Virus detection method, device, apparatus and storage medium

Abstract

The application belongs to the computer field and discloses a virus detection method, device, equipment and storage medium. The method comprises the following steps: migrating to-be-detected data to a target GPU, the target GPU storing a preset feature matching algorithm, the preset feature matching algorithm being used for judging whether a virus feature code exists in the data; and calling the preset feature matching algorithm in the target GPU to perform virus detection on the to-be-detected data. Since the to-be-detected data is migrated to the target GPU, the preset feature matching algorithm in the target GPU is called to perform virus detection on the to-be-detected data. Compared with the existing method of matching a virus feature code through a CPU and then detecting whether to-be-detected data contains a virus, the above method can reduce the occupation of the CPU and optimize the running performance of the computer.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a virus detection method, apparatus, device, and storage medium. Background Technology

[0002] With the development of information technology, computers offer increasingly richer functions and more complex system frameworks, leading to a surge in both the number and types of security problems. In the fight against malicious programs, security vendors combine various detection and removal technologies to ensure the accuracy and comprehensiveness of security software. Among all detection and removal technologies, signature-based scanning technologies account for a significant proportion. Signature scanning uses various techniques to detect whether scanned files contain signatures from virus databases. Current signature scanning technologies generally improve accuracy, efficiency, and versatility, commonly employing three techniques: intelligent scanning, micro-signature scanning, and wildcard scanning. However, regardless of these improvements, they all require a significant amount of CPU time for signature lookup and matching. Even micro-signature scanning technology, while efficient relative to other signature scanning techniques, sacrifices some accuracy. Simultaneously, as security measures evolve and escalate, virus databases have grown increasingly large, leading to a continuous increase in the resource overhead of matching signatures and severely impacting the user experience.

[0003] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this invention is to provide a virus detection method, apparatus, device, and storage medium, aiming to solve the technical problem that existing technologies using the CPU for virus detection cause impacts on computer performance.

[0005] To achieve the above objectives, the present invention provides a virus detection method, the method comprising the following steps:

[0006] The data to be detected is migrated to a target GPU, which contains a preset feature matching algorithm. The preset feature matching algorithm is used to determine whether there are virus signature codes in the data.

[0007] The preset feature matching algorithm in the target GPU is invoked to perform virus detection on the data to be detected.

[0008] Optionally, the step of invoking the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected includes:

[0009] Obtain virus detection parameters;

[0010] The virus detection parameters are input into the target GPU;

[0011] The preset feature matching algorithm in the target GPU is invoked so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result.

[0012] The presence of virus signatures in the data to be detected is determined based on the virus detection results.

[0013] Optionally, the step of migrating the data to be detected to the target GPU includes:

[0014] Allocate the first storage memory in the target GPU and migrate the data to be detected to the first storage memory;

[0015] A second storage memory is requested in the target GPU, and the second storage memory is used to store the virus detection results.

[0016] Optionally, the virus detection parameters include virus signature matching method and matching range;

[0017] The step of invoking the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result, includes:

[0018] The preset feature matching algorithm in the target GPU is invoked so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus signature matching method and the matching range, and obtains the virus detection result.

[0019] Optionally, the step of allocating first storage memory in the target GPU and migrating the data to be detected to the first storage memory includes:

[0020] Request a first storage memory in the target GPU;

[0021] Obtain the size of the data to be detected;

[0022] When the size of the data to be detected is greater than the preset data size, the data to be detected is sliced ​​to obtain the slicing result;

[0023] The data to be detected is migrated to the first storage memory based on the slicing results.

[0024] Optionally, the step of requesting the first storage memory in the target GPU includes:

[0025] Obtain the total memory of the target GPU and the memory usage rate of the target GPU within a preset period;

[0026] The free memory of the target GPU is determined based on the total memory and the memory occupancy rate;

[0027] Request the first storage memory based on the free memory.

[0028] Optionally, before the step of migrating the data to be detected to the target GPU, the method further includes:

[0029] A preset feature matching algorithm is written based on a high-order shader language, and the preset feature matching algorithm is copied to the target GPU.

[0030] Optionally, the step of migrating the data to be detected to the target GPU includes:

[0031] Upon receiving a virus detection command, obtain CPU and GPU usage.

