Defense method and system of antivirus products in anti-killing scenarios

Abstract

The present invention discloses a defense method and system for antivirus products in a kill-free scenario, the method comprising: scanning an input file; matching the feature code in a virus library with the file content, and forming a feature code list with the successfully matched feature codes; detecting whether the successfully matched feature code is a subset of any feature code list in a database; wherein, when the successfully matched feature code is a subset of any feature code list in a database, it represents a non-first test; when the file is input for the first time, and the current feature code is not a subset of any feature code list in the database, the feature list is stored in a corresponding database. Through the processing scheme disclosed in the present invention, the challenge of targeted kill-free for antivirus software products can be effectively solved, the leading position of antivirus software products in the field of security defense can be significantly improved, and the problem of obvious defense and hidden attack in security defense can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a defense method and system for antivirus products in an anti-killing scenario. Background Art

[0002] With the frequent occurrence of network security incidents, it is crucial for anti-virus products to be able to successfully deal with the anti-killing tests of malicious code writers. These anti-killing tests are designed to fight against malicious code writers from a technical perspective. However, due to the essential characteristics of network confrontation (anti-virus software is public, while virus Trojans are usually kept secret before release), the authors of new virus Trojans will conduct anti-killing tests on popular anti-virus software, and the methods adopted by existing security products are often difficult to solve, which leads to frequent network security incidents and puts network security defenders at a disadvantage.

[0003] As for the anti-virus software’s anti-killing technology, the existing solutions include: cloud-based anti-killing and IP blocking based on upload frequency.

[0004] For cloud-based anti-virus technology, the principle is to record the number of samples uploaded by a fixed IP in a unit of time. If the number is greater than the threshold, the IP will be added to the blacklist, and no virus reporting will be performed on the blacklist users subsequently.

[0005] Although the cloud IP blacklist solution represents an important progress in the fight against anti-killing, it is still important to note that there are two major shortcomings in this solution. Disadvantage 1: Anti-killing testers will perform upload tests at different time periods. This means that if our solution only focuses on activities in a specific time period, it will also fail in other time periods. Disadvantage 2: When anti-killing testers use VPN to perform IP switching tests, there will be no short-term frequent requests from the same IP, causing the strategy to fail.

[0006] It can be seen that the above existing anti-killing test defense method still has inconveniences and defects in use, and is in urgent need of further improvement. How to create a new anti-killing test defense method has become a goal that the industry urgently needs to improve. Summary of the invention

[0007] In view of this, an embodiment of the present disclosure provides a defense method for antivirus products in an anti-virus free scenario, which at least partially solves the problems existing in the prior art.

[0008] In a first aspect, an embodiment of the present disclosure provides a method for defending an antivirus product in an anti-killing scenario, the method comprising the following steps:

[0009] Scan the input file; use the signature code in the virus database to match the file content, and form a signature code list with the successfully matched signature codes;

[0010] Detecting whether the successfully matched feature code is a subset of any feature code list in the database; wherein, when the successfully matched feature code is a subset of any feature code list in the database, it represents that it is not the first test;

[0011] When the file is input for the first time and the current feature code is not a subset of any feature code list in the database, the feature list is stored in the corresponding database.

[0012] According to a specific implementation of the embodiment of the present disclosure, when the malicious file is not input for the first time, the following steps are included:

[0013] After the test file is entered, the anti-virus engine scans and obtains the signature list;

[0014] When it is determined that the test file is a subset of any feature code list in the database, the feature code list extracted by the current scan is subjected to an OR operation with the database list to remove redundant items; wherein the database list is the feature code list previously scanned for the file and stored in the database;

[0015] Detecting whether the stored anti-virus engine scanning and obtaining signature code list is empty; wherein, when it is not empty, the current process ends;

[0016] When the stored signature list obtained by the anti-virus engine scanning is empty, the current test file is set as a bait seed file;

[0017] Extracting non-repeated character strings from the decoy seed file as threat features and adding them to a temporary feature database;

[0018] When the file is input for testing again, the system detects whether the bait feature exists. If it exists, it determines that the anti-killing test behavior has been performed.

