A server disinfection method, device, equipment and medium

Abstract

The application discloses a server disinfection method, device, equipment and medium, and relates to the technical field of computers.The server disinfection method creates a corresponding memory image for the memory system of a target operating system, and performs virus identification on the memory image; at this time, the target operating system can be in a closed state to avoid virus running, and thus the thoroughness of disinfection is ensured; in addition, the virus existing in the memory image is determined according to the virus dimension; at this time, virus identification can be performed without relying on a virus library, the limitation of virus identification is avoided, and thus the security of the computer system is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a server disinfection method, device, equipment and medium. BACKGROUND

[0002] The computer system can install multiple system software (also known as operating system), and each system software has all the disk functions stored in the corresponding memory system, and each disk function is run by the server driver program corresponding to the disk function. However, in the process of executing the disk function by the server driver operating system, it is inevitable to be invaded by viruses. It can be understood that the virus at this time also parasitizes in the disk function program in the form of program to realize running. When there is a virus in the computer system, the existing disinfection method is to avoid the invasion of the virus to the computer system by manually running the disinfection software. However, such disinfection method needs the operating system to keep working state. When the operating system is in working state and runs the disk function program, the virus program will be run first and then the disk function program (host program) where the virus exists. At this time, no matter how, the virus program will be run first and then the disinfection will be carried out, which cannot guarantee the thoroughness of disinfection, and if there is a virus that escapes the net, it will cause harm to the computer system.

[0003] In view of the above problems, how to guarantee the thoroughness of disinfection and the security of the computer system is a problem that the person skilled in the art strives to solve. SUMMARY

[0004] The purpose of the present application is to provide a server disinfection method, device, equipment and medium, which can solve the problem that the virus program will run first and the host program cannot guarantee the thoroughness of disinfection and the security of the computer system.

[0005] To solve the above technical problems, the present application provides a server disinfection method, which is applied to a server installed with multiple operating systems, and the method comprises the following steps:

[0006] Determine the target operating system; create a corresponding memory image for the memory system of the target operating system; the memory image stores all the disk functions corresponding to the disks;

[0007] Mount all the disk functions to the directory of the memory image;

[0008] Call the virus identification function to obtain multiple virus dimensions;

[0009] Determine the entropy sum based on the virus dimensions;

[0010] Compare the entropy sum with the preset value representing the risk degree of the virus to obtain a comparison result;

[0011] determining that the virus exists in the memory image according to the comparison result;

[0012] traversing the directory and determining a location path of the virus;

[0013] killing the virus according to the location path.

[0014] In another aspect, the virus identification function is called to obtain a plurality of virus dimensions, including:

[0015] The virus identification function is called to find all system files;

[0016] The first virus dimension is found in the system files, wherein the first virus dimension is a characteristic code representing a virus type;

[0017] The first entropy value corresponding to the first virus dimension is determined according to the characteristic code;

[0018] The virus identification function is called to obtain a timing task file;

[0019] The second virus dimension is found in the timing task file, wherein the second virus dimension is a correlation degree representing a virus file and a timing task file;

[0020] The second entropy value corresponding to the second virus dimension is determined according to the correlation degree;

[0021] The virus identification function is called to find all network files;

[0022] The third virus dimension is found in the network files, wherein the third virus dimension represents a number of ports opened by a fixed port;

[0023] The third entropy value corresponding to the third virus dimension is determined according to the number of ports;

[0024] The virus identification function is called to find an execution action of the virus; and a storage path of a target service is obtained;

[0025] The fourth virus dimension is found in the storage path of the target service, wherein the fourth virus dimension represents that a storage path of the execution action exists in the storage path of the target service;

[0026] The fourth entropy value corresponding to the fourth virus dimension is determined according to the storage path of the execution action.

[0027] In another aspect, the entropy value is determined based on the virus dimension, and includes:

[0028] A preset weight distribution table of the first virus dimension, the second virus dimension, the third virus dimension, and the fourth virus dimension is obtained;

[0029] determining a first weight coefficient corresponding to the first virus dimension, a second weight coefficient corresponding to the second virus dimension, a third weight coefficient corresponding to the third virus dimension, and a fourth weight coefficient corresponding to the fourth virus dimension in the weight distribution table;

[0030] determining a first virus dimension total entropy value according to the first entropy value and the first weight coefficient;

[0031] determining a second virus dimension total entropy value according to the second entropy value and the second weight coefficient;

[0032] determining a third virus dimension total entropy value according to the third entropy value and the third weight coefficient;

[0033] determining a fourth virus dimension total entropy value according to the fourth entropy value and the fourth weight coefficient;

[0034] adding the first virus dimension total entropy value, the second virus dimension total entropy value, the third virus dimension total entropy value, and the fourth virus dimension total entropy value to obtain an entropy sum.

[0035] On the other hand, comparing the entropy sum with a preset value representing the virus risk degree to obtain a comparison result, the comparison result comprising:

[0036] setting a first preset value representing the virus risk degree;

[0037] determining whether the entropy sum is greater than the first preset value;

[0038] correspondingly, determining that the virus exists in the memory image according to the comparison result, the determining that the virus exists in the memory image comprising:

[0039] if the entropy sum is greater than the first preset value, determining that the virus exists in the memory image;

[0040] if the entropy sum is not greater than the first preset value, determining that the virus does not exist in the memory image.