[0032] When the CPU utilization rate is greater than a preset CPU utilization rate threshold and the GPU utilization rate is less than a preset GPU utilization rate threshold, a preset interface is called to query whether the target GPU supports high-order shader languages.

[0033] When the target GPU supports the high-order shader language, the data to be detected is migrated to the target GPU.

[0034] Optionally, the virus detection method further includes:

[0035] Upon receiving a file search instruction, a string search script is written in a high-order shader language and compiled to obtain a string search executable file.

[0036] Determine the file search parameters according to the file search instructions;

[0037] The file search parameters are mapped to global variables in the string search executable file to obtain the mapped string search executable file;

[0038] The mapped string is used to find the executable file and migrate it to the target GPU.

[0039] The target string in the target GPU is searched by calling the mapped string in the executable file to find the target string in the file to be searched.

[0040] Optionally, before the step of calling the mapped string search executable file in the target GPU to search for the target string in the file to be searched, the method further includes:

[0041] Allocate memory for storing the target string and memory for storing the file to be searched in the target GPU;

[0042] Map the target string to the target string storage memory;

[0043] The file to be searched is mapped to the memory where the file to be searched is stored.

[0044] Furthermore, to achieve the above objectives, the present invention also provides a virus detection device, the device comprising:

[0045] The migration module is used to migrate the data to be detected to a target GPU, wherein the target GPU stores a preset feature matching algorithm, which is used to determine whether there are virus signature codes in the data.

[0046] The virus detection module is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0047] Furthermore, to achieve the above objectives, the present invention also proposes a virus detection device, the device comprising: a memory, a processor, and a virus detection program stored in the memory and executable on the processor, the virus detection program being configured to implement the steps of the virus detection method described above.

[0048] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing a virus detection program, which, when executed by a processor, implements the steps of the virus detection method described above.

[0049] This invention migrates the data to be detected to a target GPU, which stores a preset feature matching algorithm used to determine whether virus signatures exist in the data. The preset feature matching algorithm in the target GPU is then invoked to perform virus detection on the data. Because this invention migrates the data to be detected to the target GPU and invokes the preset feature matching algorithm in the target GPU to perform virus detection, compared to existing methods that use the CPU to match virus signatures and detect the presence of viruses in the data, this invention reduces CPU usage and optimizes computer performance. Furthermore, it fully utilizes the high speed, large capacity, and concurrency characteristics of the GPU, improving feature matching efficiency and enhancing virus detection efficiency without sacrificing other performance aspects. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the structure of a virus detection device in the hardware operating environment involved in the embodiments of the present invention;

[0051] Figure 2 This is a flowchart illustrating the first embodiment of the virus detection method of the present invention;

[0052] Figure 3 This is a flowchart illustrating the second embodiment of the virus detection method of the present invention;

[0053] Figure 4 This is a flowchart illustrating the third embodiment of the virus detection method of the present invention;

[0054] Figure 5 This is a structural block diagram of the first embodiment of the virus detection device of the present invention.

[0055] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0056] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0057] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a virus detection device in the hardware operating environment involved in the embodiments of the present invention.

[0058] like Figure 1 As shown, the virus detection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or stable non-volatile memory (NVM), such as a disk storage device. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0059] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the virus detection device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0060] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a virus detection program.

[0061] exist Figure 1 In the virus detection device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the virus detection device of the present invention can be set in the virus detection device, and the virus detection device calls the virus detection program stored in the memory 1005 through the processor 1001 and executes the virus detection method provided in the embodiment of the present invention.

[0062] Based on the aforementioned virus detection equipment, this embodiment of the invention provides a virus detection method, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the virus detection method of the present invention.

[0063] In this embodiment, the virus detection method includes the following steps:

[0064] Step S10: Migrate the data to be detected to the target GPU, which contains a preset feature matching algorithm. The preset feature matching algorithm is used to determine whether there are virus signature codes in the data.

[0065] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a mobile phone, tablet computer, or personal computer, or an electronic device or virus detection device capable of performing the above functions. The following description uses the virus detection device as an example to illustrate this embodiment and the subsequent embodiments.