[0019] According to a specific implementation of the embodiment of the present disclosure, the detecting whether the current feature code is a subset of any feature code list in the database includes:

[0020] Determine whether the file is being imported for the first time; wherein, when the file is being imported for the first time, the anti-virus engine generates a large number of feature codes after scanning the file, and stores the feature codes in a feature list; and,

[0021] When the file is not transmitted for the first time and the feature list is not cleared, the file is scanned by the antivirus engine and a new feature code is generated; checking whether the new feature code exists in the original feature list; if so, deleting the corresponding feature code item in the original feature list until the last feature code in the original feature list is deleted;

[0022] When the file is not being input for the first time and the signature list is cleared, the currently input file is regarded as a bait fragment of a potential threat.

[0023] According to a specific implementation of the embodiment of the present disclosure, the method further includes the following steps:

[0024] When the incoming file is not a bait marked file, a special character string is obtained as a bait feature, and the bait feature is added to a feature list database;

[0025] Cut the file, query and modify the features added to the feature list database as a bait file;

[0026] When the incoming file is a bait-marked file, it indicates that an anti-virus test is being performed.

[0027] According to a specific implementation method of the embodiment of the present disclosure, after each file is uploaded, it is checked whether the feature list is cleared; when the feature list is cleared, it indicates that an anti-killing test is being performed.

[0028] In a second aspect, an embodiment of the present disclosure provides a defense system for antivirus products in an anti-killing scenario, the system comprising:

[0029] The scanning module is configured to scan the input file; use the signature code in the virus database to match the file content, and form a signature code list with the successfully matched signature codes;

[0030] an identification module configured to detect whether the successfully matched feature code is a subset of any feature code list in the database; wherein, when the successfully matched feature code is a subset of any feature code list in the database, it represents that it is not the first test; and,

[0031] When the file is input for the first time and the current feature code is not a subset of any feature code list in the database, the feature list is stored in the corresponding database.

[0032] According to a specific implementation of the embodiment of the present disclosure, the system further includes:

[0033] The operation module is configured to scan and obtain a signature list by the anti-virus engine after the test file is input;

[0034] When it is determined that the test file is a subset of any feature code list in the database, the feature code list extracted by the current scan is subjected to an OR operation with the database list to remove redundant items; wherein the database list is the feature code list previously scanned for the file and stored in the database;

[0035] Detecting whether the stored anti-virus engine scanning and obtaining signature code list is empty; wherein, when it is not empty, the current process ends;

[0036] When the stored signature list obtained by the anti-virus engine scanning is empty, the current test file is set as a bait seed file;

[0037] Extracting non-repeated character strings from the decoy seed file as threat features and adding them to a temporary feature database;

[0038] When the file is input for testing again, the system detects whether the bait feature exists. If it exists, it determines that the anti-killing test behavior has been performed.

[0039] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0040] at least one processor; and,

[0041] a memory communicatively connected to the at least one processor; wherein,

[0042] The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor implements the defense method for antivirus products in the anti-killing scenario as described in any one of the first aspect or any one of the implementations of the first aspect.

[0043] In a fourth aspect, an embodiment of the present disclosure further provides a non-transitory computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by at least one processor, the at least one processor executes the defense method of the antivirus product in the anti-killing scenario in the aforementioned first aspect or any implementation method of the first aspect.

[0044] In the fifth aspect, the embodiments of the present disclosure also provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the defense method of the antivirus product in the anti-killing scenario in the aforementioned first aspect or any implementation method of the first aspect.

