Computer virus searching method and device, computer equipment and storage medium

Abstract

The application provides a computer virus retrieval method and device, computer equipment and a storage medium, relates to the technical field of computer security, and is used for improving the retrieval efficiency of computer viruses. The method mainly comprises the following steps: establishing a retrieval intermediate layer, and judging whether the virus information of the to-be-detected file is contained in the threat intelligence library based on the retrieval intermediate layer.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a computer virus retrieval method, apparatus, computer equipment, and storage medium. Background Technology

[0002] Traditional virus detection methods, based on computer virus signatures, work by analyzing the characteristics of all viruses and collecting their signatures in a virus signature database. During detection, the file to be detected is scanned and compared with the virus signatures in the database. If the same signature is found, the file is considered infected. Threat data enrichment is then performed, which involves searching the threat intelligence database for more detailed virus descriptions. Finally, the threat detection results are output.

[0003] However, in the traditional process of enriching threat intelligence databases based on computer virus signatures, processing efficiency is affected by the volume of data in the threat intelligence database. With the rapid development of the information age, information such as the types, characteristics, and behaviors of viruses is increasing dramatically, leading to a continuous increase in the size and volume of threat intelligence databases, thus affecting the retrieval efficiency of computer viruses in threat intelligence databases. Summary of the Invention

[0004] This application provides a computer virus retrieval method, apparatus, computer device, and storage medium to improve the efficiency of computer virus retrieval.

[0005] This invention provides a computer virus detection method, the method comprising:

[0006] A retrieval intermediate layer is established, and based on the retrieval intermediate layer, it is determined whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0007] In an optional embodiment, determining whether the threat intelligence database contains virus intelligence information for the file to be detected based on the retrieval intermediate layer includes:

[0008] Obtain the virus signature of the file to be detected;

[0009] The virus signature of the file to be detected is hashed using multiple random mapping functions to obtain multiple hash indices;

[0010] The search is performed using multiple hash indices to determine whether the retrieval intermediate layer contains the virus signature of the file to be detected, thereby determining whether the threat intelligence database contains virus intelligence information about the file to be detected.

[0011] In an optional embodiment, the step of searching the retrieval intermediate layer for virus signatures of the file to be detected based on multiple hash indices to determine whether the threat intelligence database contains virus intelligence information of the file to be detected includes:

[0012] Retrieve the values ​​corresponding to multiple hash indices in the intermediate layer binary bit array;

[0013] If multiple hash indices correspond to the same value of 1, then it is determined that the threat intelligence database contains virus intelligence information of the file to be detected.

[0014] If any of the hash index values ​​is 0, then the threat intelligence database does not contain virus intelligence information for the file to be detected.

[0015] In an optional embodiment, establishing the retrieval intermediate layer includes:

[0016] Initialize a binary bit array, with each index position set to 0;

[0017] The virus signatures of multiple known viruses are hashed using multiple random mapping functions to obtain multiple hash indices corresponding to the virus signatures of the known viruses.

[0018] Set the values ​​of the hash indices corresponding to the virus signatures of multiple known viruses to 1 at the corresponding index positions in the binary bit array.

[0019] In an optional embodiment, the method further includes:

[0020] If it is determined that the threat intelligence database contains virus intelligence information of the file to be detected, then retrieve the detailed description of the virus corresponding to the virus signature of the file to be detected from the threat intelligence database;

[0021] If it is determined that the threat intelligence database does not contain virus intelligence information for the file to be detected, then the virus search for the file to be detected will be filtered out.

[0022] In an optional embodiment, the method further includes:

[0023] When the number of newly added known viruses in the threat intelligence database exceeds the preset value, it is determined whether the newly added known viruses are within the storage capacity of the current retrieval intermediate layer.

[0024] If the newly added known virus is within the storage range that the current retrieval intermediate layer can accommodate, then the hash calculation of the original multiple random mapping functions of the retrieval intermediate layer is performed on the newly added known virus to obtain multiple hash subscripts corresponding to the virus feature codes of the newly added known virus.