[0066] It should be noted that the data to be detected can be potentially virus-carrying data that requires virus signature matching. The target GPU can be a graphics processing unit (GPU) with computing capabilities. The preset feature matching algorithm can be a data matching algorithm used to determine whether virus signatures exist in the data.

[0067] Furthermore, in order to utilize the GPU for virus detection and reduce the computational burden on the CPU, before step S10, the method further includes: writing a preset feature matching algorithm based on a high-order shader language and copying the preset feature matching algorithm to the target GPU.

[0068] It should be noted that this refers to High Level Shader Language (HLSL).

[0069] Furthermore, some GPUs may not support high-level shader languages, making virus detection impossible. Therefore, the step of migrating the data to be detected to the target GPU includes:

[0070] Upon receiving a virus detection command, obtain CPU and GPU usage.

[0071] When the CPU utilization rate is greater than a preset CPU utilization rate threshold and the GPU utilization rate is less than a preset GPU utilization rate threshold, a preset interface is called to query whether the target GPU supports high-order shader languages.

[0072] When the target GPU supports the high-order shader language, the data to be detected is migrated to the target GPU.

[0073] It should be noted that the virus detection command may include information such as the data to be detected, detection time, detection range, and virus signature matching method. The preset CPU utilization threshold and the preset GPU utilization threshold can be pre-set usage thresholds used to determine whether to use the CPU or GPU for virus detection. The preset interface may be an interface used to query whether the target GPU supports high-order shader languages.

[0074] Furthermore, in order to use the GPU to match the data to be detected with the virus signature and complete the virus detection, before step S10, the method further includes: migrating the virus signature to the target GPU for storage.

[0075] Step S20: Call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0076] It should be noted that the step of calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected can be to detect whether there is a virus signature in the data to be detected by the target GPU and the preset feature matching algorithm. If there is a virus signature, it is determined that there is a virus corresponding to the virus signature in the data to be detected.

[0077] This embodiment migrates the data to be detected to a target GPU, which stores a preset feature matching algorithm. This algorithm is used to determine whether virus signatures exist in the data. The preset feature matching algorithm in the target GPU is then invoked to perform virus detection on the data. Since this embodiment migrates the data to be detected to the target GPU and invokes the preset feature matching algorithm in the target GPU to perform virus detection, compared to existing methods that use the CPU to match virus signatures and detect the presence of viruses in the data, this embodiment reduces CPU usage, optimizes computer performance, and fully utilizes the high speed, large capacity, and concurrency characteristics of the GPU, improving feature matching efficiency and thus enhancing virus detection efficiency without sacrificing other performance aspects.

[0078] refer to Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the virus detection method of the present invention.

[0079] Based on the first embodiment described above, in this embodiment, step S20 includes:

[0080] Step S201: Obtain virus detection parameters.

[0081] It should be noted that the virus detection parameters may include information such as the virus detection method, the virus detection range, and regular expressions used to remove redundant data. The virus detection methods include intelligent scanning, micro-feature scanning, and wildcard scanning.

[0082] Step S202: Input the virus detection parameters into the target GPU.

[0083] Step S203: Invoke the preset feature matching algorithm in the target GPU so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters and obtains the virus detection result.

[0084] It should be noted that the virus detection parameters include a virus signature matching method and a matching range. The step of invoking the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected based on the virus detection parameters and obtain a virus detection result includes: invoking the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected based on the virus signature matching method and the matching range, and obtaining a virus detection result. The virus signature matching method may include intelligent scanning, micro-feature scanning, and wildcard scanning, etc. The matching range is used to limit the data in the data to be detected that needs to be detected for virus detection.

[0085] In practice, the virus detection device acquires the virus detection parameters set by the user and sends the virus detection parameters to the target GPU, so that the preset feature matching algorithm in the target GPU performs virus detection on the data to be detected according to the virus signature code matching method and the matching range in the virus detection parameters, and obtains the virus detection result.

[0086] Step S204: Determine whether there is a virus signature in the data to be detected based on the virus detection results.

[0087] It should be noted that the virus detection result includes whether there is a virus signature in the data to be detected, and if there is a virus signature in the data to be detected, the relevant information of the virus signature, including the characteristics of the virus signature and the corresponding virus.

