Virus detection method and device, equipment and storage medium

Abstract

The invention belongs to the field of computers, and discloses a virus detection method and device, equipment and a storage medium. The method comprises the steps that to-be-detected data is migrated to a target GPU, a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used for judging whether virus feature codes exist in the data or not; and calling the preset feature matching algorithm in the target GPU to perform virus detection on the to-be-detected data. According to the method, the to-be-detected data is migrated to the target GPU, and the preset feature matching algorithm in the target GPU is called to perform virus detection on the to-be-detected data. Compared with an existing mode of detecting whether viruses exist in the to-be-detected data by performing virus feature code matching through a CPU, the mode provided by the invention has the advantages that the occupation of the CPU can be reduced, and the operation performance of the computer is optimized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a virus detection method, device, equipment and storage medium. Background Art

[0002] With the development of information technology, the functions provided by computers are becoming more and more abundant, and the system framework is becoming more and more complex. The number and types of security issues that come with it are increasing. In the process of fighting against malicious programs, in order to ensure the accuracy and comprehensiveness of security software, security vendors will combine multiple detection and killing technologies. Among all the detection and killing technologies, technical solutions related to signature code scanning occupy a considerable proportion. Signature code scanning uses various technical solutions to detect whether the scanned file contains the signature code in the virus library. The current signature scanning technologies are generally improved in three aspects: accuracy, efficiency and generality. The following three technical solutions are common: intelligent scanning, micro-signature scanning and wildcard scanning. However, no matter how the above scanning technologies are improved, they all take up a lot of CPU time for feature query matching. Even the micro-signature scanning technology is highly efficient relative to other feature scanning technologies, and it also sacrifices a certain degree of accuracy. At the same time, with the evolution and upgrading of security confrontation, the scale of the engine virus library is becoming larger and larger, resulting in the continuous growth of resource overhead of the engine matching signature library, which seriously affects the operation experience of computer users.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a virus detection method, device, equipment and storage medium, aiming to solve the technical problem that the prior art performs virus detection through the CPU, which affects the computer performance.

[0005] To achieve the above object, the present invention provides a virus detection method, which comprises the following steps:

[0006] Migrating the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data;

[0007] The preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected.

[0008] Optionally, the step of calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected includes:

[0009] Get virus detection parameters;

[0010] Inputting the virus detection parameters into the target GPU;

[0011] Calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result;

[0012] It is determined whether there is a virus signature code in the data to be detected according to the virus detection result.

[0013] Optionally, the step of migrating the data to be detected to the target GPU includes:

[0014] Applying for a first storage memory in the target GPU, and migrating the data to be detected to the first storage memory;

[0015] Apply for a second storage memory in the target GPU, where the second storage memory is used to store the virus detection result.

[0016] Optionally, the virus detection parameters include a virus signature code matching method and a matching range;

[0017] The step of calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result includes:

[0018] The preset feature matching algorithm in the target GPU is called so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus feature code matching mode and the matching range to obtain a virus detection result.

[0019] Optionally, the step of applying for a first storage memory in the target GPU and migrating the data to be detected to the first storage memory includes:

[0020] Applying for a first storage memory in the target GPU;

[0021] Get the size of the data to be detected;

[0022] When the size of the data to be detected is larger than the preset data size, slicing the data to be detected to obtain a slicing result;

[0023] The data to be detected is migrated to the first storage memory according to the slicing result.

[0024] Optionally, the step of applying for a first storage memory in the target GPU includes:

[0025] Obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period;

[0026] Determine the free memory of the target GPU according to the total memory and the memory occupancy rate;

[0027] Apply for a first storage memory according to the free memory.

[0028] Optionally, before the step of migrating the data to be detected to the target GPU, the step further includes:

[0029] A preset feature matching algorithm is written based on a high-level shader language, and the preset feature matching algorithm is copied to a target GPU.

[0030] Optionally, the step of migrating the data to be detected to the target GPU includes:

[0031] When receiving a virus detection instruction, obtain the CPU usage and GPU usage;

[0032] When the CPU usage is greater than a preset CPU usage threshold and the GPU usage is less than a preset GPU usage threshold, calling a preset interface to query whether the target GPU supports a high-level shader language;

[0033] When the target GPU supports the high-level shader language, the data to be detected is migrated to the target GPU.