[0025] Set the corresponding index positions of multiple hash subscripts for the newly added known virus signatures to 1. If the value of the corresponding index position is already 1, skip it; if the value of the corresponding index position is 0, set its value to 1 to obtain the binary bit array corresponding to the newly added known virus signatures.

[0026] The updated binary bit array is combined with the original multiple random mapping functions to form the updated retrieval intermediate layer.

[0027] In an optional embodiment, the method further includes:

[0028] If the newly added known virus is not within the storage capacity of the current retrieval intermediate layer, and the binary bit array of the current retrieval intermediate layer no longer meets the storage requirements, then the number of bits in the binary bit array and the number of random mapping functions are re-determined based on the number of newly added known viruses, and the retrieval intermediate layer is re-established.

[0029] This invention provides a computer virus detection device, the device comprising:

[0030] Establish a module to build the retrieval intermediate layer;

[0031] The judgment module is used to determine whether the threat intelligence database contains virus intelligence information of the file to be detected, based on the retrieval intermediate layer.

[0032] In an optional embodiment, the determination module specifically includes:

[0033] The acquisition unit is used to acquire the virus signature of the file to be detected.

[0034] The calculation unit is used to perform hash calculations on the virus signature of the file to be detected using multiple random mapping functions to obtain multiple hash indices;

[0035] The determining unit is used to search the retrieval intermediate layer for virus signatures of the file to be detected based on multiple hash indices, so as to determine whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0036] In an optional embodiment, the determining unit is specifically used for:

[0037] Retrieve the values ​​corresponding to multiple hash indices in the intermediate layer binary bit array;

[0038] If multiple hash indices correspond to the same value of 1, then it is determined that the threat intelligence database contains virus intelligence information of the file to be detected.

[0039] If any of the hash index values ​​is 0, then the threat intelligence database does not contain virus intelligence information for the file to be detected.

[0040] In an optional embodiment, the establishment module is specifically used for:

[0041] Initialize a binary bit array, with each index position set to 0;

[0042] The virus signatures of multiple known viruses are hashed using multiple random mapping functions to obtain multiple hash indices corresponding to the virus signatures of the known viruses.

[0043] Set the values ​​of the hash indices corresponding to the virus signatures of multiple known viruses to 1 at the corresponding index positions in the binary bit array.

[0044] In an optional embodiment, the illustrated apparatus further includes:

[0045] The retrieval module is used to retrieve detailed description information of the virus signature corresponding to the file to be detected from the threat intelligence database if it is determined that the threat intelligence database contains virus intelligence information of the file to be detected.

[0046] The filtering module is used to filter out virus searches for the file to be detected if it is determined that the threat intelligence database does not contain virus intelligence information for the file to be detected.

[0047] In an optional embodiment, when the number of newly added known viruses in the threat intelligence database exceeds a preset value, it is determined whether the newly added known viruses are within the storage range that the current retrieval intermediate layer can accommodate.

[0048] If the newly added known virus is within the storage range that the current retrieval intermediate layer can accommodate, then the hash calculation of the original multiple random mapping functions of the retrieval intermediate layer is performed on the newly added known virus to obtain multiple hash subscripts corresponding to the virus feature codes of the newly added known virus.

[0049] Set the corresponding index positions of multiple hash subscripts for the newly added known virus signatures to 1. If the value of the corresponding index position is already 1, skip it; if the value of the corresponding index position is 0, set its value to 1 to obtain the binary bit array corresponding to the newly added known virus signatures.

[0050] The updated binary bit array is combined with the original multiple random mapping functions to form the updated retrieval intermediate layer.