[0088] Furthermore, in order to perform virus detection in the GPU, the step of migrating the data to be detected to the target GPU includes: requesting a first storage memory in the target GPU and migrating the data to be detected to the first storage memory; and requesting a second storage memory in the target GPU, wherein the second storage memory is used to store the virus detection results.

[0089] It should be noted that the first storage memory can be the memory in the GPU used to store the data to be detected. The second storage memory can be the memory in the GPU used to store the virus detection results.

[0090] Furthermore, to avoid excessively large data to be detected, which would lead to excessive GPU memory usage and affect GPU performance, the step of allocating a first storage memory in the target GPU and migrating the data to be detected to the first storage memory includes: allocating a first storage memory in the target GPU; obtaining the size of the data to be detected; when the size of the data to be detected is greater than a preset data size, slicing the data to be detected to obtain slicing results; and migrating the data to be detected to the first storage memory according to the slicing results.

[0091] It should be noted that the preset data size can be a pre-set data size. When the size of the data to be detected is larger than the preset data size, the data to be detected needs to be sliced ​​to avoid directly migrating all the data to be detected to the target GPU, which would affect the running performance of the target GPU. The slicing of the data to be detected can be done by slicing the data to be detected according to the preset data size, so that the size of each slice data in the slicing result does not exceed the preset data size. The migration of the data to be detected to the first storage memory according to the slicing result can be done by migrating the slice data in the slicing result to the first storage memory for virus detection. After the virus detection of the slice data is completed, the first storage memory is released, and then the slice data that has not been virus detected is migrated to the first storage memory, until all the slice data corresponding to the data to be detected has been migrated to the first storage memory and the virus detection is completed. The size of the first storage memory allocated in the target GPU can be greater than or equal to the preset data size.

[0092] Furthermore, to avoid impacting GPU performance, the step of allocating the first storage memory in the target GPU includes:

[0093] Obtain the total memory of the target GPU and the memory usage rate of the target GPU within a preset period;

[0094] The free memory of the target GPU is determined based on the total memory and the memory occupancy rate;

[0095] Request the first storage memory based on the free memory.

[0096] It should be noted that the preset period can be a pre-set time period, such as a day, a week, or a month. The memory usage rate of the target GPU can be the memory usage information of the target GPU within the preset period. Because the memory usage rate of the target GPU changes dynamically, this embodiment obtains the memory usage rate of the target GPU within the preset period, and determines the free memory of the target GPU based on the memory usage rate of the target GPU within the preset period and the total memory, thereby alleviating the CPU's workload for virus detection while avoiding impacting the GPU's operating performance. Therefore,

[0097] Determining the free memory of the target GPU based on the total memory and the memory occupancy rate can be achieved by determining the target memory occupancy rate based on the memory occupancy rate, and then determining the free memory of the target GPU based on the target memory occupancy rate and the total memory. Determining the target memory occupancy rate can be done by multiplying the total memory by the target memory occupancy rate to obtain the target memory occupancy rate, and then subtracting the target memory occupancy rate from the total memory to obtain the free memory of the target GPU. The free memory is then allocated as the first storage memory.

[0098] This embodiment acquires virus detection parameters; inputs the virus detection parameters into the target GPU; calls the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result; and determines whether there is a virus signature in the data to be detected based on the virus detection result. This embodiment reduces CPU usage and improves computer performance by calling the preset feature matching algorithm in the target GPU for virus detection.

[0099] refer to Figure 4 , Figure 4 This is a flowchart illustrating the third embodiment of the virus detection method of the present invention.

[0100] Based on the above embodiments, in this embodiment, after step S20, the method further includes:

[0101] Step S30: Upon receiving a file search instruction, write a string search script using a high-order shader language and compile the string search script to obtain a string search executable file.

[0102] It should be noted that the file search instruction can be an instruction to search for a target string in a file to be searched, and may include file search parameters, the file to be searched, and the target string. The string search executable file can be a compiled executable file used to search for the target string in the file to be searched.

[0103] Step S40: Determine the file search parameters according to the file search instruction.

[0104] It should be noted that the file search parameters may include the search range, search time, and search method, etc.

