Methods and devices for controlling virus file transfer and methods and devices for obtaining virus samples

Abstract

The embodiments of the present application provide a virus file transmission control method and device and a virus sample acquisition method and device, wherein the virus file transmission control method includes: receiving a data packet; if there is a file in the data packet, determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold; if so, performing signature calculation on the file bytes corresponding to the preset threshold to obtain signature information; matching the signature information with the signature information of the pre-stored virus file to obtain a first matching result; and controlling the transmission of the data packet according to the first matching result. The implementation of the above embodiments can improve the efficiency of virus file detection when there are many files to be transmitted, and save computer resources required for virus detection.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a virus file transmission control method and device, and a virus sample acquisition method and device. Background Art

[0002] In the prior art, for known virus caches, sample restoration can be completed on the device when the number of files is small. However, when device resources are limited and the device is in a network traffic environment or an existing network environment and needs to transfer a large number of files, a large number of samples are often lost and the cache overflows, causing problems such as insufficient performance and insufficient resources. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a virus file transmission control method and device and a virus sample acquisition method and device, which can improve the efficiency of virus file detection when there are many files to be transmitted and save computer resources required for virus detection.

[0004] In a first aspect, an embodiment of the present application provides a virus file transmission control method, comprising:

[0005] Receive data packets;

[0006] If there is a file in the data packet, determine whether the cumulative number of bytes of the file is greater than or equal to a preset threshold;

[0007] If yes, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0008] Matching the signature information with pre-stored signature information of the virus file to obtain a first matching result;

[0009] The data packet is controlled for transmission according to the first matching result.

[0010] In the above implementation process, the MD5 algorithm is not directly calculated on the entire file, but the signature calculation is performed on the number of bytes of the preset threshold of the file, which reduces the calculation time; the signature calculation is performed on the file bytes corresponding to the preset threshold to obtain signature information, and the signature information is matched with the signature information of the pre-stored virus file to obtain a first matching result, and the transmission of the data packet is controlled according to the first matching result, which improves the detection efficiency and saves the computer resources required for virus detection.

[0011] Further, after the step of determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold, the method further includes:

[0012] If not, determine whether the file has been received;

[0013] If yes, perform MD5 algorithm processing on the file to obtain the MD5 value of the file;

[0014] Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result;

[0015] The data packet is controlled for transmission according to the second matching result.

[0016] In the above implementation process, if the number of bytes of the entire file is less than the preset threshold, the entire file is directly processed by the MD5 algorithm to obtain the MD5 value of the entire file, the MD5 value of the file is matched with the MD5 value of the pre-stored virus file to obtain a second matching result, and the data packet is controlled for transmission according to the second matching result. Based on the above implementation, it can be ensured that all files are tested for viruses.

[0017] Furthermore, the step of controlling transmission of the data packet according to the first matching result includes:

[0018] If the first matching result is the same, in response to the instruction of the completion of the file reception, the file is processed by the MD5 algorithm to obtain the MD5 value of the file;

[0019] Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result;

[0020] The data packet is controlled for transmission according to the second matching result.

[0021] In the above implementation process, if the first matching result is the same, the file can be preliminarily judged to be a suspected virus file. When the entire file is received, the entire file is processed by the MD5 algorithm to obtain the MD5 value, and the MD5 value is matched with the MD5 value of the virus file stored in advance to obtain the second matching result. The file is transmitted and controlled according to the second matching result. The entire file is processed by the MD5 algorithm to obtain the MD5 value of the entire file, which can accurately determine whether the file is a virus file.

[0022] Furthermore, the step of controlling transmission of the data packet according to the second matching result includes:

[0023] If the second matching result is the same, stop receiving the data packet.

[0024] In the above implementation process, if the second matching result is the same, it means that the file is a virus file, and the receiving of data packets is stopped to ensure the safety of the device.