[0051] If the newly added known virus is not within the storage capacity of the current retrieval intermediate layer, and the binary bit array of the current retrieval intermediate layer no longer meets the storage requirements, then the number of bits in the binary bit array and the number of random mapping functions are re-determined based on the number of newly added known viruses, and the retrieval intermediate layer is re-established.

[0052] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned computer virus detection method.

[0053] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned computer virus retrieval method.

[0054] A computer program product comprising a computer program that, when executed by a processor, implements the aforementioned computer virus retrieval method.

[0055] This invention provides a computer virus retrieval method, apparatus, computer device, and storage medium. It establishes a retrieval intermediate layer and, based on this intermediate layer, determines whether a threat intelligence database contains virus intelligence information for the file to be detected. In other words, this invention designs a retrieval intermediate layer between virus signatures and the threat intelligence database, enabling rapid determination of whether virus intelligence information for the file to be detected exists in the threat intelligence database, thereby significantly improving the efficiency of threat data retrieval during virus detection. Attached Figure Description

[0056] Figure 1 A flowchart of a computer virus retrieval method provided in this application;

[0057] Figure 2 A flowchart for determining whether the threat intelligence database contains the file to be detected, provided in this application;

[0058] Figure 3 A schematic diagram illustrating the binary bit array configuration provided in this application;

[0059] Figure 4 Flowchart of another computer virus detection method provided in this application;

[0060] Figure 5 This is a schematic diagram of the computer virus detection device provided in this application.

[0061] Figure 6 A schematic diagram of the computer device provided in this application. Detailed Implementation

[0062] To better understand the above technical solutions, the technical solutions of the embodiments of this application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of this application and the specific features in the embodiments are detailed descriptions of the technical solutions of the embodiments of this application, rather than limitations on the technical solutions of this application. In the absence of conflict, the embodiments of this application and the technical features in the embodiments can be combined with each other.

[0063] Please see Figure 1 This invention provides a computer virus retrieval method, which specifically includes steps S10-S20:

[0064] S10, Establish the intermediate retrieval layer.

[0065] The retrieval intermediate layer consists of a data structure composed of a long binary bit array and a series of random mapping functions (unbiased hash functions). The binary bit array stores the index values ​​corresponding to the hash values ​​after the data virus signature hashing process. The random mapping functions are used to perform hash operations on the sample data to generate relatively uniform hash values, so that the indexes corresponding to the calculated hash values ​​can be uniformly mapped to the binary bit array.

[0066] Specifically, establishing the retrieval intermediate layer includes: initializing a binary bit array, with the value at each index position initially set to 0; performing hash calculations using multiple random mapping functions on the virus signatures of multiple known viruses to obtain multiple hash indices corresponding to the virus signatures of the known viruses; and setting the value at the corresponding index position of the multiple hash indices corresponding to the virus signatures of the multiple known viruses in the binary bit array to 1. The number of bits in the binary bit array and the number of random mapping functions are directly proportional to the accuracy of determining the presence or absence of virus intelligence information in the threat intelligence database.

[0067] For example, if 01010101110101101 is a virus signature, after processing by a hash random mapping function, the index 15 is obtained. This virus signature is then stored at index 15 of the binary bit group in the retrieval intermediate layer and set to 1.

[0068] S20, Based on the retrieval intermediate layer, determine whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0069] In this embodiment, the specific process involves calculating the hash values ​​of multiple random mapping functions corresponding to the virus signature of the file to be detected. Then, the corresponding position in the binary bit array is queried based on the hash value. If the values ​​at the corresponding positions are all 1, it is determined that the threat intelligence database contains virus intelligence information about the file to be detected. This is a data processing flow that retrieves more detailed virus description information from the threat intelligence database based on the detected virus signature. The threat intelligence database contains detailed information about many viruses, such as their family affiliation and behavior.

[0070] like Figure 2 As shown, in an optional embodiment provided by the present invention, the step of determining whether the threat intelligence database contains virus intelligence information of the file to be detected based on the retrieval intermediate layer includes:

[0071] S201, Obtain the virus signature of the file to be detected.