[0105] Step S50: Map the file search parameters to global variables in the string search executable file to obtain the mapped string search executable file.

[0106] In practice, the virus detection device maps the file search parameters to global variables in the string search executable file to obtain the mapped string search executable file.

[0107] Step S60: Migrate the mapped string search executable file to the target GPU.

[0108] Step S70: Call the target string in the target GPU to search for the target string in the executable file.

[0109] In practice, the target GPU uses the mapped string to search for the target string in the executable file. The file to be searched and the target string are stored in memory pre-allocated in the target GPU. To store the search results, additional memory is allocated in the target GPU to store the search results.

[0110] Furthermore, in order to perform file search in the GPU, before step S70, the method further includes: allocating target string storage memory and file search storage memory in the target GPU; mapping the target string to the target string storage memory; and mapping the file search to the file search storage memory.

[0111] It should be noted that the target string storage memory is used to store the target string. The file to be searched storage memory is used to store the file to be searched. The target GPU also includes search result memory, which is used to store the search results for the target string.

[0112] In this embodiment, upon receiving a file search instruction, a string search script is written in a high-order shader language and compiled to obtain a string search executable file. File search parameters are determined according to the file search instruction; these parameters are mapped to global variables in the string search executable file to obtain a mapped string search executable file; the mapped string search executable file is then migrated to the target GPU; and the mapped string search executable file on the target GPU is invoked to search for the target string in the file to be searched. This embodiment utilizes the GPU for file searching, reducing CPU usage, improving computer performance, and leveraging the GPU's high speed, large capacity, and concurrency capabilities to enhance search efficiency.

[0113] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the virus detection device of the present invention.

[0114] like Figure 5 As shown, the virus detection device proposed in this embodiment of the invention includes:

[0115] Migration module 10 is used to migrate the data to be detected to a target GPU, wherein the target GPU stores a preset feature matching algorithm, which is used to determine whether there are virus signature codes in the data.

[0116] The virus detection module 20 is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected.

[0117] This embodiment migrates the data to be detected to a target GPU, which stores a preset feature matching algorithm. This algorithm is used to determine whether virus signatures exist in the data. The preset feature matching algorithm in the target GPU is then invoked to perform virus detection on the data. Since this embodiment migrates the data to be detected to the target GPU and invokes the preset feature matching algorithm in the target GPU to perform virus detection, compared to existing methods that use the CPU to match virus signatures and detect the presence of viruses in the data, this embodiment reduces CPU usage and optimizes computer performance.

[0118] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0119] In addition, for technical details not described in detail in this embodiment, please refer to the virus detection method provided in any embodiment of the present invention, which will not be repeated here.

[0120] Based on the first embodiment of the virus detection device of the present invention described above, a second embodiment of the virus detection device of the present invention is proposed.

[0121] In this embodiment, the virus detection module 20 is also used to acquire virus detection parameters;

[0122] The virus detection parameters are input into the target GPU;

[0123] The preset feature matching algorithm in the target GPU is invoked so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result.

[0124] The presence of virus signatures in the data to be detected is determined based on the virus detection results.

[0125] Furthermore, the virus detection module 20 is also used to request a first storage memory in the target GPU and migrate the data to be detected to the first storage memory;

[0126] A second storage memory is requested in the target GPU, and the second storage memory is used to store the virus detection results.

[0127] Furthermore, the virus detection module 20 is also used to call the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus signature matching method and the matching range, and obtains the virus detection result.

[0128] Furthermore, the virus detection module 20 is also used to request a first storage memory in the target GPU;

[0129] Obtain the size of the data to be detected;

[0130] When the size of the data to be detected is greater than the preset data size, the data to be detected is sliced ​​to obtain the slicing result;

[0131] The data to be detected is migrated to the first storage memory based on the slicing results.

[0132] Furthermore, the virus detection module 20 is also used to obtain the total memory of the target GPU and the memory occupancy rate of the target GPU within a preset period;

[0133] The free memory of the target GPU is determined based on the total memory and the memory occupancy rate;

[0134] Request the first storage memory based on the free memory.

[0135] Furthermore, the migration module 10 is also used to write a preset feature matching algorithm based on a high-order shader language and copy the preset feature matching algorithm to the target GPU.