[0034] Optionally, the virus detection method further includes:

[0035] When receiving a file search instruction, a string search script is written in a high-level shader language and the string search script is compiled to obtain a string search executable file;

[0036] Determine file search parameters according to the file search instruction;

[0037] Mapping the file search parameter to the global variable in the string search executable file to obtain a mapped string search executable file;

[0038] Migrating the mapped string search executable file to the target GPU;

[0039] The mapped string search executable file in the target GPU is called to search for the target string in the file to be searched.

[0040] Optionally, before the step of calling the mapped string search executable file in the target GPU to search for the target string in the file to be searched, the method further includes:

[0041] Applying for a target string storage memory and a to-be-searched file storage memory in the target GPU;

[0042] Mapping the target string to the target string storage memory;

[0043] The to-be-searched file is mapped to the to-be-searched file storage memory.

[0044] In addition, to achieve the above object, the present invention also provides a virus detection device, the device comprising:

[0045] A migration module, used to migrate the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data;

[0046] The virus detection module is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0047] In addition, to achieve the above objectives, the present invention also proposes a virus detection device, which includes: a memory, a processor, and a virus detection program stored in the memory and executable on the processor, wherein the virus detection program is configured to implement the steps of the virus detection method described above.

[0048] In addition, to achieve the above-mentioned purpose, the present invention further proposes a storage medium, on which a virus detection program is stored, and when the virus detection program is executed by a processor, the steps of the virus detection method described above are implemented.

[0049] The present invention migrates the data to be detected to a target GPU, in which a preset feature matching algorithm is stored, and the preset feature matching algorithm is used to determine whether a virus feature code exists in the data; the preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected. Since the present invention migrates the data to be detected to a target GPU, and calls the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected. Compared with the existing method of matching virus feature codes through the CPU to detect whether the data to be detected contains viruses, the above method of the present invention can reduce the occupancy of the CPU and optimize the operating performance of the computer. It also makes full use of the high-speed, large-volume, and concurrent characteristics of the GPU itself, improves the efficiency of feature matching, and makes it possible to improve the efficiency of virus detection without reducing other performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a structural schematic diagram of a virus detection device in a hardware operating environment involved in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the process of the first embodiment of the virus detection method of the present invention;

[0052] Figure 3 This is a schematic diagram of the process of the second embodiment of the virus detection method of the present invention;

[0053] Figure 4 This is a schematic diagram of the process of the third embodiment of the virus detection method of the present invention;

[0054] Figure 5 FIG. 4 is a structural block diagram of the first embodiment of the virus detection device of the present invention.

[0055] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0057] Reference Figure 1 , Figure 1 The figure is a schematic diagram of the structure of a virus detection device in a hardware operating environment involved in an embodiment of the present invention.

[0058] like Figure 1 As shown, the virus detection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0059] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the virus detection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0060] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a virus detection program.

[0061] exist Figure 1 In the virus detection device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the virus detection device of the present invention can be set in the virus detection device, and the virus detection device calls the virus detection program stored in the memory 1005 through the processor 1001, and executes the virus detection method provided by the embodiment of the present invention.

[0062] Based on the above virus detection device, an embodiment of the present invention provides a virus detection method, referring to Figure 2 , Figure 2 FIG. 4 is a flow chart of the first embodiment of the virus detection method of the present invention.

[0063] In this embodiment, the virus detection method includes the following steps:

[0064] Step S10: Migrate the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data.

[0065] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a mobile phone, a tablet computer, a personal computer, etc., or an electronic device or a virus detection device that can realize the above functions. The following takes the virus detection device as an example to illustrate this embodiment and the following embodiments.

[0066] It should be noted that the data to be detected may be data that may carry a virus and needs to be matched with a virus signature. The target GPU may be a graphics processing unit (GPU) with computing functions. The preset signature matching algorithm may be a data matching algorithm for determining whether a virus signature exists in the data.

[0067] Furthermore, in order to utilize the GPU for virus detection and reduce the computing pressure of the CPU, before step S10, it also includes: writing a preset feature matching algorithm based on a high-level shader language, and copying the preset feature matching algorithm to the target GPU.

[0068] It should be noted that the High Level Shader Language (HLSL) is a high-level shader language.

[0069] Furthermore, some GPUs may not support high-level shader languages, resulting in the inability to perform virus detection. Therefore, the step of migrating the data to be detected to the target GPU includes:

[0070] When receiving a virus detection instruction, obtain the CPU usage and GPU usage;

[0071] When the CPU usage is greater than a preset CPU usage threshold and the GPU usage is less than a preset GPU usage threshold, calling a preset interface to query whether the target GPU supports a high-level shader language;

[0072] When the target GPU supports the high-level shader language, the data to be detected is migrated to the target GPU.