[0041] On the other hand, after determining that the virus exists in the memory image, further comprising:

[0042] setting a second preset value representing the virus risk degree as a network risk, a third preset value representing the virus risk degree as a virus risk, and a fourth preset value representing the virus risk degree as determining that the virus exists;

[0043] determining whether the entropy sum is greater than the first preset value and not greater than the second preset value;

[0044] if the entropy sum is greater than the first preset value and not greater than the second preset value, determining that the virus risk degree is the network risk;

[0045] determining whether the entropy sum is greater than the second preset value and not greater than the third preset value;

[0046] If the entropy sum is greater than the second preset value and is not greater than the third preset value, it is determined that the virus risk degree is virus risk.

[0047] It is judged whether the entropy sum is greater than the third preset value and is not greater than the fourth preset value.

[0048] If the entropy sum is greater than the third preset value and is not greater than the fourth preset value, it is determined that the virus risk degree is virus risk.

[0049] On the other hand, after determining that there is a virus in the memory image according to the comparison result, it further comprises:

[0050] Obtain the virus library in the memory system corresponding to the target operating system;

[0051] Add the virus determined according to the comparison result to the virus library to obtain a new virus library;

[0052] Update the virus library of other operating systems based on the new virus library.

[0053] On the other hand, updating the virus library of other operating systems based on the new virus library comprises:

[0054] Limit the authority of the virus in the target operating system;

[0055] Obtain the file basic information of the virus;

[0056] According to the file basic information, traverse other operating systems;

[0057] When the file basic information is found in other operating systems, the virus corresponding to the file basic information is killed.

[0058] To solve the above technical problems, the present application also provides a server virus killing device, which is applied to a server installed with multiple operating systems, and the device comprises:

[0059] A first determination module is used to determine a target operating system, create a corresponding memory image for the memory system of the target operating system, and store all disk functions corresponding to the disks in the memory image;

[0060] A mounting module is used to mount all the disk functions to the directory of the memory image;

[0061] A first calling module is used to call a virus identification function to obtain multiple virus dimensions;

[0062] A second determination module is used to determine an entropy sum based on the virus dimensions;

[0063] A comparison module is used to compare the entropy sum with preset values representing virus risk degrees to obtain a comparison result;

[0064] A third determining module is configured to determine the virus existing in the memory image according to the comparison result.

[0065] A first traversing module is configured to traverse the directory and determine the location path of the virus.

[0066] A first killing module is configured to kill the virus according to the location path.

[0067] To solve the above technical problems, the application further provides a server disinfection device, comprising:

[0068] A memory is configured to store a computer program.

[0069] A processor is configured to point to the computer program and implement the steps of the server disinfection method.

[0070] To solve the above technical problems, the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the server disinfection method.

[0071] The server disinfection method provided by the application creates a corresponding memory image for the memory system of the target operating system, and identifies the virus in the memory image, so that the target operating system can be in a closed state to avoid the running of the virus, thereby ensuring the thoroughness of disinfection. In addition, the virus existing in the memory image is determined according to the virus dimension, so that the virus identification can be performed without relying on the virus library, thereby avoiding the limitation of virus identification and ensuring the security of the computer system.

[0072] In addition, in order to ensure the accuracy of virus identification, corresponding entropy values and weight values are respectively set to determine the entropy values used for virus risk assessment, so as to determine the four risks of the virus, so as to determine the presence of the virus in the computer system after determining that the virus meets the required risk, and to accurately kill the virus.

[0073] The application further provides a server disinfection device, equipment and medium, which have the same effect as above. BRIEF DESCRIPTION OF DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0075] Figure 1 A server disinfection method flowchart provided by the embodiments of the application;

[0076] Figure 2 A schematic diagram of an architecture of a computer system provided by an embodiment of the present application is shown in

[0077] Figure 3 A schematic diagram of a virus killing method of a server provided by an embodiment of the present application is shown in

[0078] Figure 4 A structural diagram of a virus killing device of a server provided by an embodiment of the present application is shown in

[0079] Figure 5 A structural diagram of a virus killing device of a server provided by an embodiment of the present application is shown in DETAILED DESCRIPTION

[0080] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0081] The core of the present application is to provide a virus killing method, device, equipment and medium of a server, which can ensure the thoroughness of virus killing and the security of a computer system.

[0082] In order to enable the persons in the technical field to better understand the present application scheme, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0083] Figure 1 A flowchart of a virus killing method of a server provided by an embodiment of the present application is shown in Figure 1 The virus killing method of the server is applied to a server installed with multiple operating systems, and the method comprises the following steps.

[0084] S10: determining a target operating system; creating a corresponding memory image for a memory system of the target operating system; the memory image stores disk functions corresponding to all disks;

[0085] It should be noted that a server is arranged in the computer system, and the server can control the operating system to execute corresponding services. One server can control multiple operating systems at the same time. The memory image is obtained by compiling a kernel program of the target operating system, and the virus identification function is integrated into the server.

[0086] Figure 2 A schematic diagram of an architecture of a computer system provided by an embodiment of the present application is shown in Figure 2As shown, the operating system can be a Community Enterprise Operating System (CentOS), Ubuntu, or Red Hat Enterprise Linux. In addition, the server in this embodiment is a data processing server of a data center, but it can be understood that the data processing server not only performs data processing functions, but also schedules and manages other services. Therefore, the target operating system can be any one of CentOS, Ubuntu, or Red Hat Enterprise Linux.

[0087] S11: Mount all disk functions to the directory of the memory image.

