A testing method and system for detecting anti-virus effect of anti-virus software

Abstract

The present invention discloses a test method, system, device and storage medium for detecting the anti-virus effect of anti-virus software, and the method includes: an operating system behavior monitoring module monitors the malicious behavior of viruses and the anti-virus behavior of anti-virus software in real time through operating system behavior monitoring, and generates logs; a behavior log management module performs behavior comparison statistics on the logs to detect and judge the malicious behavior of viruses and the anti-virus effect of anti-virus software; and also includes: a virtual machine scheduling and deployment module creates a virtual machine or a cluster of virtual machines, deploys an operating system in the virtual machine, and deploys a behavior monitoring system into the operating system, deploys the anti-virus software into the operating system through scheduling, performs scanning and anti-virus through scheduling, and executes virus malicious behavior samples through scheduling. The present invention can effectively quantify the malicious behavior of viruses and the anti-virus effect of anti-virus software, can accurately detect and judge the malicious behavior of viruses and the anti-virus effect of anti-virus software, and promotes the research and development of anti-virus software.

Description

Technical Field

[0001] The present invention relates to the field of anti-virus software testing, and in particular to a testing method and system for detecting the anti-virus effect of anti-virus software. Background Art

[0002] With the development of malicious code viruses, it is very important for anti-virus software to detect and remove viruses to ensure the information security of the operating system. More and more organizations and individuals are aware of this.

[0003] However, with the increase in malicious code viruses, the viruses' abilities to hide, reside, and infect are becoming increasingly sophisticated. Antivirus software needs to continuously improve its antivirus capabilities in the fight against malicious code viruses. However, faced with a wide variety of malicious behaviors of viruses with various technologies, as well as newly emerging malicious behaviors of viruses, the antivirus effects of antivirus software are difficult to quantify and test. Without the support of security researchers who have mastered professional virus analysis knowledge and skills, it is difficult for testers to conduct accurate and quantified test results on the antivirus effects.

[0004] In the prior art, when testing antivirus software, the virus is usually run, then the antivirus software is installed to perform antivirus, and the antivirus results are manually reviewed to determine the antivirus effect. With this testing method, the tester cannot accurately perceive the virus running status and cannot effectively determine the antivirus results; and it is difficult to fully cover virus types. Summary of the invention

[0005] In view of this, the present invention provides a testing method and system for detecting the antivirus effect of antivirus software, so that it can quantify the malicious behavior of viruses and the antivirus effect of antivirus software, and has strong operability to overcome the problems existing in the prior art.

[0006] In a first aspect, an embodiment of the present invention provides a testing method for detecting the antivirus effect of antivirus software, comprising:

[0007] The operating system behavior monitoring module monitors the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through operating system behavior monitoring, and generates logs;

[0008] The behavior log management module performs behavior comparison statistics on the logs to detect and judge virus malicious behavior and the anti-virus effect of the anti-virus software.

[0009] According to a specific implementation of the embodiment of the present invention, before the operating system behavior monitoring module monitors the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through the operating system behavior monitoring, it also includes:

[0010] The virtual machine scheduling and deployment module creates a virtual machine or a cluster of virtual machines, deploys an operating system in the virtual machine, and deploys a behavior monitoring system into the operating system. It deploys antivirus software into the operating system through scheduling, performs scanning and antivirus through scheduling, and executes virus and malicious behavior samples through scheduling.

[0011] According to a specific implementation of an embodiment of the present invention, the deployment of anti-virus software to the operating system through scheduling and the execution of scanning and anti-virus through scheduling include:

[0012] The virtual machine scheduling and deployment module schedules the antivirus software management module; the antivirus software management module is used to manage one or more antivirus software and antivirus engines, and provide antivirus software deployment and scanning and antivirus operation interfaces for the virtual machine scheduling and deployment module to deploy antivirus software and schedule scanning and antivirus.

[0013] According to a specific implementation of an embodiment of the present invention, the scheduling and executing of virus malicious behavior samples includes:

[0014] The virtual machine scheduling and deployment module schedules the virus sample management module, and the virus sample management module is used to manage virus malicious behavior samples, organize and classify samples, and issue samples for execution and record sample information under scheduling.

[0015] According to a specific implementation of an embodiment of the present invention, the virtual machine scheduling and deployment module includes internal scheduling and external scheduling;

[0016] External scheduling is responsible for handling virtual machine creation, start / stop / recovery, file transfer, and command transmission;

[0017] Internal dispatch is responsible for handling the implantation of behavior monitoring systems, installation and execution of anti-virus software, and execution of virus and malicious behavior samples;

[0018] The internal scheduling or external scheduling is also responsible for log export.