[0045] The defense method of antivirus products in the kill-free scenario in the disclosed embodiment can effectively solve the challenge of targeted kill-free for antivirus software products. The unique kill-free identification technology and efficient kill-free countermeasure strategy significantly enhance the leading position of antivirus software products in the field of security defense and effectively improve the problem of "obvious defense and hidden attack" in security defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0047] Figure 1 A flowchart of a defense method for an antivirus product in an anti-killing scenario provided by an embodiment of the present disclosure;

[0048] Figure 2 A flowchart of a defense method for an antivirus product in an anti-killing scenario provided by an embodiment of the present disclosure;

[0049] Figure 3 A schematic diagram of the working principle of an identification module provided in an embodiment of the present disclosure;

[0050] Figure 4 A schematic diagram of an anti-virus engine scanning and forming a feature list with feature codes provided by an embodiment of the present disclosure;

[0051] Figure 5 A schematic diagram of a feature list that is not input for the first time and is not cleared provided in an embodiment of the present disclosure;

[0052] Figure 6 A schematic diagram of a non-first-time input and clearing feature list provided in an embodiment of the present disclosure;

[0053] Figure 7 A schematic diagram of the working principle of a bait module provided in an embodiment of the present disclosure;

[0054] Figure 8 A schematic diagram of the defense system structure of an antivirus product in an anti-virus killing scenario provided by an embodiment of the present disclosure; and

[0055] Fig. 9 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0056] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0057] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0058] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement a device and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0059] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0060] In view of the shortcomings of the above existing solutions, this solution uses the changes in feature points to preliminarily observe the target file behavior, and then uses bait files to accurately collect the target behavior.

[0061] During the anti-killing test, the virus and Trojan authors will repeatedly upload the virus and Trojan to the anti-virus product to observe whether the scan results identify the virus and Trojan, and then modify the virus and Trojan to avoid being scanned and cleared by the anti-virus software.

[0062] An embodiment of the present invention provides a defense method for antivirus products in an anti-killing scenario, by recording feature points of scanned files, and subsequently scanning and detecting changes in feature points when the same file is uploaded. When the point changes exceed a threshold, the file is determined to be a malicious file. The anti-virus product directly extracts file features and adds them to a library. When the virus library is subsequently upgraded, the features are added as isolation features, and then restored after the safety period has expired.

[0063] This innovation cleverly copes with the known anti-killing strategies in the market through careful adjustments to the design of anti-virus products. It not only ensures the continued openness of anti-virus products, but also quickly builds a strong defense system. This innovation provides reliable protection for network security and strong support for network defenders, ensuring that network security can move forward smoothly without being troubled by threats.

[0064] Anti-virus: Malware authors use various methods and strategies to avoid detection and removal by traditional anti-virus software and security systems.

[0065] Signature points: A key technology of anti-virus software, security personnel will extract unique signs of malicious files after analyzing malware, which can be strings or binary data. In the subsequent file scan, once these special marks are found, the file will be quickly marked as a potential malicious file.

[0066] Figure 1 A schematic diagram of the process of the defense method of an antivirus product in an anti-killing scenario provided by an embodiment of the present disclosure.

[0067] Figure 2 For Figure 1 Flow chart of the antivirus product's defense method in the corresponding anti-killing scenario.

[0068] like Figure 2 As shown, the identification module is used to:

[0069] Original feature collection: When the file is uploaded for the first time, a list of features obtained by scanning is recorded.

[0070] Feature collision: The features scanned by the uploaded file are subsequently recorded, and the features in the feature list are recorded when they are involved.

[0071] Behavior determination: After each file upload, check whether the feature list is cleared. If it is cleared, it means that the target is undergoing anti-killing test.

[0072] The decoy module is used to:

[0073] Feature Extraction: Perform simple feature extraction on strings or code lists in files.

[0074] Bait features: The extracted features are used as bait for the tester to continue the anti-killing test.

[0075] Bait monitoring: monitor whether the subsequent uploaded files collide with the bait feature point first, and then process the point.

[0076] like Figure 1 As shown, at step S110, the input file is scanned; the feature codes in the virus database are used to match the file content, and the successfully matched feature codes are combined into a feature code list.

[0077] More specifically, after a malicious file is first entered, the antivirus engine will scan the file. One of the scanning strategies is to use the signature codes in the virus database to match the file content. The successfully matched signature codes form a list, which is passed to the recognition module.

[0078] More specifically, the process proceeds to step S120.

[0079] In step S120, it is detected whether the successfully matched feature code is a subset of any feature code list in the database; wherein, when the successfully matched feature code is a subset of any feature code list in the database, it represents that it is not the first test.