[0088] In order to perform the virus killing operation, the target operating system needs to be in a closed state (it can be understood that the closed state means that the target operating system does not perform any operation and does not perform any business). Therefore, in order to kill the virus of the current target operating system, the virus needs to be set to static (here, static means that the virus program exists in the host program, but the virus program does not run because the target operating system is in a closed state). Since all programs are used to execute all disk functions in the memory system, all disk functions need to be mounted to the memory image. In order to facilitate the management of disk functions, all disk functions are integrated into a directory, and the storage location of the directory is the memory image.

[0089] S12: Call the virus identification function to obtain a plurality of virus dimensions.

[0090] It should be noted that the virus identification function is used to find viruses in the programs corresponding to all disk functions and kill them. In some embodiments, the user can determine the number of virus dimensions obtained by modifying the corresponding program script. In this embodiment, the number of virus dimensions is not limited.

[0091] S13: Determine the entropy value based on the virus dimension.

[0092] According to the virus dimension, it can be determined whether the characteristics of the virus appearing in the current program meet the value of the virus affecting the host program. When it meets, the entropy value is 100, and when it does not meet, the entropy value is 50. It can be understood that the specific value of the entropy value can be determined according to the specific embodiment, and in this embodiment, it is not limited.

[0093] S14: Compare the entropy value with a preset value representing the risk degree of the virus to obtain a comparison result.

[0094] S15: determining that the virus exists in the memory image according to the comparison result;

[0095] It can be understood that when the entropy value in a program corresponding to a certain disk function reaches the preset value representing the risk degree of the virus, the program can be referred to as a host program, and the storage path of the host program is searched in the directory in the memory image. Further, the position of the virus in the host program can be determined.

[0096] S16: traversing the directory and determining the position path of the virus;

[0097] S17: killing the virus according to the position path.

[0098] In the embodiment, the corresponding memory image is created by the memory system of the target operating system, and the virus is identified in the memory image. At this time, the target operating system can be in a closed state to avoid the running of the virus, thereby ensuring the thoroughness of the virus killing. In addition, the virus existing in the memory image is determined according to the virus dimension, so that the virus identification can be performed without relying on the virus library, thereby avoiding the limitation of the virus identification and ensuring the security of the computer system.

[0099] In addition, it should be noted that when it is determined that the virus exists in the target operating system, in order to determine the specific position of the virus in the host program, the position of a symbol representing the start of execution of the virus program in the host program can also be determined. The virus program can be set at the start point, the intermediate point and the end point of the host program. The order of determining the position of the virus program in the host program is the start point, the intermediate point and the end point in sequence. Specifically:

[0100] determining whether the symbol representing the start of execution of the virus program is set at the start point of the host program;

[0101] if the symbol representing the start of execution of the virus program is set at the start point of the host program, the position of the virus program is outputted;

[0102] if the symbol representing the start of execution of the virus program is not set at the start point of the host program, it is determined whether the symbol representing the start of execution of the virus program is set at the intermediate point of the host program;

[0103] if the symbol representing the start of execution of the virus program is set at the intermediate point of the host program, the position of the virus program is outputted;

[0104] if the symbol representing the start of execution of the virus program is not set at the intermediate point of the host program, it is determined whether the symbol representing the start of execution of the virus program is set at the end point of the host program;

[0105] if the symbol representing the start of execution of the virus program is set at the end point of the host program, the position of the virus program is outputted;

[0106] if the symbol representing the start of execution of the virus program is not set at the end point of the host program, the process is ended.

[0107] In some embodiments, four virus dimensions are provided, and the virus identification function is called to obtain the virus dimensions, including:

[0108] The virus identification function is called to find all system files.

[0109] The first virus dimension is found in the system files, wherein the first virus dimension is a characteristic code representing a virus type.

[0110] The first entropy value corresponding to the first virus dimension is determined according to the characteristic code.

[0111] In this embodiment, Table 1 is a first virus dimension information table, and the instruction for finding the first virus dimension can be represented as: Find / usr / local / *-type f-name “*.php” | xargs grep “eval(“>wwroot / eval.txt; there are three types of viruses found at this time, the first type is a backdoor virus, and the characteristic code corresponding to the backdoor virus is Cha88.cn, c99shell, phpspy, scanners, cmd.php, str_rot13, webshell; the second type is a suspicious code feature, and the characteristic code corresponding to the suspicious code feature is System(, passthru(, exec(, popen(, Proc_open(; the third type is an encrypted backdoor feature, and the characteristic code corresponding to the encrypted backdoor feature is Eval(gzinflate;

[0112] Table 1 is a first virus dimension information table

[0113]

[0114] The virus identification function is called to obtain the timing task file.

[0115] The second virus dimension is found in the timing task file, wherein the second virus dimension is a correlation degree representing a virus file and a timing task file.

[0116] The second entropy value corresponding to the second virus dimension is determined according to the correlation degree.

[0117] In this embodiment, the correlation degree with the timing task file can be determined by a user-defined formula. During the execution of the server, the server will set a timing task from beginning to end, and at least one folder corresponding to the timing task will be established to store the time length of the timer corresponding to each business. At this time, in order to ensure the accurate control of the server on the timing, prevent it from being affected and tampered by viruses, the correlation degree with the timing task file needs to be evaluated.

[0118] The virus identification function is called to find all network files.