[0072] The virus signature is a unique binary sequence extracted from different locations within the virus. Specifically, in this embodiment, a virus signature database can be used to determine whether a file to be detected is a virus file. If the file to be detected is a virus file, then the virus signature of the file to be detected is obtained.

[0073] S202, perform hash calculations on the virus signature of the file to be detected using multiple random mapping functions to obtain multiple hash indices.

[0074] like Figure 3 The diagram shows the hash calculations performed using multiple random mapping functions on the virus signature (corresponding to the element values ​​in the diagram) of the file to be detected. Specifically, the virus signature of the file to be detected is hashed using three random mapping functions: the hash value (hash index) calculated by the first random mapping function is 0; the hash value (hash index) calculated by the second random mapping function is 3; and the hash value (hash index) calculated by the third random mapping function is 8.

[0075] S203, based on multiple hash indices, search the retrieval intermediate layer to determine whether the virus signature of the file to be detected is contained, so as to determine whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0076] In an optional embodiment of the present invention, the step of searching the retrieval intermediate layer for virus signatures of the file to be detected based on multiple hash indices to determine whether the threat intelligence database contains virus intelligence information of the file to be detected includes: obtaining the values ​​corresponding to the multiple hash indices in the binary bit array of the retrieval intermediate layer; if the values ​​corresponding to the multiple hash indices are all 1, then it is determined that the threat intelligence database contains virus intelligence information of the file to be detected; if any of the values ​​corresponding to the multiple hash indices are 0, then it is determined that the threat intelligence database does not contain virus intelligence information of the file to be detected.

[0077] For example, given three random mapping functions A, B, and C, the virus signature 01010101110101101 is first processed by these functions, yielding indices 5, 10, and 13 respectively. The 5th, 10th, and 13th bits of the binary array are then set to 1. In other words, 01010101110101101 can be represented by 5, 10, and 13. When the signature 010101011101101 is encountered during a search, it is processed by functions A, B, and C to obtain 5, 10, and 13. Searching the Bloom filter's binary array using these values ​​yields a 1, confirming the existence of 010101011101101101. If a different virus signature 110101111 is processed through A, B, and C and the result is 3, 5, 10, then searching the intermediate binary bit array will yield 0, 1, 1, proving that the virus signature 110101111 does not exist.

[0078] For example, if the hash index of "virus signature 1" obtained by hashing using a random mapping function is 5, then the value at index 5 of the binary bit array is set to 1. Similarly, if the hash index of "virus signature 2" obtained by hashing using a random mapping function is 1, then the value at index 1 of the binary bit array is set to 1. The resulting binary bit array for the intermediate layer is then 010001000000000000000000000000... When "virus signature 1" is obtained, the index obtained after random mapping is still 5. Therefore, checking the value at index 5 of the binary bit array and finding it to be 1 proves that "virus signature 1" exists. The same logic applies to "virus signature 2".

[0079] In this embodiment, multiple hash indices are obtained by performing hash calculations using multiple random mapping functions to improve the accuracy of virus signature retrieval. For example, if the index of "virus signature 3" is calculated as 5 using a random mapping function, and the position of 5 in the binary bit array is also found to be 1, then it proves that "virus signature 3" also exists (but "virus signature 3" was not stored when the Bloom filter was built), which leads to a false positive. Therefore, this embodiment of the invention uses multiple random mapping functions for hash calculations.

[0080] For example, after calculating "virus signature 1" using multiple random mapping functions, the indices are 5 and 8. Similarly, after calculating "virus signature 2" using multiple random mapping functions, the indices are 1 and 2. The resulting binary bit array would be 0110010010000000000000000000... Since the Bloom filter consists of two random mapping functions, if we then check for "virus signature 3," the results would be 5 and 7. However, searching for the positions of 5 and 7 in the binary bit array reveals that indices 5 and 7 are 1 and 0 respectively, not both 1. Therefore, it indicates that virus signature 3 does not exist. This reduces the chance of false positives.