[0025] In a second aspect, an embodiment of the present application provides a method for obtaining a virus sample, comprising:

[0026] Acquire data packets in the system where virus signatures are imported;

[0027] If there is a file in the data packet, determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold;

[0028] If yes, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0029] Matching the signature information with pre-stored signature information of the virus file to obtain a third matching result;

[0030] A virus sample file is obtained according to the third matching result.

[0031] In the above implementation process, there is a virus file in the system into which the virus feature is imported. In order to obtain the virus sample file, a data packet is obtained in the system. When there is a file in the data packet, it is determined whether the cumulative number of bytes of the file is greater than or equal to a preset threshold. If so, a signature calculation is performed on the file bytes corresponding to the preset threshold to obtain signature information, and the signature information is matched with the signature information of the pre-stored virus file to obtain a third matching result. Compared with the prior art, the above embodiment does not directly perform MD5 calculation on the entire file, which saves calculation time, saves equipment resources, and improves detection efficiency.

[0032] Further, after the step of determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold, the method further includes:

[0033] If not, determine whether the file has been received;

[0034] If yes, perform MD5 algorithm processing on the file to obtain the MD5 value of the file;

[0035] Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fourth matching result;

[0036] The virus sample file is obtained according to the fourth matching result.

[0037] In the above implementation process, if the number of bytes of the entire file is less than the preset threshold, the entire file can be directly processed by the MD5 algorithm to obtain the MD5 value of the entire file. Since the number of bytes of the entire file is small, the calculation time is reduced; after the MD5 algorithm is processed on the entire file, the MD5 value of the file is obtained, and the MD5 value of the file is matched with the MD5 value of the pre-stored virus file to obtain a fourth matching result, and the virus sample file can be quickly obtained according to the fourth matching result.

[0038] Furthermore, the step of obtaining a virus sample file according to the third matching result includes:

[0039] If the third matching result is the same, in response to the instruction of the completion of the file reception, the file is processed by the MD5 algorithm to obtain the MD5 value of the file;

[0040] Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fifth matching result;

[0041] The virus sample file is obtained according to the fifth matching result.

[0042] In the above implementation process, if the third matching result is the same, it means that the file is a suspected virus file. Therefore, when the entire file is received, the entire file is processed by the MD5 algorithm to obtain the MD5 value of the file, and the MD5 value of the file is matched with the MD5 value of the pre-stored virus file to obtain the fifth matching result; the virus sample file is obtained according to the fifth matching result.

[0043] Furthermore, the step of obtaining the virus sample file according to the fifth matching result includes:

[0044] If the fifth matching result is the same, confirm that the file is the virus sample file, and save the virus sample file;

[0045] If the fifth matching result is different, the virus sample file is deleted.

[0046] In the above implementation process, if the fifth matching result is the same, it means that the file is a virus sample file, so the virus sample file is saved; if not, the virus sample file is deleted, so that the resources of the device are released.

[0047] In a third aspect, an embodiment of the present application provides a virus file transmission control device, comprising:

[0048] A receiving module, used for receiving data packets;

[0049] A first judgment module is used to judge whether the cumulative number of bytes of the file is greater than or equal to a preset threshold if there is a file in the data packet; if so, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0050] A first matching module, used to match the signature information with pre-stored signature information of the virus file to obtain a first matching result;

[0051] A transmission control module is used to control the transmission of the data packet according to the first matching result.

[0052] In the above implementation process, the MD5 algorithm is not directly calculated on the entire file, but the signature calculation is performed on the number of bytes of the preset threshold of the file, which reduces the calculation time; the signature calculation is performed on the file bytes corresponding to the preset threshold to obtain signature information, and the signature information is matched with the signature information of the pre-stored virus file to obtain a first matching result, and the transmission of the data packet is controlled according to the first matching result, which improves the detection efficiency and saves the computer resources required for virus detection.

[0053] In a fourth aspect, an embodiment of the present application provides a virus sample acquisition device, comprising:

[0054] An acquisition module, used for acquiring data packets in a system for importing virus signatures;

[0055] A second judgment module is used to judge whether the cumulative number of bytes of the file is greater than or equal to a preset threshold if there is a file in the data packet; if so, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0056] A second matching module, used for matching the signature information with the signature information of the virus file stored in advance to obtain a third matching result;

[0057] The virus sample acquisition module is used to acquire a virus sample file according to the third matching result.