[0019] In a second aspect, an embodiment of the present invention further provides a test system for detecting the antivirus effect of antivirus software, comprising:

[0020] The operating system behavior monitoring module is configured to monitor the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through operating system behavior monitoring, and generate logs;

[0021] The behavior log management module is configured to perform behavior comparison statistics on the logs to detect and judge virus malicious behaviors and the anti-virus effect of the anti-virus software.

[0022] A specific implementation method according to an embodiment of the present invention further includes:

[0023] The virtual machine scheduling and deployment module is configured to create a virtual machine or a cluster of virtual machines, deploy an operating system in the virtual machine, and deploy a behavior monitoring system into the operating system. Antivirus software is deployed into the operating system through scheduling, scanning and antivirus are performed through scheduling, and virus malicious behavior samples are executed through scheduling.

[0024] A specific implementation method according to an embodiment of the present invention further includes:

[0025] The anti-virus software management module is configured to manage one or more anti-virus software and anti-virus engines, and provide an anti-virus software deployment and scanning anti-virus operation interface for the virtual machine scheduling and deployment module to deploy the anti-virus software and schedule scanning and anti-virus;

[0026] The virus sample management module is configured to manage virus malicious behavior samples, organize and classify samples, and issue samples for execution and record sample information under the scheduling of the virtual machine scheduling and deployment module.

[0027] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0028] at least one processor; and,

[0029] a memory communicatively connected to the at least one processor; wherein,

[0030] The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor is caused to execute the above-mentioned test method for detecting the antivirus effect of the antivirus software.

[0031] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and when the computer instructions are executed by at least one processor, the at least one processor executes the test method for detecting the antivirus effect of antivirus software as described above.

[0032] In the fifth aspect, an embodiment of the present invention further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the test method for detecting the antivirus effect of antivirus software in the aforementioned first aspect or any implementation of the first aspect.

[0033] The present invention monitors the malicious behavior of viruses and the anti-virus behavior of anti-virus software in real time through operating system behavior monitoring, and compares the behavior logs, which can effectively quantify the malicious behavior of viruses and the anti-virus effect of anti-virus software, and can accurately detect and judge the malicious behavior of viruses and the anti-virus effect of anti-virus software. It has strong operability, can ensure the security of the system, and quickly form a closed loop for improving virus detection and killing capabilities.

[0034] The present invention is used to test the antivirus effect of antivirus software, which solves the problem that the antivirus effect is difficult to quantify and test. By comparing the malicious behavior of the virus and the antivirus behavior of the antivirus software through operating system behavior monitoring, a comparative test of the antivirus effect is realized, and the defects of the detection and antivirus capabilities of the antivirus software can be found. From the testing perspective, it provides optimization power for the detection and killing capabilities of the antivirus software, improves the testing method of the antivirus software product, and promotes the research and development of antivirus software.

[0035] The present invention supports the testing of multiple anti-virus software and does not rely on the running log of the anti-virus software itself. The system in the present invention can be automatically deployed to achieve comprehensive coverage of virus samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0037] Figure 1 A schematic diagram of a testing method for detecting the antivirus effect of antivirus software provided by an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of the structure of a test system for detecting the antivirus effect of antivirus software provided by an embodiment of the present invention;

[0039] Figure 3 A schematic flow chart of a testing method for detecting the antivirus effect of antivirus software provided by an embodiment of the present invention;

[0040] Figure 4 A schematic diagram of operating system behavior monitoring and scheduling provided by an embodiment of the present invention;

[0041] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0043] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0044] The present invention provides a solution for detecting malicious virus behaviors and anti-virus software anti-virus behaviors through operating system behavior monitoring. The principle is to compare the detection results of malicious virus behaviors with the system behaviors of anti-virus software anti-virus process. The key point is to be able to monitor the system behaviors in the operating system in real time, and to be able to accurately detect and judge malicious virus behaviors and the anti-virus effects of anti-virus software. Among them, behavior monitoring refers to monitoring the data generated by the process in the computer; software malicious behaviors refer to malicious operations or behaviors performed by malware.

[0045] Figure 1 A schematic diagram of a testing method for detecting the antivirus effect of antivirus software provided by an embodiment of the present invention; Figure 2 A schematic diagram of the structure of a test system for detecting the antivirus effect of antivirus software provided by an embodiment of the present invention.