[0119] finding a third virus dimension in the network file; wherein the third virus dimension represents a number of ports of the fixed ports being opened;

[0120] determining a third entropy value corresponding to the third virus dimension according to the number of ports;

[0121] calling a virus identification function to find an execution action of the virus; and obtaining a storage path of the target service;

[0122] It should be noted that, in the present embodiment, the virus dimension to be concerned is the fixed port, at this time, the setting conditions related to the port are all stored in the configuration file in the network file, in the configuration file, the fixed port is the irregular port, and the number of the irregular ports being opened needs to be counted in the configuration file, Table 2 is a third virus dimension information table, as shown in Table 2, the port with the serial number 7 and the port number 10000 is the irregular port, at this time, the port is affected by the backdoor virus;

[0123] Table 2 third virus dimension information table

[0124] Serial number Port number Remarks 1 872 Hacker 2 9873 Hacker 3 9874 Hacker 4 9898 Hacker 5 9999 No 6 9996 No 7 10000 Backdoor …… …… …… n 10000+n No

[0125] finding a fourth virus dimension in the storage path of the target service; wherein the fourth virus dimension represents that the storage path of the execution action exists in the storage path of the target service;

[0126] determining a fourth entropy value corresponding to the fourth virus dimension according to the storage path of the execution action.

[0127] In the present embodiment, the virus program will execute a key action (at this time, the key action can be understood as a certain program symbol or program statement), and the key action is stored in the script of the virus program, in the server, the storage path of the client service can be pre-set, and the key action of the virus program is found in the storage path of the client service, if the key action of the virus program exists in the storage path of the client service, at this time, the fourth entropy value is determined to be 100, it can be understood that the numerical value of the entropy value can be set to the maximum upper limit value according to the specific embodiment, Table 3 is a fourth virus dimension information table, as shown in the following table:

[0128] Table 3 fourth virus dimension information table

[0129]

[0130]

[0131] In some embodiments, determining the entropy value based on the virus dimension comprises:

[0132] Obtain the preset weight allocation table for the first virus dimension, the second virus dimension, the third virus dimension, and the fourth virus dimension;

[0133] In the weight allocation table, determine the first weight coefficient corresponding to the first virus dimension, the second weight coefficient corresponding to the second virus dimension, the third weight coefficient corresponding to the third virus dimension, and the fourth weight coefficient corresponding to the fourth virus dimension.

[0134] It is understandable that in the weight allocation table, the first weight coefficient is determined to be 0.2, the second weight coefficient is 0.2, the third weight coefficient is 0.25, and the fourth weight coefficient is 0.35; at this time, it can be seen that the fourth weight coefficient corresponding to the fourth virus dimension has the largest proportion.

[0135] Additionally, it should be noted that for all the entropy values ​​mentioned above, there are only three implementations for each entropy value: entropy value 100, entropy value 50, and entropy value 0.

[0136] The total entropy value of the first virus dimension is determined based on the first entropy value and the first weighting coefficient.

[0137] The total entropy value of the second virus dimension is determined based on the second entropy value and the second weighting coefficient.

[0138] The total entropy value of the third virus dimension is determined based on the third entropy value and the third weighting coefficient.

[0139] The total entropy value of the fourth virus dimension is determined based on the fourth entropy value and the fourth weighting coefficient.

[0140] The total entropy values ​​of the first virus dimension, the second virus dimension, the third virus dimension, and the fourth virus dimension are summed to obtain the total entropy value.

[0141] The formula for obtaining the sum of entropy values ​​is as follows:

[0142] Value_file = 0.2 * value (signature) + 0.2 * value (cron) + 0.25 * value (port) + 0.35 * value (action);

[0143] Where Value_file is the sum of entropy values, the first weight coefficient is 0.2, the second weight coefficient is 0.2, the third weight coefficient is 0.25, the fourth weight coefficient is 0.35, value(feature code) is the first entropy value, value(cron) is the second entropy value, value(port) is the third entropy value, and value(action) is the fourth entropy value;

[0144] The comparison results, obtained by comparing the entropy value with a preset value representing the degree of virus risk, include:

[0145] setting a first preset value representing a degree of virus risk;

[0146] judging whether the entropy sum is greater than the first preset value;

[0147] Correspondingly, determining that the virus exists in the memory image according to the comparison result includes:

[0148] If the entropy sum is greater than the first preset value, it is determined that the virus exists in the memory image.

[0149] If the entropy sum is not greater than the first preset value, it is determined that the virus does not exist in the memory image.

[0150] In this embodiment, the first preset value is set to 25. When the entropy sum is not greater than 25, it is determined that the virus does not exist in the computer system, and no virus killing operation is needed. When the entropy sum is greater than 25, it is determined that the virus exists in the computer system, and the virus killing operation is needed.

[0151] In addition, after it is determined that the virus exists in the memory image, the method further includes:

[0152] setting a second preset value representing a degree of network risk, a third preset value representing a degree of virus risk, and a fourth preset value representing a determination of the existence of the virus;

[0153] In this embodiment, the second preset value is set to 50, the third preset value is set to 75, and the fourth preset value is set to 100.

[0154] judging whether the entropy sum is greater than the first preset value and not greater than the second preset value;

[0155] If the entropy sum is greater than the first preset value and not greater than the second preset value, it is determined that the degree of virus risk is the network risk.

[0156] judging whether the entropy sum is greater than the second preset value and not greater than the third preset value;

[0157] If the entropy sum is greater than the second preset value and not greater than the third preset value, it is determined that the degree of virus risk is the virus risk.