[0058] In the above implementation process, there is a virus file in the system into which the virus feature is imported. In order to obtain the virus sample file, a data packet is obtained in the system. When there is a file in the data packet, it is determined whether the cumulative number of bytes of the file is greater than or equal to a preset threshold. If so, a signature calculation is performed on the file bytes corresponding to the preset threshold to obtain signature information, and the signature information is matched with the signature information of the pre-stored virus file to obtain a third matching result. Compared with the prior art, the above embodiment does not directly perform MD5 calculation on the entire file, which saves calculation time, saves equipment resources, and improves detection efficiency.

[0059] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 A flowchart of a virus file transmission control method provided in an embodiment of the present application;

[0062] Figure 2 A flowchart of another virus file transmission control method provided in an embodiment of the present application;

[0063] Figure 3 A schematic diagram of a flow chart of controlling transmission of a data packet according to a first matching result provided in an embodiment of the present application;

[0064] Figure 4 A schematic diagram of a process for obtaining virus sample files provided in an embodiment of the present application;

[0065] Figure 5 A flowchart of another method for obtaining virus sample files provided in an embodiment of the present application;

[0066] Figure 6 A schematic diagram of a process for obtaining a virus sample file for a third matching result provided in an embodiment of the present application;

[0067] Figure 7 A schematic diagram of the structure of a virus file transmission control device provided in an embodiment of the present application;

[0068] Figure 8 A schematic diagram of the structure of a virus sample file acquisition device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0070] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0071] Example 1

[0072] See also Figure 1 The present application embodiment provides a virus file transmission control method, comprising:

[0073] S11: receiving data packets;

[0074] S12: If there is a file in the data packet, determine whether the cumulative number of bytes of the file is greater than or equal to a preset threshold; if so, execute S13;

[0075] S13: Perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0076] S14: Match the signature information with the signature information of the pre-stored virus file to obtain a first matching result;

[0077] S15: Control the transmission of the data packet according to the first matching result.

[0078] In the above embodiment, the preset threshold is 256. Furthermore, performing signature calculation on the file bytes corresponding to the preset threshold is performing signature calculation on the first 256 bytes of the file.

[0079] In the above embodiment, the execution of S12 is in response to an instruction indicating that the transmission of a data packet is completed.

[0080] In the above implementation process, the MD5 algorithm is not directly calculated on the entire file, but the signature calculation is performed on the preset threshold number of bytes of the file, which reduces the calculation time; the signature calculation is performed on the preset threshold number of bytes of the file to obtain signature information, and the signature information is matched with the signature information of the pre-stored virus file to obtain a first matching result, and the transmission of the data packet is controlled according to the first matching result, which improves the detection efficiency and saves resources.

[0081] Example 2

[0082] See also Figure 2 In a possible implementation manner, when it is determined that the cumulative number of bytes of the file is less than a preset threshold, that is, when the determination result of S12 is no, the method further includes:

[0083] S16: Determine whether the file has been received; if so, execute S17;

[0084] S17: Process the file using the MD5 algorithm to obtain the MD5 value of the file;

[0085] S18: Match the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result;

[0086] S19: Control the transmission of the data packet according to the second matching result.

[0087] In S16, if the judgment result is no, continue to receive data packets.

[0088] In the above implementation process, if the number of bytes of the entire file is less than the preset threshold, the entire file is directly processed by the MD5 algorithm to obtain the MD5 value of the entire file, the MD5 value of the file is matched with the MD5 value of the pre-stored virus file to obtain a second matching result, and the data packet is controlled for transmission according to the second matching result. Based on the above implementation, it can be ensured that all data packets are detected.

[0089] See also Figure 3 In the above embodiment, the execution of S16 is in response to an instruction indicating that the transmission of a data packet is completed.