[0081] In an optional embodiment provided by the invention, when the number of newly added known viruses in the threat intelligence database exceeds a preset value, it is determined whether the newly added known viruses are within the storage capacity of the current retrieval intermediate layer. If the newly added known viruses are within the storage capacity of the current retrieval intermediate layer, the hash calculation of the original multiple random mapping functions of the retrieval intermediate layer is performed on the newly added known viruses to obtain multiple hash indices corresponding to the virus signatures of the newly added known viruses. The corresponding index positions of the multiple hash indices corresponding to the virus signatures of the newly added known viruses are set to 1. If the value of the corresponding index position is already 1, it is skipped. If the value of the corresponding index position is 0, it is set to 1 to obtain the updated binary bit array corresponding to the virus signatures of the newly added known viruses. The updated binary bit array and the original multiple random mapping functions are combined to form the updated retrieval intermediate layer.

[0082] If the newly added known virus is not within the storage capacity of the current retrieval intermediate layer, and the binary bit array of the current retrieval intermediate layer no longer meets the storage requirements, then the number of bits in the binary bit array and the number of random mapping functions are re-determined based on the number of newly added known viruses, and the retrieval intermediate layer is re-established.

[0083] For example, the threat intelligence database contains detailed information on virus signature 1 and virus signature 2. A retrieval intermediate layer is then established. After multiple random mapping functions are applied to "virus signature 1," the indices are 5 and 8. For "virus signature 2," the indices are 1 and 2. The binary bit array is then 0110010010000000000000000000... The retrieval intermediate layer is now complete. After some time, if we want to add "virus signature 3," we first add the detailed information for "virus signature 3" to the threat intelligence database, and then add it to the retrieval intermediate layer. "Virus signature 3," after being calculated using the two previous random mapping functions, yields 5 and 7. Checking the binary bit array, we find that the value at index 5 is already 1, so we ignore it. Then, we set the value at index 7 from 0 to 1. This completes the addition of "virus signature 3." The binary bit array becomes 011001011000000000000000000... When "virus signature 3" is obtained again, the two calculations will still return 5 and 7. Looking up the binary bit array, we find that the values ​​at indices 5 and 7 are both 1, proving that "virus signature 3" exists in the threat intelligence database.

[0084] In this embodiment of the invention, all virus signatures in the current threat intelligence database are extracted, and each signature is processed by a Bloom filter's random mapping function (unbiased hash function). The resulting hash value, corresponding to its hash index, is stored in the corresponding position of the binary bit array of the Bloom filter, forming a virus database retrieval intermediate layer based on the Bloom filter. Before retrieving the threat intelligence database based on virus signatures in the subsequent virus detection data processing enrichment process, the Bloom filter retrieval intermediate layer determines whether the signature exists in the threat intelligence database. If it exists, a detailed description of the virus is retrieved; otherwise, the retrieval operation for that signature in the database is filtered out.

[0085] In this embodiment, a retrieval intermediate layer is designed using the characteristics of a Bloom filter between the virus signature and the threat intelligence database. This retrieval intermediate layer stores the status of whether a certain virus signature exists in the threat intelligence database, enabling rapid determination of whether a certain virus signature exists in the threat intelligence database. It filters out retrieval operations for virus signatures that do not exist in the threat intelligence database, which can significantly improve the efficiency of the threat data enrichment stage in virus detection.

[0086] This invention provides a computer virus retrieval method. First, a retrieval intermediate layer is established. Then, based on this intermediate layer, it is determined whether the threat intelligence database contains virus intelligence information for the file to be detected. In other words, this invention designs a retrieval intermediate layer between the virus signature and the threat intelligence database, enabling rapid determination of whether virus intelligence information for the file to be detected exists in the threat intelligence database, thus significantly improving the efficiency of threat data retrieval during virus detection.