[0080] More specifically, in the recognition module, it is detected whether the current signature is a subset of any signature list in the database. A subset means it is not the first test; here the malicious file is input for the first time, not a subset, and this signature list is stored in the corresponding database. This process ends.

[0081] Next, go to step S130.

[0082] At step S130, when the file is input for the first time and the current feature code is not a subset of any feature code list in the database, the feature list is stored in the corresponding database.

[0083] In an embodiment of the present invention, the detection of whether the current feature code is a subset of any feature code list in a database includes: determining whether the file is being transmitted for the first time; wherein, when the file is being transmitted for the first time, the anti-virus engine generates a large number of feature codes after scanning the file, and stores the feature codes in a feature list; and, when the file is not being transmitted for the first time and the feature list is not cleared, the anti-virus engine generates a new feature code after scanning the file; checking whether the new feature code exists in the original feature list; wherein, if it exists, deleting the corresponding feature code item in the original feature list until the last feature code in the original feature list is deleted; when the file is not being transmitted for the first time and the feature list is cleared, the currently transmitted file is regarded as a bait fragment of a potential threat.

[0084] More specifically, if Figure 3 As shown, the working principle of the recognition module includes the following steps:

[0085] Step 1: Initial file transfer

[0086] like Figure 4 As shown, after the file is first scanned, the anti-virus engine will generate a large number of signatures and store them in a signature list.

[0087] Step 2: Not the first time the feature list is entered and not cleared

[0088] like Figure 5 As shown in the figure, after the file is uploaded and scanned by the anti-virus engine, some new signatures will be generated. Our system will check whether these new signatures exist in the original signature list. If they do, the system will delete the corresponding signature items in the original signature list. This process will continue to loop until the last signature in the original signature list is deleted.

[0089] Step 3: Not the first time to pass in and clear the feature list

[0090] like Figure 6As shown in the figure, the currently incoming file will be regarded as a bait fragment of a potential threat and passed to the bait module for further processing.

[0091] In an embodiment of the present invention, the method also includes the following steps: when the incoming file is not a bait marked file, obtaining a special character string as a bait feature, and adding the bait feature to a feature list database; cutting the file, querying and modifying the feature added to the feature list database as a bait file; when the incoming file is a bait marked file, it indicates that an anti-killing test is being performed.

[0092] More specifically, if Figure 7 As shown, the working principle of the decoy module includes the following steps:

[0093] Step 1: The incoming file is not a bait-marked file

[0094] Get a special string as a bait feature and add it to the feature list database. Later, the anti-killing tester will continue to cut the file to query and modify the features added to the library. At this time, the features in the library will be cleared again in the behavior recognition module, and then enter the bait module with the bait file.

[0095] Step 2: The incoming file is a bait mark file

[0096] When the incoming file is a bait file marked in the database, it means that the target person is undergoing an anti-killing test.

[0097] In an embodiment of the present invention, when a malicious file is not input for the first time, the following steps are included: after the test file is input, the anti-virus engine scans to obtain a feature code list; when it is determined that the test file is a subset of any feature code list in a database, the feature code list extracted by this scan is combined with the database list for OR operation to remove redundant items; wherein the database list is the feature code list that was previously scanned and stored in the database for the file; it is detected whether the stored feature code list obtained by the anti-virus engine scan is empty; wherein, when it is not empty, the current process ends; when the stored feature code list obtained by the anti-virus engine scan is empty, the current test file is set as a bait seed file; non-repeated strings in the bait seed file are extracted as threat features and added to a temporary feature database; when the file is input for testing again, it is detected whether the bait feature exists, and if it exists, the anti-killing test behavior is determined.

[0098] More specifically, when the malicious file is not input for the first time, the following steps are included:

[0099] (1) After the malicious file is input, the anti-virus engine also scans to obtain the signature list and uploads the signature list to the recognition module.

[0100] (2) The recognition module determines that the file is a subset of the previous feature list, and performs an “OR operation” on the list and the database list to remove redundant items.

[0101] (3) Check whether the feature list is empty. If it is not empty, the current process ends.