[0090] In a possible implementation, S15 includes:

[0091] S151: If the first matching result is the same, in response to the instruction of the completion of file reception, the file is processed by the MD5 algorithm to obtain the MD5 value of the file;

[0092] S152: Match the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result;

[0093] S153: Control the transmission of the data packet according to the second matching result.

[0094] In the above implementation process, if the first matching result is the same, the file can be preliminarily judged to be a suspected virus file. When the entire file is received, the entire file is processed by the MD5 algorithm to obtain the MD5 value, and the MD5 value is matched with the MD5 value of the virus file stored in advance to obtain the second matching result. The file is transmitted and controlled according to the second matching result. The entire file is processed by the MD5 algorithm to obtain the MD5 value of the entire file, which can accurately determine whether the file is a virus file.

[0095] If the first matching result is different, the file is determined to be a non-virus file, the file is released, and the file is transmitted to the next node.

[0096] In a possible implementation, S152 includes:

[0097] If the second matching result is the same, stop receiving data packets.

[0098] In the above implementation process, if the second matching result is the same, it means that the file is a virus file, and the receiving of data packets is stopped to ensure the safety of the device.

[0099] Example 3

[0100] See also Figure 4 , the present application provides a method for obtaining a virus sample, comprising:

[0101] S21: Obtaining a data packet in the system for importing virus signatures;

[0102] S22: If there is a file in the data packet, determine whether the cumulative number of bytes of the file is greater than or equal to a preset threshold; if so, execute S23;

[0103] S23: Calculate the signature of the file bytes corresponding to the preset threshold to obtain signature information;

[0104] S24: Matching the signature information with the signature information of the virus file stored in advance to obtain a third matching result;

[0105] S25: Obtain a virus sample file according to the third matching result.

[0106] In the above embodiment, S22 responds to the instruction that the transmission of each corresponding data packet of the file is completed.

[0107] In the above embodiment, the preset threshold is 256. Furthermore, performing signature calculation on the file bytes corresponding to the preset threshold is performing signature calculation on the first 256 bytes of the file.

[0108] In the above implementation process, there is a virus file in the system into which the virus feature is imported. In order to obtain the virus sample file, a data packet is obtained in the system. When there is a file in the data packet, it is determined whether the cumulative number of bytes of the file is greater than or equal to a preset threshold. If so, a signature calculation is performed on the number of file bytes corresponding to the preset threshold to obtain signature information, and the signature information is matched with the signature information of the pre-stored virus file to obtain a third matching result. Compared with the prior art, the above embodiment does not directly perform MD5 calculation on the entire file, which saves calculation time, saves equipment resources, and improves detection efficiency.

[0109] Example 4

[0110] See also Figure 5 In a possible implementation manner, when the judgment result of S22 is no, the method further includes:

[0111] S26: Determine whether the file has been received, if so, execute S27;

[0112] S27: Process the file using the MD5 algorithm to obtain the MD5 value of the file;

[0113] S28: Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fourth matching result;

[0114] S29: Obtain a virus sample file according to the fourth matching result.

[0115] In S26, if the judgment result is no, then continue to acquire new data packets.

[0116] In the above embodiment, S26 responds to the instruction that the transmission of each corresponding data packet of the file is completed.

[0117] In the above implementation process, if the number of bytes of the entire file is less than the preset threshold, the entire file can be directly processed by the MD5 algorithm to obtain the MD5 value of the entire file. Since the number of bytes of the entire file is small, the calculation time is reduced; after the MD5 algorithm is processed on the entire file, the MD5 value of the file is obtained, and the MD5 value of the file is matched with the MD5 value of the pre-stored virus file to obtain a fourth matching result, and the virus sample file can be quickly obtained according to the fourth matching result.

[0118] See also Figure 6 In a possible implementation manner, S25 includes:

[0119] S251: If the third matching result is the same, in response to the instruction of the completion of file reception, the file is processed by the MD5 algorithm to obtain the MD5 value of the file;

[0120] S252: Match the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fifth matching result;

[0121] S253: Obtain a virus sample file according to the fifth matching result.