[0073] It should be noted that the virus detection instruction may include information such as data to be detected, detection time, detection range, virus signature matching method, etc. The preset CPU usage threshold and the preset GPU usage threshold may be pre-set usage thresholds for determining whether to use the CPU or GPU for virus detection. The preset interface may be an interface for querying whether the target GPU supports a high-level shader language.

[0074] Furthermore, in order to use the GPU to match the data to be detected with the virus signature code to complete the virus detection, before step S10, the process further includes: migrating the virus signature code to the target GPU for storage.

[0075] Step S20: calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0076] It should be noted that calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected can be to detect whether there is a virus signature code in the data to be detected through the target GPU and the preset feature matching algorithm. If so, it is determined that the virus corresponding to the virus signature code exists in the data to be detected.

[0077] In this embodiment, the data to be detected is migrated to a target GPU, in which a preset feature matching algorithm is stored, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data; the preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected. Since in this embodiment, the data to be detected is migrated to a target GPU, the preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected. Compared with the existing method of matching virus feature codes through the CPU to detect whether there is a virus in the data to be detected, the above method of this embodiment can reduce the occupancy of the CPU, optimize the operating performance of the computer, and make full use of the high-speed, large-scale, and concurrent characteristics of the GPU itself, improve the efficiency of feature matching, and make it possible to improve the efficiency of virus detection without reducing other performance.

[0078] refer to Figure 3 , Figure 3 FIG. 4 is a flow chart of a second embodiment of a virus detection method according to the present invention.

[0079] Based on the above first embodiment, in this embodiment, step S20 includes:

[0080] Step S201: Obtain virus detection parameters.

[0081] It should be noted that the virus detection parameters may include information such as virus detection mode, virus detection range, and regular expressions for removing redundant data. The virus detection modes include intelligent scanning, micro-feature scanning, and wildcard scanning.

[0082] Step S202: inputting the virus detection parameters into the target GPU.

[0083] Step S203: calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters to obtain a virus detection result.

[0084] It should be noted that the virus detection parameters include a virus signature code matching method and a matching range; the step of calling the preset signature matching algorithm in the target GPU so that the preset signature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters to obtain a virus detection result includes: calling the preset signature matching algorithm in the target GPU so that the preset signature matching algorithm performs virus detection on the data to be detected according to the virus signature code matching method and the matching range to obtain a virus detection result. The virus signature code matching method may include intelligent scanning, micro-signature scanning, and wildcard scanning, etc. The matching range is used to limit the data that needs to be detected for viruses in the data to be detected.

[0085] In a specific implementation, the virus detection device obtains the virus detection parameters set by the user, and sends the virus detection parameters to the target GPU, so that the preset feature matching algorithm in the target GPU performs virus detection on the data to be detected according to the virus feature code matching method and the matching range in the virus detection parameters, and obtains the virus detection result.

[0086] Step S204: determining whether a virus signature code exists in the data to be detected according to the virus detection result.

[0087] It should be noted that the virus detection result includes information on whether there is a virus signature code in the data to be detected and, if there is a virus signature code in the data to be detected, related information of the existing virus signature code, including the characteristics of the virus signature code and the corresponding virus.

[0088] Furthermore, in order to perform virus detection in the GPU, the step of migrating the data to be detected to the target GPU includes: applying for a first storage memory in the target GPU and migrating the data to be detected to the first storage memory; applying for a second storage memory in the target GPU, and the second storage memory is used to store the virus detection result.

[0089] It should be noted that the first storage memory may be a memory in the GPU for storing data to be detected, and the second storage memory may be a memory in the GPU for storing virus detection results.

[0090] Furthermore, in order to avoid the data to be detected being too large, which would cause the GPU memory occupancy to be too high and affect the performance of the GPU, the step of applying for a first storage memory in the target GPU and migrating the data to be detected to the first storage memory includes: applying for a first storage memory in the target GPU; obtaining the size of the data to be detected; when the size of the data to be detected is larger than a preset data size, slicing the data to be detected to obtain a slicing result; and migrating the data to be detected to the first storage memory according to the slicing result.