[0102] (4) If the feature list is empty, set the current test file as the bait seed file and transfer the file to the bait module

[0103] (5) In the decoy module, non-repeating strings in the file are extracted and added to the temporary feature database as threat features.

[0104] (6) When the file is input for testing again, the presence of the bait feature is detected. If it is present, the anti-killing test behavior is determined.

[0105] In the embodiment of the present invention, after each file upload, it is checked whether the feature list is cleared; when the feature list is cleared, it indicates that an anti-killing test is being performed.

[0106] The anti-killing identification technology includes: firstly, preliminary feature identification is performed through feature point collision, and then some decoy features are added to the potential anti-killing fragments. Then, it is monitored whether the target attempts to remove these decoy features. In this way, it is determined whether the target is undergoing anti-killing testing.

[0107] Figure 8 The defense system 800 of the antivirus product in the anti-killing scenario provided by the present invention is shown, including a scanning module 810 and an identification module 820 .

[0108] The scanning module 810 is used to scan the input file; use the feature code in the virus database to match the file content, and form a feature code list with the successfully matched feature codes;

[0109] The identification module 820 is used to detect whether the successfully matched feature code is a subset of any feature code list in the database; wherein, when the successfully matched feature code is a subset of any feature code list in the database, it represents that it is not the first test; and,

[0110] When the file is input for the first time and the current feature code is not a subset of any feature code list in the database, the feature list is stored in the corresponding database.

[0111] In an embodiment of the present invention, the system further includes:

[0112] The operation module is configured to scan and obtain a signature list by the anti-virus engine after the test file is input;

[0113] When it is determined that the test file is a subset of any feature code list in the database, the feature code list extracted by the current scan is subjected to an OR operation with the database list to remove redundant items; wherein the database list is the feature code list previously scanned for the file and stored in the database;

[0114] Detecting whether the stored anti-virus engine scanning and obtaining signature code list is empty; wherein, when it is not empty, the current process ends;

[0115] When the stored signature list obtained by the anti-virus engine scanning is empty, the current test file is set as a bait seed file;

[0116] Extracting non-repeated character strings from the decoy seed file as threat features and adding them to a temporary feature database;

[0117] When the file is input for testing again, the system detects whether the bait feature exists. If it exists, it determines that the anti-killing test behavior has been performed.

[0118] See also Fig. 9 The present disclosure also provides an electronic device 90, which includes:

[0119] at least one processor; and,

[0120] a memory communicatively connected to the at least one processor; wherein,

[0121] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the defense method of the antivirus product in the anti-killing scenario in the aforementioned method embodiment.

[0122] The embodiment of the present disclosure also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the defense method of the antivirus product in the anti-killing scenario in the aforementioned method embodiment.

[0123] The embodiments of the present disclosure also provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the defense method of the antivirus product in the anti-killing scenario in the aforementioned method embodiment.

[0124] Reference below Fig. 9, which shows a schematic diagram of the structure of an electronic device 90 suitable for implementing the embodiment of the present disclosure. The electronic device in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0125] like Fig. 9 As shown, the electronic device 90 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage device 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the electronic device 90 are also stored. The processing device 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0126] Typically, the following devices may be connected to the I / O interface 905: input devices 906 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 907 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 908 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 909. The communication device 909 may allow the electronic device 90 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 90 with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0127] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 909, or installed from a storage device 908, or installed from a ROM 902. When the computer program is executed by the processing device 901, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0128] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0129] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0130] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains at least two Internet Protocol addresses; sends a node evaluation request including the at least two Internet Protocol addresses to a node evaluation device, wherein the node evaluation device selects an Internet Protocol address from the at least two Internet Protocol addresses and returns it; receives the Internet Protocol address returned by the node evaluation device; wherein the obtained Internet Protocol address indicates an edge node in a content distribution network.

[0131] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: receives a node evaluation request including at least two Internet Protocol addresses; selects an Internet Protocol address from the at least two Internet Protocol addresses; and returns the selected Internet Protocol address; wherein the received Internet Protocol address indicates an edge node in a content distribution network.

[0132] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0133] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0134] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0135] It should be understood that various parts of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.

