sandbox, obtains the operation behavior result of the source process body file on the file type of the operated file, and determines whether the source process body file is a virus file according to the operation behavior result; receives the virus file information sent by the server, and the virus file information includes the operation behavior information and file attribute information corresponding to the determined source process body file. Therefore, the present invention can timely discover mutant viruses and new viruses, thereby improving the detection accuracy of computer viruses.

[0065] See also Figure 2 , another computer virus detection method provided for an embodiment of the present invention, the method further comprises:

[0066] In step S107, the client querys whether there is file identification information corresponding to the source process ontology file in the preset mapping table.

[0067] Among them, the preset mapping table also stores file identification information of the source process ontology file that has been sent to the server, and the file identification information can uniquely identify the source process ontology file.

[0068] In step S108, if there is file identification information corresponding to the source process body file in the preset mapping table, the source process body file in the target data is replaced with the corresponding file identification information.

[0069] If the file identification information corresponding to the source process body file does not exist in the preset mapping table, the source process body file, file identification information and operation behavior information are sent to the server as target data, and then the file identification information corresponding to the source process body file is generated, and the file identification information of the source process body file is stored in the preset mapping table.

[0070] Step S109 determines whether there is a data item corresponding to the information digest algorithm MD5 value of the target data in the preset mapping table.

[0071] The information digest algorithm MD5 value of the target data is generated based on the file identification information, the type of the operated file and the operation behavior information in the target data. The preset mapping table also stores the MD5 value of the target data that has been sent to the server. It should be noted that since the source process body file can perform different operations on different types of files, the same file identification information can correspond to multiple different MD5 values ​​in the preset mapping table.

[0072] In this embodiment, the client can first query from the preset mapping table whether there is file identification information corresponding to the source process body file. If there is file identification information corresponding to the source process body file in the preset mapping table, the MD5 value is calculated based on the file identification information corresponding to the source process body file, the operated file type and the operation behavior information, and then query from the preset mapping table whether there is a calculated MD5 value. If the calculated MD5 value exists, it means that the client has previously sent the same target data to the server, and there is no need to send it to the server again; if the calculated MD5 value does not exist, the file identification information corresponding to the source process body file, the operated file type and the operation behavior information are sent to the server as the target data, and an MD5 value is generated based on the file identification information corresponding to the source process body file, the operated file type and the operation behavior information, and stored under the corresponding file identification information in the preset mapping table.

[0073] Furthermore, if the file identification information corresponding to the source process body file does not exist in the preset mapping table, the file identification information corresponding to the source process body file is generated and stored in the preset mapping table. Then, the source process body file, the operated file type and the operation behavior information are sent to the server as target data, and the MD5 value is calculated based on the file identification information corresponding to the process body file, the operated file type and the operation behavior information, and the calculated MD5 value is stored under the corresponding file identification information in the preset mapping table.

[0074] Correspondingly, step S102 is, if there is no data item corresponding to the MD5 value of the target data in the preset mapping table, sending the target data to the server and storing the MD5 value of the target data in the preset mapping table.

[0075] Accordingly, in step S103, before the server executes the source process body file in the sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type, the server further includes:

[0076] In step S110, if the source process ontology file in the target data is the corresponding file identification information, the server obtains the source process ontology file corresponding to the file identification information based on the source process ontology file library.

[0077] Among them, the source process ontology file library stores file identification information corresponding to each source process ontology file.

[0078] The embodiment of the present invention provides a computer virus detection method. First, the client queries whether there is file identification information corresponding to the source process body file in the preset mapping table. If there is file identification information corresponding to the source process body file in the preset mapping table, the source process body file in the target data is replaced with the corresponding file identification information, thereby reducing the amount of data sent by the client to the server. After that, the client determines whether there is a data item corresponding to the information digest algorithm MD5 value of the target data in the preset mapping table. If there is no data item corresponding to the MD5 value of the target data in the preset mapping table, the target data is sent to the server. If there is a data item corresponding to the MD5 value of the target data in the preset mapping table, the client does not need to send the target data to the server, so that the amount of data sent by the client to the server can be further reduced through this embodiment.

[0079] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0080] In one embodiment, a client is provided that corresponds one by one to the computer virus detection method in the above-mentioned embodiment. If Figure 3 As shown, each functional module of the client is described in detail as follows:

[0081] An acquisition module 31 is used to acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of operations of the source process main body file on the file of the operated file type exceeds a preset value;

[0082] A sending module 32, configured to send the target data to a server, so that the server executes the source process body file in a sandbox to obtain an operation result of the source process body file on the file of the operated file type, and determine whether the source process body file is a virus file according to the operation result;

[0083] The receiving module 33 is used to receive the virus file information sent by the server, wherein the virus file information includes the operation behavior information and file attribute information corresponding to the determined source process body file.