[0136] Furthermore, the migration module 10 is also used to obtain CPU utilization and GPU utilization when receiving a virus detection instruction;

[0137] When the CPU utilization rate is greater than a preset CPU utilization rate threshold and the GPU utilization rate is less than a preset GPU utilization rate threshold, a preset interface is called to query whether the target GPU supports high-order shader languages.

[0138] When the target GPU supports the high-order shader language, the data to be detected is migrated to the target GPU.

[0139] Furthermore, the virus detection module 20 is also used to write a string search script in a high-order shader language and compile the string search script to obtain a string search executable file when a file search instruction is received;

[0140] Determine the file search parameters according to the file search instructions;

[0141] The file search parameters are mapped to global variables in the string search executable file to obtain the mapped string search executable file;

[0142] The mapped string is used to find the executable file and migrate it to the target GPU.

[0143] The target string in the target GPU is searched by calling the mapped string in the executable file to find the target string in the file to be searched.

[0144] Furthermore, the virus detection module 20 is also used to allocate target string storage memory and file to be searched storage memory in the target GPU;

[0145] Map the target string to the target string storage memory;

[0146] The file to be searched is mapped to the memory where the file to be searched is stored.

[0147] Other embodiments or specific implementations of the virus detection device of the present invention can be referred to the above-described method embodiments, and will not be repeated here.

[0148] Furthermore, embodiments of the present invention also propose a storage medium storing a virus detection program, which, when executed by a processor, implements the steps of the virus detection method described above.

[0149] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0150] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0151] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0152] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for detecting a virus, characterized in that, The virus detection method includes the following steps: The data to be detected is migrated to a target GPU, which contains a preset feature matching algorithm. The preset feature matching algorithm is used to determine whether there are virus signature codes in the data. The preset feature matching algorithm in the target GPU is invoked to perform virus detection on the data to be detected. The step of migrating the data to be detected to the target GPU includes: Allocate a first storage memory in the target GPU; When the size of the data to be detected is greater than the preset data size, the data to be detected is sliced ​​to obtain the slicing result; Based on the slicing results, the data to be detected is migrated to the first storage memory; Accordingly, the step of invoking the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected includes: The preset feature matching algorithm in the target GPU is invoked to perform virus detection on the slice data stored in the first storage memory. After the virus detection is completed, the first storage memory is released, and the slice data that has not been detected is migrated to the first storage memory. This process continues until all slice data corresponding to the data to be detected has been migrated to the first storage memory to complete the virus detection.

2. The virus detection method as described in claim 1, characterized in that, The step of calling the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected includes: Obtain virus detection parameters; The virus detection parameters are input into the target GPU; The preset feature matching algorithm in the target GPU is invoked so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result. The presence of virus signatures in the data to be detected is determined based on the virus detection results.

3. The virus detection method as described in claim 2, characterized in that, The step of migrating the data to be detected to the target GPU includes: Allocate the first storage memory in the target GPU and migrate the data to be detected to the first storage memory; A second storage memory is requested in the target GPU, and the second storage memory is used to store the virus detection results.

4. The virus detection method as described in claim 3, characterized in that, The virus detection parameters include the virus signature matching method and matching range; The step of invoking the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result, includes: The preset feature matching algorithm in the target GPU is invoked so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus signature matching method and the matching range, and obtains the virus detection result.

5. The virus detection method as described in claim 3, characterized in that, The step of requesting the first storage memory in the target GPU includes: Obtain the total memory of the target GPU and the memory usage rate of the target GPU within a preset period; The free memory of the target GPU is determined based on the total memory and the memory occupancy rate; Request the first storage memory based on the free memory.

6. The virus detection method as described in claim 1, characterized in that, Before the step of migrating the data to be detected to the target GPU, the method further includes: A preset feature matching algorithm is written based on a high-order shader language, and the preset feature matching algorithm is copied to the target GPU.

7. The virus detection method as described in claim 6, characterized in that, The step of migrating the data to be detected to the target GPU includes: Upon receiving a virus detection command, obtain CPU and GPU usage. When the CPU utilization rate is greater than a preset CPU utilization rate threshold and the GPU utilization rate is less than a preset GPU utilization rate threshold, a preset interface is called to query whether the target GPU supports high-order shader languages. When the target GPU supports the high-order shader language, the data to be detected is migrated to the target GPU.