[0158] judging whether the entropy sum is greater than the third preset value and not greater than the fourth preset value;

[0159] If the entropy sum is greater than the third preset value and not greater than the fourth preset value, it is determined that the degree of virus risk is the determination of the existence of the virus.

[0160] For this embodiment, Table 4 is a fourth virus dimension information table, as shown in the following table:

[0161] Table 4 Virus Risk Degree Determination Table

[0162] Serial number Entropy value and Virus risk degree 1 0-25 Presence of virus 2 25-50 Network risk 3 50-75 Virus risk 4 75-100 Determination of presence of virus

[0163] In some embodiments, after determining that there is a virus in the memory image according to the comparison result, further comprising:

[0164] Obtaining a virus library in a memory system corresponding to the target operating system;

[0165] Adding the virus determined according to the comparison result to the virus library to obtain a new virus library;

[0166] Updating the virus library of other operating systems based on the new virus library.

[0167] Wherein, updating the virus library of other operating systems based on the new virus library comprises:

[0168] Restricting the authority of the virus in the target operating system;

[0169] Obtaining file basic information of the virus;

[0170] Traversing other operating systems according to the file basic information;

[0171] When the file basic information is found in other operating systems, killing the virus corresponding to the file basic information.

[0172] Figure 3 A server disinfection method provided by the embodiment of the application is shown in a schematic diagram as shown in Figure 3 The steps of the disinfection method schematic diagram are as follows:

[0173] S30: starting the memory image created by the memory system of the target operating system;

[0174] S31: determining that the memory image is started, and calling a virus identification function;

[0175] S32: obtaining multiple virus dimensions through the virus identification function;

[0176] S33: determining a preset value representing the risk degree of the virus based on the virus dimensions;

[0177] S34: determining the virus existing in the memory image according to the preset value representing the risk degree of the virus;

[0178] S35: killing the virus in the memory image.

[0179] At this time, the memory image corresponding to the memory system of the target operating system is created, and virus identification is performed on the memory image, at this time, the target operating system can be in a closed state to avoid the running of the virus, and the thoroughness of the virus killing is ensured; in addition, the virus existing in the memory image is determined according to the virus dimension, at this time, the virus identification can be performed without relying on the virus library, the limitation of the virus identification is avoided, and the security of the computer system is ensured.

[0180] In the above embodiment, the server virus killing method is described in detail, and the present application also provides a corresponding server virus killing device. It should be noted that the present application describes the embodiment of the device from two angles, one is based on the functional module, and the other is based on the hardware.

[0181] Figure 4 A server virus killing device structure diagram provided by the embodiment of the present application is shown in FIG. 1, and the present application also provides a server virus killing device, which is applied to a server installed with multiple operating systems, and the device comprises: Figure 4

[0182] A first determining module 40 is configured to determine a target operating system, create a corresponding memory image for a memory system of the target operating system, and store all disk functions corresponding to the disks in the memory image;

[0183] A mounting module 41 is configured to mount all the disk functions to a directory of the memory image;

[0184] A first calling module 42 is configured to call a virus identification function to obtain multiple virus dimensions;

[0185] A second determining module 43 is configured to determine an entropy sum based on the virus dimensions;

[0186] A comparison module 44 is configured to compare the entropy sum with a preset value representing the risk degree of the virus to obtain a comparison result;

[0187] A third determining module 45 is configured to determine whether there is a virus in the memory image according to the comparison result;

[0188] A first traversal module 46 is configured to traverse the directory and determine the location path of the virus;

[0189] A first killing module 47 is configured to kill the virus according to the location path.

[0190] In addition, the device further comprises the following modules:

[0191] In some embodiments, the virus identification function is called to obtain the multiple virus dimensions, and the virus identification function comprises:

[0192] ​The second calling module is configured to call the virus identification function to find all system files;

[0193] The first finding module is configured to find a first virus dimension in the system files, wherein the first virus dimension is a characteristic code representing a virus type;

[0194] The fourth determining module is configured to determine a first entropy value corresponding to the first virus dimension according to the characteristic code;

[0195] The third calling module is configured to call the virus identification function to obtain a scheduled task file;

[0196] The second finding module is configured to find a second virus dimension in the scheduled task file, wherein the second virus dimension represents an association degree between a virus file and the scheduled task file;

[0197] The fifth determining module is configured to determine a second entropy value corresponding to the second virus dimension according to the association degree;

[0198] The fourth calling module is configured to call the virus identification function to find all network files;

[0199] The third finding module is configured to find a third virus dimension in the network files, wherein the third virus dimension represents a number of open fixed ports;

[0200] The sixth determining module is configured to determine a third entropy value corresponding to the third virus dimension according to the number of ports;

[0201] The fifth calling module is configured to call the virus identification function to find an execution action of the virus, and obtain a storage path of a target service;

[0202] The fourth finding module is configured to find a fourth virus dimension in the storage path of the target service, wherein the fourth virus dimension represents that a storage path of the execution action exists in the storage path of the target service;

[0203] The seventh determining module is configured to determine a fourth entropy value corresponding to the fourth virus dimension according to the storage path of the execution action.