[0091] It should be noted that the preset data size may be a pre-set data size. When the size of the data to be detected is larger than the preset data size, the data to be detected needs to be sliced ​​to avoid directly migrating all the data to be detected to the target GPU and affecting the operating performance of the target GPU. The slicing of the data to be detected may be slicing the data to be detected according to the preset data size, so that the size of each slice data in the slicing result does not exceed the preset data size. The migrating of the data to be detected to the first storage memory according to the slicing result may be migrating the slice data in the slicing result to the first storage memory for virus detection. After the virus detection of the slice data is completed, the first storage memory is released, and then the slice data that has not been virus-detected is migrated to the first storage memory until the slice data corresponding to the data to be detected are all migrated to the first storage memory to complete the virus detection. Among them, the size of the first storage memory applied for in the target GPU may be greater than or equal to the preset data size.

[0092] Furthermore, in order to avoid affecting the operating performance of the GPU, the step of applying for a first storage memory in the target GPU includes:

[0093] Obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period;

[0094] Determine the free memory of the target GPU according to the total memory and the memory occupancy rate;

[0095] Apply for a first storage memory according to the free memory.

[0096] It should be noted that the preset period may be a pre-set time period, such as a day, a week, or a month. The memory occupancy rate of the target GPU may be the memory occupancy information of the target GPU in the preset period. Because the memory occupancy rate of the target GPU changes dynamically, this embodiment obtains the memory occupancy rate of the target GPU within the preset period, determines the free memory of the target GPU according to the memory occupancy rate and the total memory of the target GPU within the preset period, and shares the virus detection calculation for the CPU without affecting the operating performance of the GPU. Therefore,

[0097] Determining the free memory of the target GPU according to the total memory and the memory occupancy rate may be to determine the target memory occupancy rate according to the memory occupancy rate, and to determine the free memory of the target GPU according to the target memory occupancy rate and the total memory. Determining the target memory occupancy rate according to the memory occupancy rate may be to use the median of the memory occupancy rates as the target memory occupancy rate, or may be to use the maximum value of the memory occupancy rates as the target memory occupancy rate. Determining the free memory of the target GPU according to the target memory occupancy rate and the total memory may be to multiply the total memory by the target memory occupancy rate to obtain the target occupied memory, and then to subtract the target occupied memory from the total memory to obtain the free memory of the target GPU. Applying the free memory as the first storage memory.

[0098] This embodiment obtains virus detection parameters; inputs the virus detection parameters into the target GPU; calls the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters to obtain a virus detection result; and determines whether there is a virus feature code in the data to be detected according to the virus detection result. This embodiment can reduce the use of the CPU and improve the performance of the computer by calling the preset feature matching algorithm in the target GPU to perform virus detection.

[0099] refer to Figure 4 , Figure 4 FIG. 4 is a flow chart of a third embodiment of a virus detection method according to the present invention.

[0100] Based on the above embodiments, in this embodiment, after step S20, the method further includes:

[0101] Step S30: when receiving the file search instruction, a string search script is written in a high-level shader language and the string search script is compiled to obtain a string search executable file.

[0102] It should be noted that the file search instruction may be an instruction for searching a target string from a file to be searched, and may include a file search parameter, a file to be searched, and a target string. The string search executable file may be a compiled executable file for searching a target string from a file to be searched.

[0103] Step S40: determining file search parameters according to the file search instruction.

[0104] It should be noted that the file search parameters may include a search range, a search time, a search method, and the like.

[0105] Step S50: Mapping the file search parameters to global variables in the string search executable file to obtain a mapped string search executable file.

[0106] In a specific implementation, the virus detection device maps the file search parameter to a global variable in the string search executable file to obtain a mapped string search executable file.

[0107] Step S60: Migrate the mapped string search executable file to the target GPU.

[0108] Step S70: calling the mapped string search executable file in the target GPU to search for the target string in the file to be searched.

[0109] In a specific implementation, the target GPU searches for the target string in the file to be searched according to the mapped string search executable file. The file to be searched and the target string are stored in a storage memory applied for in advance in the target GPU. In order to store the search result, a storage result memory needs to be applied for in the target GPU to store the search result.

[0110] Furthermore, in order to perform file search in the GPU, before step S70, it also includes: applying for a target string storage memory and a file storage memory to be searched in the target GPU; mapping the target string to the target string storage memory; mapping the file to be searched to the file storage memory to be searched.