[0122] In a possible implementation, S253 includes:

[0123] If the fifth matching result is the same, the file is confirmed as a virus sample file and the virus sample file is saved;

[0124] If the fifth matching result is different, the file is deleted.

[0125] In the above implementation process, if the third matching result is the same, it means that the file is a suspected virus file. Therefore, when the entire file is received, the entire file is processed by the MD5 algorithm to obtain the MD5 value of the file, and the MD5 value of the file is matched with the MD5 value of the pre-stored virus file to obtain the fifth matching result; the virus sample file is obtained according to the fifth matching result.

[0126] If the third matching result is different, in response to the instruction of the completion of file reception, the file is processed by MD5 algorithm to obtain the MD5 value of the file; the MD5 value of the file is matched with the MD5 value of the virus file stored in advance to obtain the sixth matching result; if the sixth matching result is the same, the signature information of the file is saved. If the sixth matching result is different, the file is deleted.

[0127] In the above implementation process, if the fifth matching result is the same, it means that the file is a virus sample file, so the virus sample file is saved; if not, the virus sample file is deleted, so that the resources of the device are released.

[0128] Example 5

[0129] See also Figure 7 The present application embodiment provides a virus file transmission control device, comprising:

[0130] A receiving module 11, used for receiving data packets;

[0131] The first judgment module 12 is used to judge whether the cumulative number of bytes of the file is greater than or equal to a preset threshold if there is a file in the data packet; if so, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0132] A first matching module 13 is used to match the signature information with the pre-stored signature information of the virus file to obtain a first matching result;

[0133] The transmission control module 14 is used to control the transmission of the data packet according to the first matching result.

[0134] In a possible implementation, the first judgment module 12 is further used to determine whether the file has been received when it is determined that the cumulative number of bytes of the file is less than a preset threshold; perform MD5 algorithm processing on the file to obtain the MD5 value of the file; the first matching module 13 is further used to match the MD5 value of the file with the MD5 value of the pre-stored virus file to obtain a second matching result; the transmission control module 14 is further used to control the transmission of the data packet according to the second matching result.

[0135] In a possible implementation, the transmission control module 14 is further configured to, when the first matching result is the same, respond to an instruction indicating that the file reception is complete, perform MD5 algorithm processing on the file to obtain an MD5 value of the file;

[0136] Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result;

[0137] The data packet is controlled for transmission according to the second matching result.

[0138] In a possible implementation manner, the transmission control module 14 is further configured to stop receiving data packets when the second matching result is the same.

[0139] Example 6

[0140] See also Figure 8 , the embodiment of the present application provides a virus sample acquisition device, comprising:

[0141] An acquisition module 21 is used to acquire a data packet in a system for importing virus features;

[0142] The second judgment module 22 is used to judge whether the cumulative number of bytes of the file is greater than or equal to a preset threshold if there is a file in the data packet; if so, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information;

[0143] The second matching module 23 is used to match the signature information with the pre-stored signature information of the virus file to obtain a third matching result;

[0144] The virus sample acquisition module 24 is used to acquire a virus sample file according to the third matching result.

[0145] In a possible implementation manner, the second judgment module 22 is further used to judge whether the file has been received when the cumulative number of bytes of the file is less than a preset threshold; if so, perform MD5 algorithm processing on the file to obtain the MD5 value of the file;

[0146] The second matching module 23 is further used to match the MD5 value of the file with the MD5 value of the pre-stored virus file to obtain a fourth matching result;

[0147] The virus sample acquisition module 24 is further configured to acquire a virus sample file according to the fourth matching result.

[0148] The second judgment module 22 is also used for, when the third matching result is the same, responding to the instruction of the completion of file reception, performing MD5 algorithm processing on the file to obtain the MD5 value of the file;

[0149] The second matching module 23 matches the MD5 value of the file with the MD5 value of the pre-stored virus file to obtain a fifth matching result;

[0150] The virus sample acquisition module 24 is further configured to acquire a virus sample file according to the fifth matching result.