[0087] Further, such as Figure 4 As shown, after determining whether the threat intelligence database contains virus intelligence information for the file to be detected based on the retrieval intermediate layer, this method further includes:

[0088] Step S30: If it is determined that the threat intelligence database contains virus intelligence information of the file to be detected, then retrieve the detailed description of the virus corresponding to the virus signature of the file to be detected from the threat intelligence database.

[0089] Step S40: If it is determined that the threat intelligence database does not contain virus intelligence information of the file to be detected, then the virus search of the file to be detected is filtered out.

[0090] In traditional methods, all scanned viruses undergo a threat intelligence database search based on their signatures during data enrichment. However, the presence of a virus signature in the database is unknown before the search begins, resulting in inefficient data enrichment and wasted computational resources. This invention addresses this by establishing a retrieval intermediary layer. The virus signature stores the presence or absence of a specific virus signature in the database. Therefore, the presence of a virus signature in the threat intelligence database can be determined in advance. By using the retrieval intermediary layer and the virus signature of the file to be detected, it can be determined whether the database contains virus intelligence information for the file. This filters out retrieval operations for virus signatures not in the database, thereby improving the efficiency of data enrichment.

[0091] This invention provides a computer virus retrieval method. It obtains the virus signature of a file to be detected; by retrieving an intermediate layer and the virus signature of the file to be detected, it determines whether the threat intelligence database contains virus intelligence information for the file to be detected; if the threat intelligence database contains virus intelligence information for the file to be detected, it retrieves detailed virus description information corresponding to the virus signature of the file to be detected from the threat intelligence database; if the threat intelligence database does not contain virus intelligence information for the file to be detected, it filters out virus searches for the file to be detected. In other words, this invention utilizes the characteristics of a Bloom filter, designing an intermediate retrieval layer between the virus signature and the threat intelligence database. This enables rapid determination of whether a virus signature exists in the threat intelligence database. By filtering out virus signatures not in the threat intelligence database, it significantly improves the efficiency of threat data retrieval during virus detection.

[0092] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0093] In one embodiment, a computer virus detection device is provided, which corresponds one-to-one with the computer virus detection methods described in the above embodiments. For example... Figure 5 As shown, the functional modules of the computer virus detection device are described in detail below:

[0094] Module 51 is established to create the retrieval intermediate layer;

[0095] The judgment module 52 is used to determine whether the threat intelligence database contains virus intelligence information of the file to be detected based on the retrieval intermediate layer.

[0096] In an optional embodiment, the determination module 52 specifically includes:

[0097] The acquisition unit is used to acquire the virus signature of the file to be detected.

[0098] The calculation unit is used to perform hash calculations on the virus signature of the file to be detected using multiple random mapping functions to obtain multiple hash indices;

[0099] The determining unit is used to search the retrieval intermediate layer for virus signatures of the file to be detected based on multiple hash indices, so as to determine whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0100] In an optional embodiment, the determining unit is specifically used for:

[0101] Retrieve the values ​​corresponding to multiple hash indices in the intermediate layer binary bit array;

[0102] If multiple hash indices correspond to the same value of 1, then it is determined that the threat intelligence database contains virus intelligence information of the file to be detected.

[0103] If any of the hash index values ​​is 0, then the threat intelligence database does not contain virus intelligence information for the file to be detected.

[0104] In an optional embodiment, the establishment module 51 is specifically used for:

[0105] Initialize a binary bit array, with each index position set to 0;

[0106] The virus signatures of multiple known viruses are hashed using multiple random mapping functions to obtain multiple hash indices corresponding to the virus signatures of the known viruses.

[0107] Set the values ​​of the hash indices corresponding to the virus signatures of multiple known viruses to 1 at the corresponding index positions in the binary bit array.