[0111] It should be noted that the target string storage memory is used to store the target string. The to-be-searched file storage memory is used to store the to-be-searched file, and the target GPU also includes a search result memory for storing the search result of the target string.

[0112] When receiving a file search instruction, this embodiment writes a string search script in a high-level shader language and compiles the string search script to obtain a string search executable file; determines a file search parameter according to the file search instruction; maps the file search parameter to a global variable in the string search executable file to obtain a mapped string search executable file; migrates the mapped string search executable file to the target GPU; calls the mapped string search executable file in the target GPU to search for a target string in the file to be searched. This embodiment uses the GPU to perform file search, which can reduce CPU occupancy, improve computer performance, and utilize the high-speed, large-volume, and concurrent characteristics of the GPU itself to improve search efficiency.

[0113] Reference Figure 5 , Figure 5 FIG. 4 is a structural block diagram of the first embodiment of the virus detection device of the present invention.

[0114] like Figure 5 As shown, the virus detection device proposed in the embodiment of the present invention includes:

[0115] A migration module 10 is used to migrate the data to be detected to a target GPU, in which a preset feature matching algorithm is stored, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data;

[0116] The virus detection module 20 is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0117] In this embodiment, the data to be detected is migrated to the target GPU, and a preset feature matching algorithm is stored in the target GPU. The preset feature matching algorithm is used to determine whether there is a virus feature code in the data; the preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected. Since this embodiment migrates the data to be detected to the target GPU, the preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected. Compared with the existing method of matching virus feature codes through the CPU to detect whether there is a virus in the data to be detected, the above method of this embodiment can reduce the occupancy of the CPU and optimize the operating performance of the computer.

[0118] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0119] In addition, for technical details not fully described in this embodiment, reference can be made to the virus detection method provided in any embodiment of the present invention, and will not be repeated here.

[0120] Based on the above-mentioned first embodiment of the virus detection device of the present invention, a second embodiment of the virus detection device of the present invention is proposed.

[0121] In this embodiment, the virus detection module 20 is also used to obtain virus detection parameters;

[0122] Inputting the virus detection parameters into the target GPU;

[0123] Calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result;

[0124] It is determined whether there is a virus signature code in the data to be detected according to the virus detection result.

[0125] Furthermore, the virus detection module 20 is further used to apply for a first storage memory in the target GPU and migrate the data to be detected to the first storage memory;

[0126] Apply for a second storage memory in the target GPU, where the second storage memory is used to store the virus detection result.

[0127] Furthermore, the virus detection module 20 is further used to call the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus feature code matching method and the matching range to obtain a virus detection result.

[0128] Furthermore, the virus detection module 20 is further used to apply for a first storage memory in the target GPU;

[0129] Get the size of the data to be detected;

[0130] When the size of the data to be detected is larger than the preset data size, slicing the data to be detected to obtain a slicing result;

[0131] The data to be detected is migrated to the first storage memory according to the slicing result.

[0132] Furthermore, the virus detection module 20 is further used to obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period;

[0133] Determine the free memory of the target GPU according to the total memory and the memory occupancy rate;

[0134] Apply for a first storage memory according to the free memory.

[0135] Furthermore, the migration module 10 is also used to write a preset feature matching algorithm based on a high-level shader language, and copy the preset feature matching algorithm to the target GPU.

[0136] Furthermore, the migration module 10 is also used to obtain the CPU usage rate and the GPU usage rate when receiving the virus detection instruction;

[0137] When the CPU usage is greater than a preset CPU usage threshold and the GPU usage is less than a preset GPU usage threshold, calling a preset interface to query whether the target GPU supports a high-level shader language;

[0138] When the target GPU supports the high-level shader language, the data to be detected is migrated to the target GPU.

[0139] Furthermore, the virus detection module 20 is further configured to, upon receiving a file search instruction, write a string search script in a high-level shader language and compile the string search script to obtain a string search executable file;

[0140] Determine file search parameters according to the file search instruction;

[0141] Mapping the file search parameter to the global variable in the string search executable file to obtain a mapped string search executable file;

[0142] Migrating the mapped string search executable file to the target GPU;

[0143] The mapped string search executable file in the target GPU is called to search for the target string in the file to be searched.

[0144] Furthermore, the virus detection module 20 is further used to apply for a target string storage memory and a to-be-searched file storage memory in the target GPU;

[0145] Mapping the target string to the target string storage memory;

[0146] The to-be-searched file is mapped to the to-be-searched file storage memory.