[0046] Cooperate Figure 1 , 2 As shown, a test system 100 for detecting the antivirus effect of antivirus software provided in this embodiment includes the following modules: a virtual machine scheduling and deployment module 110, an antivirus software management module 120, a virus sample management module 130; an operating system behavior monitoring module 140, and a behavior log management module 150, wherein:

[0047] The virtual machine scheduling and deployment module 110 is used to create a virtual machine or a cluster of virtual machines, and is responsible for scheduling and deployment. The operating system is deployed in the virtual machine. Various versions of the operating system can be deployed in the cluster, and the behavior monitoring system is deployed in the operating system. The anti-virus software is deployed in the operating system in an initial silent state through scheduling, and scanning and anti-virus are executed through scheduling. Virus malicious behavior samples are executed through scheduling.

[0048] The anti-virus software management module 120 is used to manage one or more anti-virus software and anti-virus engines, and provides interfaces such as anti-virus software deployment and scanning and anti-virus operations for the virtual machine scheduling and deployment module to deploy anti-virus software and schedule scanning and anti-virus operations. It supports multiple anti-virus software and anti-virus engines, and can conduct comparative studies on virus behaviors and anti-virus methods in multiple dimensions to find deficiencies in anti-virus software that needs to be tested.

[0049] The virus sample management module 130 is used to manage virus malicious behavior samples, organize and classify samples, and issue samples for execution and record sample information under the scheduling of the virtual machine scheduling and deployment module.

[0050] The operating system behavior monitoring module 140 is responsible for monitoring the behavior of the operating system, monitoring the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through the operating system behavior monitoring, and generating logs; the logs can be uploaded through the interface of the behavior log management module;

[0051] The behavior log management module 150 receives the behavior log information collected by the operating system behavior monitoring in the virtual machine instances of each system, and performs behavior comparison statistics on the logs to detect and judge the malicious behavior of viruses and the anti-virus effect of anti-virus software.

[0052] Figure 3 A flowchart of a testing method for detecting the antivirus effectiveness of antivirus software provided by an embodiment of the present invention.

[0053] Combination Figure 1 , Figure 3 As shown, this embodiment provides a test method for detecting the antivirus effect of antivirus software, including:

[0054] Step S210, the virtual machine scheduling and deployment module creates a virtual machine or a cluster of virtual machines, deploys an operating system in the virtual machine, various versions of the operating system can be deployed in the cluster, and the behavior monitoring system is deployed to the operating system. The antivirus software is deployed to the operating system through scheduling, scanning and antivirus are performed through scheduling, and virus malicious behavior samples are executed through scheduling.

[0055] The anti-virus software is deployed to the operating system through scheduling, and the scanning and anti-virus execution through scheduling includes:

[0056] The virtual machine scheduling and deployment module schedules the antivirus software management module; the antivirus software management module is used to manage one or more antivirus software and antivirus engines, and provides antivirus software deployment and scanning and antivirus operation interfaces for the virtual machine scheduling and deployment module to deploy antivirus software and schedule scanning and antivirus.

[0057] The malicious behaviors samples executed by scheduling include:

[0058] The virtual machine scheduling and deployment module schedules the virus sample management module. The virus sample management module is used to manage virus malicious behavior samples, organize and classify samples, and issue samples for execution and record sample information under scheduling.

[0059] Step S220: The operating system behavior monitoring module monitors the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through operating system behavior monitoring, and generates a log;

[0060] Step S230: The behavior log management module performs behavior comparison statistics on the log to detect and judge virus malicious behavior and the anti-virus effect of the anti-virus software.

[0061] Figure 4 A schematic diagram of an operating system behavior monitoring and scheduling principle provided by an embodiment of the present invention.

[0062] Cooperate Figure 4 As shown, the virtual machine scheduling and deployment module includes internal scheduling and external scheduling;

[0063] The creation, start, stop, and restore of virtual machines, as well as file and command transfers, are handled by the external dispatcher. When a user needs to create a virtual machine, the external dispatcher receives the request and creates a new virtual machine. When a user needs to start a virtual machine, the external dispatcher starts the virtual machine and returns it to the user. Similarly, when a user needs to stop a virtual machine, the external dispatcher stops the virtual machine and releases resources. When a problem occurs with a virtual machine, the external dispatcher performs a recovery operation to fix the problem.

[0064] Internal scheduling is responsible for handling tasks such as implantation of the behavior monitoring system (probe implantation), installation and execution of antivirus software, and execution of virus malicious behavior samples. When the user needs to install antivirus software, internal scheduling will download the antivirus software installation package to the virtual machine and perform the installation. When the user needs to execute the sample, internal scheduling will run the sample file in the virtual machine and record the results. In addition, internal scheduling can also implant probes to monitor the behavior and performance of the virtual machine.