[0108] In an optional embodiment, the illustrated apparatus further includes:

[0109] The retrieval module 53 is used to retrieve detailed description information of the virus signature corresponding to the file to be detected from the threat intelligence database if it is determined that the threat intelligence database contains virus intelligence information of the file to be detected.

[0110] The filtering module 54 is used to filter out virus searches for the file to be detected if it is determined that the threat intelligence database does not contain virus intelligence information for the file to be detected.

[0111] In an optional embodiment, when the number of newly added known viruses in the threat intelligence database exceeds a preset value, it is determined whether the newly added known viruses are within the storage range that the current retrieval intermediate layer can accommodate.

[0112] If the newly added known virus is within the storage range that the current retrieval intermediate layer can accommodate, then the hash calculation of the original multiple random mapping functions of the retrieval intermediate layer is performed on the newly added known virus to obtain multiple hash subscripts corresponding to the virus feature codes of the newly added known virus.

[0113] Set the corresponding index positions of multiple hash subscripts for the newly added known virus signatures to 1. If the value of the corresponding index position is already 1, skip it; if the value of the corresponding index position is 0, set its value to 1 to obtain the binary bit array corresponding to the newly added known virus signatures.

[0114] The updated binary bit array is combined with the original multiple random mapping functions to form the updated retrieval intermediate layer.

[0115] If the newly added known virus is not within the storage capacity of the current retrieval intermediate layer, and the binary bit array of the current retrieval intermediate layer no longer meets the storage requirements, then the number of bits in the binary bit array and the number of random mapping functions are re-determined based on the number of newly added known viruses, and the retrieval intermediate layer is re-established.

[0116] Specific limitations regarding computer virus detection devices can be found in the limitations of computer virus detection methods described above, and will not be repeated here. Each module in the aforementioned device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0117] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a computer virus detection method.

[0118] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0119] A retrieval intermediate layer is established, and based on the retrieval intermediate layer, it is determined whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0120] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0121] A retrieval intermediate layer is established, and based on the retrieval intermediate layer, it is determined whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0122] In one embodiment, a computer program product is provided, the computer program product comprising a computer program that is executed by a processor to perform the following steps:

[0123] A retrieval intermediate layer is established, and based on the retrieval intermediate layer, it is determined whether the threat intelligence database contains virus intelligence information of the file to be detected.

[0124] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0126] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for detecting computer viruses, characterized in that, The method includes: Establish a retrieval intermediate layer, and determine whether the threat intelligence database contains virus intelligence information of the file to be detected based on the retrieval intermediate layer; If it is determined that the threat intelligence database contains virus intelligence information of the file to be detected, then retrieve the detailed description of the virus corresponding to the virus signature of the file to be detected from the threat intelligence database; If it is determined that the threat intelligence database does not contain virus intelligence information for the file to be detected, then the virus search for the file to be detected will be filtered out. The establishment of the retrieval intermediate layer includes: Initialize a binary bit array, with each index position set to 0; The virus signatures of multiple known viruses are hashed using multiple random mapping functions to obtain multiple hash indices corresponding to the virus signatures of the known viruses. Set the values ​​of the hash indices corresponding to the virus signatures of multiple known viruses to 1 at the corresponding index positions in the binary bit array; The number of bits in the binary bit set and the number of the random mapping functions are directly proportional to the accuracy of determining the existence status of virus intelligence information in the threat intelligence database. When the number of newly added known viruses in the threat intelligence database exceeds the preset value, it is determined whether the newly added known viruses are within the storage capacity of the current retrieval intermediate layer. If the newly added known virus is within the storage range that the current retrieval intermediate layer can accommodate, then the hash calculation of the original multiple random mapping functions of the retrieval intermediate layer is performed on the newly added known virus to obtain multiple hash subscripts corresponding to the virus feature codes of the newly added known virus. Set the corresponding index positions of multiple hash subscripts for the newly added known virus signatures to 1. If the value of the corresponding index position is already 1, skip it; if the value of the corresponding index position is 0, set its value to 1 to obtain the binary bit array corresponding to the newly added known virus signatures. The updated binary bit array is combined with the original multiple random mapping functions to form the updated retrieval intermediate layer; If the newly added known virus is not within the storage capacity of the current retrieval intermediate layer, and the binary bit array of the current retrieval intermediate layer no longer meets the storage requirements, then the number of bits in the binary bit array and the number of random mapping functions are re-determined based on the number of newly added known viruses, and the retrieval intermediate layer is re-established.