[0204] In some embodiments, determining the entropy value based on the virus dimension comprises:

[0205] The first obtaining module is configured to obtain a preset weight distribution table of the first virus dimension, the second virus dimension, the third virus dimension, and the fourth virus dimension;

[0206] The eighth determining module is configured to determine, in the weight distribution table, a first weight coefficient corresponding to the first virus dimension, a second weight coefficient corresponding to the second virus dimension, a third weight coefficient corresponding to the third virus dimension, and a fourth weight coefficient corresponding to the fourth virus dimension;

[0207] a ninth determining module configured to determine a first virus dimension total entropy value according to the first entropy value and a first weight coefficient;

[0208] a tenth determining module configured to determine a second virus dimension total entropy value according to the second entropy value and a second weight coefficient;

[0209] an eleventh determining module configured to determine a third virus dimension total entropy value according to the third entropy value and a third weight coefficient;

[0210] a twelfth determining module configured to determine a fourth virus dimension total entropy value according to the fourth entropy value and a fourth weight coefficient;

[0211] an adding module configured to add the first virus dimension total entropy value, the second virus dimension total entropy value, the third virus dimension total entropy value and the fourth virus dimension total entropy value to obtain an entropy sum.

[0212] In some embodiments, the comparison between the entropy sum and the preset value representing the virus risk degree obtains a comparison result, which includes:

[0213] a first setting module configured to set a first preset value representing the virus risk degree;

[0214] a first judging module configured to judge whether the entropy sum is greater than the first preset value;

[0215] Correspondingly, the determination of the existence of the virus in the memory image according to the comparison result includes:

[0216] a thirteenth determining module configured to determine that the virus exists in the memory image if the entropy sum is greater than the first preset value;

[0217] a fourteenth determining module configured to determine that the virus does not exist in the memory image if the entropy sum is not greater than the first preset value.

[0218] In some embodiments, after the determination of the existence of the virus in the memory image, the method further includes:

[0219] a second setting module configured to set a second preset value representing the virus risk degree as a network risk, a third preset value representing the virus risk degree as a virus risk, and a fourth preset value representing the virus risk degree as the determination of the existence of the virus;

[0220] a second judging module configured to judge whether the entropy sum is greater than the first preset value and not greater than the second preset value;

[0221] a fifteenth determining module configured to determine that the virus risk degree is the network risk if the entropy sum is greater than the first preset value and not greater than the second preset value;

[0222] a third judging module configured to judge whether the entropy sum is greater than the second preset value and not greater than the third preset value;

[0223] The sixteenth determination module is used to determine the degree of virus risk as virus risk if the sum of entropy values ​​is greater than the second preset value and not greater than the third preset value.

[0224] The fourth judgment module is used to determine whether the entropy value is greater than the third preset value and not greater than the fourth preset value;

[0225] The seventeenth determination module is used to determine the degree of virus risk if the sum of the entropy values ​​is greater than the third preset value and not greater than the fourth preset value, thus confirming the presence of a virus.

[0226] In some embodiments, after determining that a virus exists in the memory image based on the comparison results, the method further includes:

[0227] The second acquisition module is used to acquire the virus database in the memory system corresponding to the target operating system.

[0228] The add module is used to add viruses identified based on comparison results to the virus database, resulting in a new virus database;

[0229] The update module is used to update the virus definitions of other operating systems based on the new virus definitions.

[0230] In some embodiments, updating the virus database of other operating systems based on the new virus database includes:

[0231] The permission restriction module is used to restrict permissions for viruses in the target operating system.

[0232] The third acquisition module is used to obtain basic file information of the virus.

[0233] The second traversal module is used to traverse other operating systems based on the basic information of the file;

[0234] The second detection module is used to detect and remove viruses corresponding to the basic file information when it is found in other operating systems.

[0235] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus, which will not be repeated here.

[0236] Figure 5 This is a structural diagram of a server antivirus device provided in an embodiment of the present invention, as shown below. Figure 5 As shown, a server antivirus device includes:

[0237] Memory 50 is used to store computer programs;

[0238] The processor 51 is used to execute computer programs to implement the steps of the server antivirus method mentioned in the above embodiments.

[0239] The server's disinfection device provided by the embodiment can include, but is not limited to, a smart phone, a tablet computer, a notebook computer or a desktop computer, etc.

[0240] The processor 51 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 51 can be implemented in at least one of a hardware form of a Digital Signal Processing (DSP), a Field-Programmable Gate Array (FPGA), a Programmable Logic Array (PLA). The processor 51 can also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a Central Processing Unit (CPU). The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 51 can be integrated with a Graphics Processing Unit (GPU) for rendering and drawing the content to be displayed by the display screen. In some embodiments, the processor 51 can also include an Artificial Intelligence (AI) processor for processing machine learning-related computing operations.

[0241] The memory 50 can include one or more computer-readable storage media, which can be non-transitory. The memory 50 can also include a high-speed random access memory, and a non-volatile memory such as one or more disk storage devices, flash storage devices. In the embodiment, the memory 50 is at least used to store the following computer programs, wherein the computer programs are loaded and executed by the processor 51, and can implement the related steps of the server's disinfection method disclosed in any one of the preceding embodiments. In addition, the resources stored by the memory 50 can also include an operating system and data, etc., and the storage mode can be temporary storage or permanent storage. The operating system can include Windows, Unix, Linux, etc. The data can include, but is not limited to, the server's disinfection method, etc.

[0242] In some embodiments, the server's disinfection device can also include a display screen, an input / output interface, a communication interface, a power supply and a communication bus.