[0147] Other embodiments or specific implementations of the virus detection device of the present invention can refer to the above-mentioned method embodiments, which will not be described in detail here.

[0148] In addition, an embodiment of the present invention further provides a storage medium, on which a virus detection program is stored. When the virus detection program is executed by a processor, the steps of the virus detection method described above are implemented.

[0149] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0150] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0151] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0152] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0153] The present invention discloses A1, a virus detection method, which comprises the following steps:

[0154] Migrating the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data;

[0155] The preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected.

[0156] A2. In the virus detection method described in 1, the step of calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected comprises:

[0157] Get virus detection parameters;

[0158] Inputting the virus detection parameters into the target GPU;

[0159] Calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result;

[0160] It is determined whether there is a virus signature code in the data to be detected according to the virus detection result.

[0161] A3. In the virus detection method described in A2, the step of migrating the data to be detected to the target GPU comprises:

[0162] Applying for a first storage memory in the target GPU, and migrating the data to be detected to the first storage memory;

[0163] Apply for a second storage memory in the target GPU, where the second storage memory is used to store the virus detection result.

[0164] A4. The virus detection method as described in A2, wherein the virus detection parameters include a virus signature matching method and a matching range;

[0165] The step of calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result includes:

[0166] The preset feature matching algorithm in the target GPU is called so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus feature code matching mode and the matching range to obtain a virus detection result.

[0167] A5. In the virus detection method described in A3, the step of applying for a first storage memory in the target GPU and migrating the data to be detected to the first storage memory comprises:

[0168] Applying for a first storage memory in the target GPU;

[0169] Get the size of the data to be detected;

[0170] When the size of the data to be detected is larger than the preset data size, slicing the data to be detected to obtain a slicing result;

[0171] The data to be detected is migrated to the first storage memory according to the slicing result.

[0172] A6. In the virus detection method described in A5, the step of applying for a first storage memory in the target GPU comprises:

[0173] Obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period;

[0174] Determine the free memory of the target GPU according to the total memory and the memory occupancy rate;

[0175] Apply for a first storage memory according to the free memory.

[0176] A7. The virus detection method as described in A1, before the step of migrating the data to be detected to the target GPU, further comprising:

[0177] A preset feature matching algorithm is written based on a high-level shader language, and the preset feature matching algorithm is copied to a target GPU.

[0178] A8. In the virus detection method described in A7, the step of migrating the data to be detected to the target GPU comprises:

[0179] When receiving a virus detection instruction, obtain the CPU usage and GPU usage;

[0180] When the CPU usage is greater than a preset CPU usage threshold and the GPU usage is less than a preset GPU usage threshold, calling a preset interface to query whether the target GPU supports a high-level shader language;

[0181] When the target GPU supports the high-level shader language, the data to be detected is migrated to the target GPU.

[0182] A9. The virus detection method according to any one of A1 to A8, further comprising:

[0183] When receiving a file search instruction, a string search script is written in a high-level shader language and the string search script is compiled to obtain a string search executable file;

[0184] Determine file search parameters according to the file search instruction;

[0185] Mapping the file search parameter to the global variable in the string search executable file to obtain a mapped string search executable file;

[0186] Migrating the mapped string search executable file to the target GPU;

[0187] The mapped string search executable file in the target GPU is called to search for the target string in the file to be searched.

[0188] A10. The virus detection method as described in A9, before the step of calling the mapped string search executable file in the target GPU to search for the target string in the file to be searched, further comprising:

[0189] Applying for a target string storage memory and a to-be-searched file storage memory in the target GPU;

[0190] Mapping the target string to the target string storage memory;

[0191] The to-be-searched file is mapped to the to-be-searched file storage memory.

[0192] The present invention discloses B11, a virus detection device, the virus detection device comprising:

[0193] A migration module, used to migrate the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data;

[0194] The virus detection module is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0195] B12. The virus detection device as described in B11, wherein the virus detection module is further used to obtain virus detection parameters;

[0196] Inputting the virus detection parameters into the target GPU;

[0197] Calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result;

[0198] It is determined whether there is a virus signature code in the data to be detected according to the virus detection result.

[0199] B13. The virus detection device as described in B12, wherein the virus detection module is further used to apply for a first storage memory in the target GPU and migrate the data to be detected to the first storage memory;

[0200] Apply for a second storage memory in the target GPU, where the second storage memory is used to store the virus detection result.