2. The method according to claim 1, characterized in that, The step of determining whether the threat intelligence database contains virus intelligence information for the file to be detected based on the retrieval intermediate layer includes: Obtain the virus signature of the file to be detected; The virus signature of the file to be detected is hashed using multiple random mapping functions to obtain multiple hash indices; The search is performed using multiple hash indices to determine whether the retrieval intermediate layer contains the virus signature of the file to be detected, thereby determining whether the threat intelligence database contains virus intelligence information about the file to be detected.

3. The method according to claim 2, characterized in that, The step of searching the intermediate retrieval layer for virus signatures of the file to be detected based on multiple hash indices to determine whether the threat intelligence database contains virus intelligence information of the file to be detected includes: Retrieve the values ​​corresponding to multiple hash indices in the intermediate layer binary bit array; If multiple hash indices correspond to the same value of 1, then it is determined that the threat intelligence database contains virus intelligence information of the file to be detected. If any of the hash index values ​​is 0, then the threat intelligence database does not contain virus intelligence information for the file to be detected.

4. A computer virus detection device, characterized in that, The device includes: Establish a module to build the retrieval intermediate layer; The judgment module is used to determine whether the threat intelligence database contains virus intelligence information of the file to be detected based on the retrieval intermediate layer; If it is determined that the threat intelligence database contains virus intelligence information of the file to be detected, then retrieve the detailed description of the virus corresponding to the virus signature of the file to be detected from the threat intelligence database; If it is determined that the threat intelligence database does not contain virus intelligence information for the file to be detected, then the virus search for the file to be detected will be filtered out. The establishment of the retrieval intermediate layer includes: Initialize a binary bit array, with each index position set to 0; The virus signatures of multiple known viruses are hashed using multiple random mapping functions to obtain multiple hash indices corresponding to the virus signatures of the known viruses. Set the values ​​of the hash indices corresponding to the virus signatures of multiple known viruses to 1 at the corresponding index positions in the binary bit array; The number of bits in the binary bit set and the number of the random mapping functions are directly proportional to the accuracy of determining the existence status of virus intelligence information in the threat intelligence database. When the number of newly added known viruses in the threat intelligence database exceeds the preset value, it is determined whether the newly added known viruses are within the storage capacity of the current retrieval intermediate layer. If the newly added known virus is within the storage range that the current retrieval intermediate layer can accommodate, then the hash calculation of the original multiple random mapping functions of the retrieval intermediate layer is performed on the newly added known virus to obtain multiple hash subscripts corresponding to the virus feature codes of the newly added known virus. Set the corresponding index positions of multiple hash subscripts for the newly added known virus signatures to 1. If the value of the corresponding index position is already 1, skip it; if the value of the corresponding index position is 0, set its value to 1 to obtain the binary bit array corresponding to the newly added known virus signatures. The updated binary bit array is combined with the original multiple random mapping functions to form the updated retrieval intermediate layer; If the newly added known virus is not within the storage capacity of the current retrieval intermediate layer, and the binary bit array of the current retrieval intermediate layer no longer meets the storage requirements, then the number of bits in the binary bit array and the number of random mapping functions are re-determined based on the number of newly added known viruses, and the retrieval intermediate layer is re-established.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the computer virus retrieval method as described in any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the computer virus retrieval method as described in any one of claims 1 to 3.

Images