[0243] Those skilled in the art can understand that the structure shown in the above embodiments does not constitute a limitation on the server's disinfection device, and can include more or fewer components than those shown in the drawings. Figure 5 The structure shown in the above embodiments does not constitute a limitation on the server's disinfection device, and can include more or fewer components than those shown in the drawings.

[0244] The server disinfection device provided by the embodiment of the present application comprises a memory 50 and a processor 51, and the processor 51 can realize the server disinfection method when executing the program stored in the memory 50.

[0245] Finally, the present application also provides an embodiment corresponding to a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps recorded in the above method embodiments.

[0246] It can be understood that if the method in the above embodiment is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and executes all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0247] The server disinfection method, device, equipment and medium provided by the present application are described in detail above. The embodiments in the specification are described in a progressive manner, and each embodiment mainly describes the differences from other embodiments. The same or similar parts of each embodiment can be referred to. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts can be referred to the method part. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, the present application can be improved and modified, and these improvements and modifications also fall within the protection scope of the claims of the present application.

[0248] It also needs to be explained that in the present specification, the relational terms such as first and second and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A method of disinfecting a server, the method comprising: The method comprises the following steps: determining a target operating system; creating a corresponding memory image for a memory system of the target operating system; the memory image storing disk functions corresponding to all disks; mounting all the disk functions to a directory of the memory image; calling a virus identification function to obtain multiple virus dimensions; determining an entropy sum based on the virus dimensions; comparing the entropy sum with a preset value representing a virus risk degree to obtain a comparison result; determining that a virus exists in the memory image according to the comparison result; traversing the directory and determining a location path of the virus; killing the virus according to the location path. The method comprises the following steps: calling the virus identification function to find all system files; finding a first virus dimension in the system files; the first virus dimension is a characteristic code representing a virus type; determining a first entropy value corresponding to the first virus dimension according to the characteristic code; calling the virus identification function to obtain a timing task file; finding a second virus dimension in the timing task file; the second virus dimension represents an association degree between a virus file and the timing task file; determining a second entropy value corresponding to the second virus dimension according to the association degree; calling the virus identification function to find all network files; finding a third virus dimension in the network files; the third virus dimension represents a number of open fixed ports; determining a third entropy value corresponding to the third virus dimension according to the number of ports; calling the virus identification function to find an execution action of the virus; and obtaining a storage path of a target service; finding a fourth virus dimension under the storage path of the target service; the fourth virus dimension represents that a storage path of the execution action exists under the storage path of the target service; determining a fourth entropy value corresponding to the fourth virus dimension according to the storage path of the execution action. The method comprises the following steps: obtaining a preset weight distribution table of the first virus dimension, the second virus dimension, the third virus dimension and the fourth virus dimension; determining a first weight coefficient corresponding to the first virus dimension, a second weight coefficient corresponding to the second virus dimension, a third weight coefficient corresponding to the third virus dimension and a fourth weight coefficient corresponding to the fourth virus dimension in the weight distribution table; determining a first virus dimension total entropy value according to the first entropy value and the first weight coefficient; determining a second virus dimension total entropy value according to the second entropy value and the second weight coefficient; determining a third virus dimension total entropy value according to the third entropy value and the third weight coefficient; determining a fourth virus dimension total entropy value according to the fourth entropy value and the fourth weight coefficient; adding the first virus dimension total entropy value, the second virus dimension total entropy value, the third virus dimension total entropy value and the fourth virus dimension total entropy value to obtain the entropy sum.

2. The method of claim 1, wherein the server is a server of a network service provider. The method comprises the following steps: setting a first preset value representing a degree of risk of the virus; determining whether the entropy sum is greater than the first preset value; correspondingly, the determining that the memory image contains the virus according to the comparison result comprises: if the entropy sum is greater than the first preset value, it is determined that the memory image contains the virus; if the entropy sum is not greater than the first preset value, it is determined that the memory image does not contain the virus.

3. The method of claim 2, wherein the server is a server of a network service provider. after the determining that the memory image contains the virus, the method further comprises: setting a second preset value representing a network risk, a third preset value representing a virus risk, and a fourth preset value representing a determination of the virus; determining whether the entropy sum is greater than the first preset value and not greater than the second preset value; if the entropy sum is greater than the first preset value and not greater than the second preset value, it is determined that the degree of risk of the virus is the network risk; determining whether the entropy sum is greater than the second preset value and not greater than the third preset value; if the entropy sum is greater than the second preset value and not greater than the third preset value, it is determined that the degree of risk of the virus is the virus risk; determining whether the entropy sum is greater than the third preset value and not greater than the fourth preset value; if the entropy sum is greater than the third preset value and not greater than the fourth preset value, it is determined that the degree of risk of the virus is the determination of the virus.

4. The method of claim 1, wherein the server is a server of a network service provider. after the determining that the memory image contains the virus according to the comparison result, the method further comprises: obtaining a virus library in the memory system corresponding to the target operating system; adding the virus determined according to the comparison result into the virus library to obtain a new virus library; updating virus libraries of other operating systems based on the new virus library.

5. The method of claim 4, wherein the server is a server of a network service provider. the updating virus libraries of other operating systems based on the new virus library comprises: performing permission restriction on the virus in the target operating system; obtaining file basic information of the virus; traversing other operating systems according to the file basic information; when the file basic information is found in other operating systems, killing the virus corresponding to the file basic information.