[0201] B14. The virus detection device as described in B12, wherein the virus detection parameters include a virus signature code matching method and a matching range;

[0202] The virus detection module is further used to call the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus feature code matching method and the matching range to obtain a virus detection result.

[0203] B15. The virus detection device as described in B13, wherein the virus detection module is further used to apply for a first storage memory in the target GPU;

[0204] Get the size of the data to be detected;

[0205] When the size of the data to be detected is larger than the preset data size, slicing the data to be detected to obtain a slicing result;

[0206] The data to be detected is migrated to the first storage memory according to the slicing result.

[0207] B16. The virus detection device as described in B15, wherein the virus detection module is further used to obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period;

[0208] Determine the free memory of the target GPU according to the total memory and the memory occupancy rate;

[0209] Apply for a first storage memory according to the free memory.

[0210] B17. In the virus detection device as described in B11, the migration module is further used to write a preset feature matching algorithm based on a high-level shader language, and copy the preset feature matching algorithm to the target GPU.

[0211] B18. The virus detection device as described in B17, wherein the migration module is further used to obtain the CPU usage rate and the GPU usage rate when receiving the virus detection instruction;

[0212] When the CPU usage is greater than a preset CPU usage threshold and the GPU usage is less than a preset GPU usage threshold, calling a preset interface to query whether the target GPU supports a high-level shader language;

[0213] When the target GPU supports the high-level shader language, the data to be detected is migrated to the target GPU.

[0214] The present invention discloses C19, a virus detection device, which includes: a memory, a processor, and a virus detection program stored in the memory and executable on the processor, wherein the virus detection program is configured to implement the steps of the virus detection method described in any one of A1 to A10.

[0215] The present invention discloses D20, a storage medium, on which a virus detection program is stored. When the virus detection program is executed by a processor, the steps of the virus detection method as described in any one of A1 to A10 are implemented.

Claims

1. A virus detection method, characterized in that: The virus detection method comprises the following steps: Migrating the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data; The preset feature matching algorithm in the target GPU is called to perform virus detection on the data to be detected.

2. The virus detection method according to claim 1, characterized in that: The step of calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected includes: Get virus detection parameters; Inputting the virus detection parameters into the target GPU; Calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result; It is determined whether there is a virus signature code in the data to be detected according to the virus detection result.

3. The virus detection method according to claim 2, characterized in that: The step of migrating the data to be detected to the target GPU includes: Applying for a first storage memory in the target GPU, and migrating the data to be detected to the first storage memory; Apply for a second storage memory in the target GPU, where the second storage memory is used to store the virus detection result.

4. The virus detection method according to claim 2, characterized in that: The virus detection parameters include virus signature matching method and matching range; The step of calling the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus detection parameters to obtain a virus detection result includes: The preset feature matching algorithm in the target GPU is called so that the preset feature matching algorithm performs virus detection on the to-be-detected data according to the virus feature code matching mode and the matching range to obtain a virus detection result.

5. The virus detection method according to claim 3, characterized in that: The step of applying for a first storage memory in the target GPU and migrating the data to be detected to the first storage memory includes: Applying for a first storage memory in the target GPU; Get the size of the data to be detected; When the size of the data to be detected is larger than the preset data size, slicing the data to be detected to obtain a slicing result; The data to be detected is migrated to the first storage memory according to the slicing result.

6. The virus detection method according to claim 5, characterized in that: The step of applying for a first storage memory in the target GPU includes: Obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period; Determine the free memory of the target GPU according to the total memory and the memory occupancy rate; Apply for a first storage memory according to the free memory.

7. The virus detection method according to claim 1, characterized in that: Before the step of migrating the data to be detected to the target GPU, the method further includes: A preset feature matching algorithm is written based on a high-level shader language, and the preset feature matching algorithm is copied to a target GPU.

8. A virus detection device, characterized in that: The virus detection device comprises: A migration module, used to migrate the data to be detected to a target GPU, wherein a preset feature matching algorithm is stored in the target GPU, and the preset feature matching algorithm is used to determine whether there is a virus feature code in the data; The virus detection module is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

9. A virus detection device, characterized in that: The device comprises: a memory, a processor, and a virus detection program stored in the memory and executable on the processor, wherein the virus detection program is configured to implement the steps of the virus detection method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a virus detection program, and when the virus detection program is executed by the processor, the steps of the virus detection method according to any one of claims 1 to 7 are implemented.

Images