[0136] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A defense method for antivirus products in a kill-free scenario, characterized in that: The method comprises the following steps: Scan the input file; use the signature code in the virus database to match the file content, and form a signature code list with the successfully matched signature codes; Detecting whether the successfully matched feature code is a subset of any feature code list in the database; wherein, when the successfully matched feature code is a subset of any feature code list in the database, it represents that it is not the first test; When the file is input for the first time and the current feature code is not a subset of any feature code list in the database, the feature list is stored in the corresponding database; When the malicious file is not input for the first time, the following steps are included: After the test file is entered, the anti-virus engine scans and obtains the signature list; When it is determined that the test file is a subset of any feature code list in the database, the feature code list extracted by the current scan is subjected to an OR operation with the database list to remove redundant items; wherein the database list is the feature code list previously scanned for the file and stored in the database; Detecting whether the stored anti-virus engine scanning and obtaining signature code list is empty; wherein, when it is not empty, the current process ends; When the stored signature list obtained by the anti-virus engine scanning is empty, the current test file is set as a bait seed file; Extracting non-repeated character strings from the decoy seed file as threat features and adding them to a temporary feature database; When the file is input for testing again, the system detects whether the bait feature exists. If it exists, it determines that the anti-killing test behavior has been performed.

2. The method for defending against virus in the anti-virus scenario according to claim 1, characterized in that: The detecting whether the current feature code is a subset of any feature code list in the database includes: Determine whether the file is being imported for the first time; wherein, when the file is being imported for the first time, the anti-virus engine generates a large number of feature codes after scanning the file, and stores the feature codes in a feature list; and, When the file is not transmitted for the first time and the feature list is not cleared, the file is scanned by the antivirus engine and a new feature code is generated; checking whether the new feature code exists in the original feature list; if so, deleting the corresponding feature code item in the original feature list until the last feature code in the original feature list is deleted; When the file is not being input for the first time and the signature list is cleared, the currently input file is regarded as a bait fragment of a potential threat.

3. The method for defending against virus in the anti-virus scenario according to claim 2, characterized in that: The method further comprises the following steps: When the incoming file is not a bait marked file, a special character string is obtained as a bait feature, and the bait feature is added to a feature list database; Cut the file, query and modify the features added to the feature list database as a bait file; When the incoming file is a bait-marked file, it indicates that an anti-virus test is being performed.

4. The method for defending against virus in the anti-virus scenario according to any one of claims 1 to 3, characterized in that: After each file upload, check whether the feature list is cleared; if the feature list is cleared, it means that the anti-killing test is in progress.

5. A defense system for antivirus products in a kill-free scenario, characterized in that: The system comprises: The scanning module is configured to scan the input file; use the signature code in the virus database to match the file content, and form a signature code list with the successfully matched signature codes; an identification module configured to detect whether the successfully matched feature code is a subset of any feature code list in the database; wherein, when the successfully matched feature code is a subset of any feature code list in the database, it represents that it is not the first test; and, When the file is input for the first time and the current feature code is not a subset of any feature code list in the database, the feature list is stored in the corresponding database; The operation module is configured to scan and obtain a signature list by the anti-virus engine after the test file is input; When it is determined that the test file is a subset of any feature code list in the database, the feature code list extracted by the current scan is subjected to an OR operation with the database list to remove redundant items; wherein the database list is the feature code list previously scanned for the file and stored in the database; Detecting whether the stored anti-virus engine scanning and obtaining signature code list is empty; wherein, when it is not empty, the current process ends; When the stored signature list obtained by the anti-virus engine scanning is empty, the current test file is set as a bait seed file; Extracting non-repeated character strings from the decoy seed file as threat features and adding them to a temporary feature database; When the file is input for testing again, the system detects whether the bait feature exists. If it exists, it determines that the anti-killing test behavior has been performed.

6. An electronic device, characterized in that: The electronic device includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor executes the defense method of the antivirus product in the anti-killing scenario as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by at least one processor, cause the at least one processor to execute the defense method for antivirus products in the anti-killing scenario as described in any one of claims 1 to 4.

Images