6. The method of claim 1, wherein the server is a server of a network service provider. after the determining that the memory image contains the virus according to the comparison result, the method further comprises: determining whether a symbol representing the start of execution of a virus program is set at a starting point of a host program; if the symbol is set at the starting point of the host program, outputting a position of the virus program; if the symbol is not set at the starting point of the host program, determining whether the symbol representing the start of execution of the virus program is set at an intermediate point of the host program; if the symbol is set at the intermediate point of the host program, outputting the position of the virus program; if the symbol is not set at the intermediate point of the host program, determining whether the symbol representing the start of execution of the virus program is set at an ending point of the host program; if the symbol is set at the ending point of the host program, outputting the position of the virus program; if the symbol is not set at the ending point of the host program, ending.

7. A server's disinfection apparatus, characterized by, The device comprises: A first determining module for determining a target operating system, creating a corresponding memory image for a memory system of the target operating system, and storing disk functions corresponding to all disks in the memory image; A mounting module for mounting all the disk functions to a directory of the memory image; A first calling module for calling a virus identification function to obtain multiple virus dimensions; A second determining module for determining an entropy sum based on the virus dimensions; A comparison module for comparing the entropy sum with a preset value representing a virus risk degree to obtain a comparison result; A third determining module for determining that a virus exists in the memory image according to the comparison result; A first traversing module for traversing the directory and determining a location path of the virus; A first killing module for killing the virus according to the location path; A second calling module for calling the virus identification function to find all system files; A first finding module for finding a first virus dimension in the system files, wherein the first virus dimension is a characteristic code representing a virus type; A fourth determining module for determining a first entropy value corresponding to the first virus dimension according to the characteristic code; A third calling module for calling the virus identification function to obtain a timing task file; A second finding module for finding a second virus dimension in the timing task file, wherein the second virus dimension represents an association degree between a virus file and the timing task file; A fifth determining module for determining a second entropy value corresponding to the second virus dimension according to the association degree; A fourth calling module for calling the virus identification function to find all network files; A third finding module for finding a third virus dimension in the network files, wherein the third virus dimension represents a number of open fixed ports; A sixth determining module for determining a third entropy value corresponding to the third virus dimension according to the number of ports; A fifth calling module for calling the virus identification function to find an execution action of the virus and obtaining a storage path of a target service; A fourth finding module for finding a fourth virus dimension under the storage path of the target service, wherein the fourth virus dimension represents that a storage path of the execution action exists under the storage path of the target service; A seventh determining module for determining a fourth entropy value corresponding to the fourth virus dimension according to the storage path of the execution action; A first obtaining module for obtaining a preset weight distribution table of the first virus dimension, the second virus dimension, the third virus dimension, and the fourth virus dimension; An eighth determining module for determining a first weight coefficient corresponding to the first virus dimension, a second weight coefficient corresponding to the second virus dimension, a third weight coefficient corresponding to the third virus dimension, and a fourth weight coefficient corresponding to the fourth virus dimension in the weight distribution table; A ninth determining module for determining a first virus dimension total entropy value according to the first entropy value and the first weight coefficient; a tenth determining module, configured to determine a second virus dimension total entropy value according to the second entropy value and the second weight coefficient; an eleventh determining module, configured to determine a third virus dimension total entropy value according to the third entropy value and the third weight coefficient; a twelfth determining module, configured to determine a fourth virus dimension total entropy value according to the fourth entropy value and the fourth weight coefficient; a summing module, configured to sum the first virus dimension total entropy value, the second virus dimension total entropy value, the third virus dimension total entropy value and the fourth virus dimension total entropy value to obtain the entropy sum.

8. The server's disinfection apparatus according to claim 7, wherein, Further comprising: a first setting module, configured to set a first preset value representing the virus risk degree; a first judging module, configured to judge whether the entropy sum is greater than the first preset value; Correspondingly, the determining that the virus exists in the memory image according to the comparison result comprises: a thirteenth determining module, configured to determine that the virus exists in the memory image if the entropy sum is greater than the first preset value; a fourteenth determining module, configured to determine that the virus does not exist in the memory image if the entropy sum is not greater than the first preset value.

9. The server's disinfection apparatus according to claim 7, wherein, Further comprising: a second setting module, configured to set a second preset value representing the network risk, a third preset value representing the virus risk and a fourth preset value representing the determination of the virus; a second judging module, configured to judge whether the entropy sum is greater than the first preset value and not greater than the second preset value; a fifteenth determining module, configured to determine that the virus risk degree is the network risk if the entropy sum is greater than the first preset value and not greater than the second preset value; a third judging module, configured to judge whether the entropy sum is greater than the second preset value and not greater than the third preset value; a sixteenth determining module, configured to determine that the virus risk degree is the virus risk if the entropy sum is greater than the second preset value and not greater than the third preset value; a fourth judging module, configured to judge whether the entropy sum is greater than the third preset value and not greater than the fourth preset value; a seventeenth determining module, configured to determine that the virus risk degree is the determination of the virus if the entropy sum is greater than the third preset value and not greater than the fourth preset value.

10. A server's disinfection apparatus, characterized by, comprising: a memory, configured to store a computer program; a processor, configured to implement the steps of the antivirus method of the server according to any one of claims 1 to 6 when the computer program is executed.

11. A non-volatile storage medium, comprising: The non-volatile storage medium has a computer program stored thereon, and the computer program is executed by the processor to implement the steps of the antivirus method of the server according to any one of claims 1 to 6.

Images