[0065] Log export is also an important task, which can be completed through internal scheduling or external scheduling. When the user needs to export the log, the external scheduling can transfer the log file to the user's local computer.

[0066] See also Figure 5 The embodiment of the present invention further provides an electronic device 50, the electronic device comprising:

[0067] at least one processor; and,

[0068] a memory communicatively connected to the at least one processor; wherein,

[0069] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the test method for detecting the antivirus effect of the antivirus software in the aforementioned method embodiment.

[0070] An embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the test method for detecting the antivirus effect of antivirus software in the aforementioned method embodiment.

[0071] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the test method for detecting the antivirus effect of antivirus software in the aforementioned method embodiment.

[0072] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device 50 suitable for implementing an embodiment of the present invention. The electronic device in the embodiment of the present invention may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (such as a vehicle navigation terminal), and the like. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0073] like Figure 5 As shown, the electronic device 50 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 50 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0074] Typically, the following devices may be connected to the I / O interface 505: input devices 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 508 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 509. The communication device 509 may allow the electronic device 50 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 50 with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0075] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present invention are executed.

[0076] It should be noted that the computer-readable medium of the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0077] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0078] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0079] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A test method for detecting the antivirus effect of antivirus software, characterized in that: include: The operating system behavior monitoring module monitors the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through operating system behavior monitoring, and generates logs; The behavior log management module conducts behavior comparison statistics on the logs to detect and judge virus malicious behaviors and the anti-virus effect of anti-virus software; Before the operating system behavior monitoring module monitors the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through the operating system behavior monitoring, it also includes: The virtual machine scheduling and deployment module creates a virtual machine or a cluster of virtual machines, deploys an operating system in the virtual machine, and deploys a behavior monitoring system into the operating system. It deploys anti-virus software into the operating system through scheduling, performs scanning and anti-virus through scheduling, and executes virus and malicious behavior samples through scheduling. The step of deploying the anti-virus software to the operating system through scheduling and performing scanning and anti-virus through scheduling includes: The virtual machine scheduling and deployment module schedules the anti-virus software management module; the anti-virus software management module is used to manage one or more anti-virus software and anti-virus engines, and provides an anti-virus software deployment and scanning and anti-virus operation interface for the virtual machine scheduling and deployment module to deploy the anti-virus software and schedule scanning and anti-virus; The malicious behavior samples of viruses executed through scheduling include: The virtual machine scheduling and deployment module schedules the virus sample management module, and the virus sample management module is used to manage virus malicious behavior samples, organize and classify samples, and issue samples for execution and record sample information under scheduling.

2. The test method for detecting the antivirus effect of antivirus software according to claim 1, characterized in that: The virtual machine scheduling and deployment module includes internal scheduling and external scheduling; External scheduling is responsible for handling virtual machine creation, start / stop / recovery, file transfer, and command transmission; Internal dispatch is responsible for handling the implantation of behavior monitoring systems, installation and execution of anti-virus software, and execution of virus and malicious behavior samples; The internal scheduling or external scheduling is also responsible for log export.

3. A test system for detecting the antivirus effect of antivirus software, characterized in that: include: The operating system behavior monitoring module is configured to monitor the malicious behavior of viruses and the anti-virus software anti-virus behavior in real time through operating system behavior monitoring, and generate logs; The behavior log management module is configured to perform behavior comparison statistics on the logs to detect and judge virus malicious behaviors and the anti-virus effect of the anti-virus software; A virtual machine scheduling and deployment module is configured to create a virtual machine or a cluster of virtual machines, deploy an operating system in the virtual machine, and deploy a behavior monitoring system into the operating system, deploy anti-virus software into the operating system through scheduling, perform scanning and anti-virus through scheduling, and execute virus malicious behavior samples through scheduling; The anti-virus software management module is configured to manage one or more anti-virus software and anti-virus engines, and provide an anti-virus software deployment and scanning anti-virus operation interface for the virtual machine scheduling and deployment module to deploy the anti-virus software and schedule scanning and anti-virus; The virus sample management module is configured to manage virus malicious behavior samples, organize and classify samples, and issue samples for execution and record sample information under the scheduling of the virtual machine scheduling and deployment module.

4. An electronic device, characterized in that: The electronic device includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor executes the test method for detecting the antivirus effect of antivirus software as described in any one of claims 1 to 2.

5. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by at least one processor, cause the at least one processor to execute the test method for detecting the antivirus effect of antivirus software as claimed in any one of claims 1 to 2.

Images