8. The virus detection method according to any one of claims 1-7, characterized in that, The virus detection method further includes: Upon receiving a file search instruction, a string search script is written in a high-order shader language and compiled to obtain a string search executable file. Determine the file search parameters according to the file search instructions; The file search parameters are mapped to global variables in the string search executable file to obtain the mapped string search executable file; The mapped string is used to find the executable file and migrate it to the target GPU. The target string in the target GPU is searched by calling the mapped string in the executable file to find the target string in the file to be searched.

9. The virus detection method as described in claim 8, characterized in that, Before the step of calling the mapped string search executable file in the target GPU to search for the target string in the file to be searched, the method further includes: Allocate memory for storing the target string and memory for storing the file to be searched in the target GPU; Map the target string to the target string storage memory; The file to be searched is mapped to the memory where the file to be searched is stored.

10. A virus detection device, characterized in that, The virus detection device includes: The migration module is used to migrate the data to be detected to a target GPU, wherein the target GPU stores a preset feature matching algorithm, which is used to determine whether there are virus signature codes in the data. The virus detection module is used to call the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected; The step of migrating the data to be detected to the target GPU includes: Allocate a first storage memory in the target GPU; When the size of the data to be detected is greater than the preset data size, the data to be detected is sliced ​​to obtain the slicing result; Based on the slicing results, the data to be detected is migrated to the first storage memory; Accordingly, the step of invoking the preset feature matching algorithm in the target GPU to perform virus detection on the data to be detected includes: The preset feature matching algorithm in the target GPU is invoked to perform virus detection on the slice data stored in the first storage memory. After the virus detection is completed, the first storage memory is released, and the slice data that has not been detected is migrated to the first storage memory. This process continues until all slice data corresponding to the data to be detected has been migrated to the first storage memory to complete the virus detection.

11. The virus detection device as described in claim 10, characterized in that, The virus detection module is also used to acquire virus detection parameters; The virus detection parameters are input into the target GPU; The preset feature matching algorithm in the target GPU is invoked so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus detection parameters, and obtains the virus detection result. The presence of virus signatures in the data to be detected is determined based on the virus detection results.

12. The virus detection device as described in claim 11, characterized in that, The virus detection module is also used to request a first storage memory in the target GPU and migrate the data to be detected to the first storage memory; A second storage memory is requested in the target GPU, and the second storage memory is used to store the virus detection results.

13. The virus detection device as described in claim 11, characterized in that, The virus detection parameters include the virus signature matching method and matching range; The virus detection module is also used to call the preset feature matching algorithm in the target GPU, so that the preset feature matching algorithm performs virus detection on the data to be detected according to the virus signature matching method and the matching range, and obtains the virus detection result.

14. The virus detection device as described in claim 12, characterized in that, The virus detection module is also used to obtain the total memory of the target GPU and the memory usage rate of the target GPU within a preset period; The free memory of the target GPU is determined based on the total memory and the memory occupancy rate; Request the first storage memory based on the free memory.

15. The virus detection device as described in claim 10, characterized in that, The migration module is also used to write a preset feature matching algorithm based on a high-order shader language and copy the preset feature matching algorithm to the target GPU.

16. The virus detection device as described in claim 15, characterized in that, The migration module is also used to obtain CPU utilization and GPU utilization when a virus detection instruction is received; When the CPU utilization rate is greater than a preset CPU utilization rate threshold and the GPU utilization rate is less than a preset GPU utilization rate threshold, a preset interface is called to query whether the target GPU supports high-order shader languages. When the target GPU supports the high-order shader language, the data to be detected is migrated to the target GPU.

17. A virus detection device, characterized in that, The device includes: a memory, a processor, and a virus detection program stored in the memory and executable on the processor, the virus detection program being configured to implement the steps of the virus detection method as described in any one of claims 1 to 8.

18. A storage medium, characterized in that, The storage medium stores a virus detection program, which, when executed by a processor, implements the steps of the virus detection method as described in any one of claims 1 to 8.

Images