[0084] In an optional embodiment, the acquisition module 31 is specifically used for:

[0085] The monitoring data of all files within the client is obtained in real time, and the monitoring data includes operation source process information, operation type of file to be operated, and operation behavior information;

[0086] The number of monitoring data belonging to the same type is counted, and the operation source process information and the type of operating files in the monitoring data of the same type are the same;

[0087] The same type of monitoring data that exceeds the preset value is determined as the target monitoring data;

[0088] Obtain the source process ontology file corresponding to the operation source process information in the target monitoring data;

[0089] The type of operation file in the source process ontology file and the target monitoring data is determined as the target data.

[0090] In an optional embodiment, the acquisition module 31 is specifically used to determine the type and operation behavior information of the operational file in the source process body file and the target monitoring data as the target data.

[0091] In an optional embodiment, a sending module 32 is used to send the target data to a server so that the server determines a corresponding sandbox based on the operation behavior information, executes the source process body file in the sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type, and determines whether the source process body file is a virus file based on the operation behavior result. Different operation behavior information in the server corresponds to different sandboxes.

[0092] In an alternative embodiment, the sending module 32 is specifically used for:

[0093] Determine whether there is a data item corresponding to the information digest algorithm MD5 value of the target data in the preset mapping table, and the preset mapping table stores the MD5 value of the target data that has been sent to the server;

[0094] If there is no data item corresponding to the MD5 value of the target data in the preset mapping table, the target data is sent to the server, and the MD5 value of the target data is stored in the preset mapping table.

[0095] In an optional embodiment, the client further comprises:

[0096] A query module 34, used to query whether there is file identification information corresponding to the source process body file in the preset mapping table, and the preset mapping table also stores the file identification information of the source process body file that has been sent to the server;

[0097] The replacement module 35 is used to replace the source process body file in the target data with the corresponding file identification information if there is file identification information corresponding to the source process body file in the preset mapping table, so that the server obtains the corresponding source process body file according to the file identification information.

[0098] In one embodiment, a server is provided that corresponds one by one to the computer virus detection method in the above-mentioned embodiment. If Figure 4 As shown, the detailed description of each functional module of the server is as follows:

[0099] The receiving module 41 is used to receive target data sent by the client, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value;

[0100] An acquisition module 42 is used to execute the source process body file in the sandbox to obtain the operation result of the source process body file on the file of the operated file type, where the file of the operated file type is a generated copy file;

[0101] The determination module 43 is used to determine whether the source process ontology file is a virus file based on the operational behavior result;

[0102] The sending module 44 is used to send virus file information to the client, and the virus file information includes the determined operation behavior information and file attribute information corresponding to the source process body file.

[0103] In an alternative embodiment, the target data further includes operational behavior information, acquiring module 42, specifically for:

[0104] Obtain the sandbox corresponding to the operation behavior information, and different operation behavior information corresponds to different sandboxes;

[0105] The source process ontology file is executed in a sandbox corresponding to the operation behavior information to obtain the operation behavior result of the source process ontology file on the file of the type of operation file.

[0106] In an alternative embodiment, the determination module 43 is specifically used for:

[0107] Determine whether the operation behavior result is the same as the operation behavior information;

[0108] If the operation behavior result is the same as the operation behavior information, it is determined that the source process ontology file is a virus file.

[0109] In an optional embodiment, the acquisition module 42 is further used to acquire the source process ontology file corresponding to the file identification information according to a source process ontology file library, wherein the source process ontology file library stores the file identification information corresponding to each source process ontology file.

[0110] The specific definition of the computer virus detection device can be found in the definition of the computer virus detection method above, which will not be repeated here. Each module in the above device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0111] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a computer virus detection method is implemented.

[0112] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0113] Acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value;

[0114] Sending the target data to a server so that the server executes the source process body file in a sandbox to obtain an operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result;

[0115] The virus file information sent by the server is received, and the virus file information includes the operation behavior information and file attribute information corresponding to the source process body file determined.

[0116] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0117] Acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value;

[0118] Sending the target data to a server so that the server executes the source process body file in a sandbox to obtain an operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result;

[0119] The virus file information sent by the server is received, and the virus file information includes the operation behavior information and file attribute information corresponding to the source process body file determined.

[0120] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0121] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0122] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A computer virus detection method, characterized in that: The method is applied to a client, and the method comprises: Acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of operations of the source process main body file on the file of the operated file type exceeds a preset value; Sending the target data to a server so that the server executes the source process body file in a sandbox to obtain an operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result; Receiving virus file information sent by the server, wherein the virus file information includes operation behavior information and file attribute information corresponding to the determined source process body file; The acquiring of target data comprises: Acquire monitoring data of all files in the client in real time, including operation source process information, operated file type, and operation behavior information; Counting the number of monitoring data belonging to the same type, wherein the operation source process information and the operated file type in the monitoring data of the same type are the same; Determine the monitoring data of the same type whose quantity exceeds the preset value as target monitoring data; Obtaining a source process ontology file corresponding to the operation source process information in the target monitoring data; Determine the operated file type in the source process body file and the target monitoring data as target data; The step of determining the operated file type in the source process body file and the target monitoring data as target data includes: Determine the source process body file and the operated file type and operation behavior information in the target monitoring data as target data; The target data is sent to a server so that the server determines a corresponding sandbox according to the operation behavior information, executes the source process body file in the sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type, and determines whether the source process body file is a virus file according to the operation behavior result. Different operation behavior information in the server corresponds to different sandboxes; if the operation behavior result is the same as the operation behavior information, the source process body file is a virus file.