[0151] In a possible implementation manner, the second judgment module 22 is further configured to save the virus sample file when the fifth matching result is the same; and delete the virus sample file when the fifth matching result is different.

[0152] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0153] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0154] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0155] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0156] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0157] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A virus file transmission control method, characterized in that: include: Receive data packets; If there is a file in the data packet, determine whether the cumulative number of bytes of the file is greater than or equal to a preset threshold; If yes, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information; Matching the signature information with pre-stored signature information of the virus file to obtain a first matching result; Controlling transmission of the data packet according to the first matching result; The step of controlling the transmission of the data packet according to the first matching result includes: If the first matching result is the same, in response to the instruction of the completion of the file reception, the file is processed by the MD5 algorithm to obtain the MD5 value of the file; Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result; The data packet is controlled for transmission according to the second matching result.

2. The virus file transmission control method according to claim 1, characterized in that: After the step of determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold, the method further includes: If not, determine whether the file has been received; If yes, perform MD5 algorithm processing on the file to obtain the MD5 value of the file; Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result; The data packet is controlled for transmission according to the second matching result.

3. The virus file transmission control method according to claim 1, characterized in that: The step of controlling transmission of the data packet according to the second matching result comprises: If the second matching result is the same, stop receiving the data packet.

4. A method for obtaining a virus sample, characterized in that: include: Acquire data packets in the system where virus signatures are imported; If there is a file in the data packet, determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold; If yes, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information; Matching the signature information with pre-stored signature information of the virus file to obtain a third matching result; Acquire a virus sample file according to the third matching result; The step of obtaining a virus sample file according to the third matching result includes: If the third matching result is the same, in response to the instruction of the completion of the file reception, the file is processed by the MD5 algorithm to obtain the MD5 value of the file; Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fifth matching result; The virus sample file is obtained according to the fifth matching result.

5. The virus sample acquisition method according to claim 4, characterized in that: After the step of determining whether the cumulative number of bytes of the file is greater than or equal to a preset threshold, the method further includes: If not, determine whether the file has been received; If yes, perform MD5 algorithm processing on the file to obtain the MD5 value of the file; Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fourth matching result; The virus sample file is obtained according to the fourth matching result.

6. The virus sample acquisition method according to claim 4, characterized in that: The step of obtaining the virus sample file according to the fifth matching result includes: If the fifth matching result is the same, confirm that the file is the virus sample file, and save the virus sample file; If the fifth matching result is different, the file is deleted.

7. A virus file transmission control device, characterized in that: include: A receiving module, used for receiving data packets; A first judgment module, used for judging whether the accumulated number of bytes of the file is greater than or equal to a preset threshold value if there is a file in the data packet; If yes, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information; A first matching module, used to match the signature information with pre-stored signature information of the virus file to obtain a first matching result; A transmission control module, used for controlling the transmission of the data packet according to the first matching result; The transmission control module is further used to, when the first matching result is the same, respond to the instruction of the completion of file reception, perform MD5 algorithm processing on the file to obtain the MD5 value of the file; Matching the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a second matching result; The data packet is controlled for transmission according to the second matching result.

8. A virus sample acquisition device, characterized in that: include: An acquisition module, used for acquiring data packets in a system for importing virus signatures; A second judgment module is used to judge whether the cumulative number of bytes of the file is greater than or equal to a preset threshold if there is a file in the data packet; if so, perform signature calculation on the file bytes corresponding to the preset threshold to obtain signature information; A second matching module, used for matching the signature information with the signature information of the virus file stored in advance to obtain a third matching result; A virus sample acquisition module, used to acquire a virus sample file according to the third matching result; The second judgment module is further used to, when the third matching result is the same, respond to the instruction of the completion of file reception, perform MD5 algorithm processing on the file to obtain the MD5 value of the file; The second matching module matches the MD5 value of the file with the MD5 value of the virus file stored in advance to obtain a fifth matching result; The virus sample acquisition module is further used to acquire a virus sample file according to the fifth matching result.

Images