2. The method according to claim 1, characterized in that The sending the target data to the server comprises: Determine whether there is a data item corresponding to the message digest algorithm MD5 value of the target data in a preset mapping table, wherein the preset mapping table stores the MD5 value of the target data sent to the server; If there is no data item corresponding to the MD5 value of the target data in the preset mapping table, the target data is sent to the server, and the MD5 value of the target data is stored in the preset mapping table.

3. The method according to claim 1, characterized in that Before sending the target data to the server, the method further includes: querying whether there is file identification information corresponding to the source process body file in the preset mapping table, wherein the preset mapping table also stores the file identification information of the source process body file that has been sent to the server; If the preset mapping table contains file identification information corresponding to the source process body file, the source process body file in the target data is replaced with the corresponding file identification information, so that the server obtains the corresponding source process body file according to the file identification information.

4. A computer virus detection method, characterized in that: The method is applied to a server, and the method comprises: Receive target data sent by a client, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value; Executing the source process body file in the sandbox to obtain an operation result of the source process body file on a file of the operated file type, wherein the file of the operated file type is a generated copy file; Determine whether the source process body file is a virus file according to the operation behavior result; The virus file information sent to the client includes the operation behavior information and file attribute information corresponding to the determined source process body file; The target data also includes operation behavior information. The executing the source process body file in the sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type includes: Acquire a sandbox corresponding to the operation behavior information, where different operation behavior information corresponds to different sandboxes; Executing the source process body file in a sandbox corresponding to the operation behavior information to obtain an operation behavior result of the source process body file on a file of the operated file type; The determining whether the source process body file is a virus file according to the operation behavior result includes: Determining whether the operation behavior result is the same as the operation behavior information; If the operation behavior result is the same as the operation behavior information, it is determined that the source process body file is a virus file.

5. The method according to claim 4, characterized in that If the source process body file in the target data is the corresponding file identification information, before executing the source process body file in the sandbox, the method further includes: The source process ontology file corresponding to the file identification information is obtained according to a source process ontology file library, wherein the source process ontology file library stores the file identification information corresponding to each source process ontology file.

6. A client, characterized in that: The client comprises: An acquisition module is used to acquire target data, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value; A sending module, used for sending the target data to a server, so that the server executes the source process body file in a sandbox to obtain an operation behavior result of the source process body file on the file of the operated file type, and determining whether the source process body file is a virus file according to the operation behavior result; A receiving module, used for receiving virus file information sent by the server, wherein the virus file information includes operation behavior information and file attribute information corresponding to the determined source process body file; The acquisition module is further used to perform the following steps: Acquire monitoring data of all files in the client in real time, including operation source process information, operated file type, and operation behavior information; Counting the number of monitoring data belonging to the same type, wherein the operation source process information and the operated file type in the monitoring data of the same type are the same; Determine the monitoring data of the same type whose quantity exceeds the preset value as target monitoring data; Obtaining a source process ontology file corresponding to the operation source process information in the target monitoring data; Determine the operated file type in the source process body file and the target monitoring data as target data; The step of determining the operated file type in the source process body file and the target monitoring data as target data includes: Determine the source process body file and the operated file type and operation behavior information in the target monitoring data as target data; The target data is sent to a server so that the server determines a corresponding sandbox according to the operation behavior information, executes the source process body file in the sandbox to obtain the operation behavior result of the source process body file on the file of the operated file type, and determines whether the source process body file is a virus file according to the operation behavior result. Different operation behavior information in the server corresponds to different sandboxes.

7. A server, characterized in that: The server comprises: A receiving module, configured to receive target data sent by a client, wherein the target data includes a source process main body file and an operated file type, and the number of file operations of the source process main body file on the operated file type exceeds a preset value; An acquisition module, used for executing the source process main body file in the sandbox to obtain the operation result of the source process main body file on the file of the operated file type, wherein the file of the operated file type is a generated copy file; A determination module, used to determine whether the source process body file is a virus file according to the operation behavior result; A sending module, used for sending virus file information to the client, wherein the virus file information includes operation behavior information and file attribute information corresponding to the determined source process body file; The target data also includes operation behavior information, and the acquisition module is further used to perform the following steps: Acquire a sandbox corresponding to the operation behavior information, where different operation behavior information corresponds to different sandboxes; Executing the source process body file in a sandbox corresponding to the operation behavior information to obtain an operation behavior result of the source process body file on a file of the operated file type; The determining module is also used to perform the following steps: Determining whether the operation behavior result is the same as the operation behavior information; If the operation behavior result is the same as the operation behavior information, it is determined that the source process body file is a virus file.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the computer virus detection method according to any one of claims 1 to 5 is implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the computer virus detection method according to any one of claims 1 to 5 is implemented.

Images