Virus feature code parallel detection system and method based on extensible precision chaos hash

Abstract

The invention discloses a virus feature code parallel detection system and method based on extensible precision chaos hash, and belongs to the field of computer file system safety and parallel calculation. The method comprises the following steps: establishing a virus feature code database by adopting an extensible precision chaos Hash process; the main service program realizes virus feature code database configuration; starting a verification process of the virus feature code database in the slave service program; the receiving module is used for receiving file virus infection judgment results; and the plurality of slave service programs execute computer virus detection in parallel, the slave service programs match and identify the feature codes in the to-be-detected file with the virus feature codes in the virus feature code database, and whether the file is infected with viruses is judged according to the matching and identifying result. According to the method, the computer file system can be protected, damage of computer viruses to the file system is resisted, a safer computer defense system is constructed, and then the purpose of protecting the file system is achieved.

Description

Technical Field

[0001] The present invention relates to the fields of computer file system security and parallel computing, and in particular to a virus signature parallel detection system and method based on scalable precision chaotic hashing. Background Art

[0002] Computer viruses are the main threat that infects computer files and damages computer operating systems. Computer viruses mainly invade computer files through virus codes and malicious codes. These codes have strong attack and destruction capabilities and will be hidden through normal programs. When users copy, transfer or use them, computer viruses will start the process of destroying or infecting computer files, thus bringing danger to the computer.

[0003] Computer virus detection and killing systems are widely used and are one of the main security software. They can defend against computer viruses and security threats to computer systems. The following are typical scenarios for using computer virus detection and killing systems:

[0004] Example 1: User A saves his own files in a mobile storage device. User A uses a computer system to copy a file File. However, the file has been infected by a computer virus and contains a computer virus. User A copies the file File to his own mobile storage device and opens the file File in his own computer system. The virus hidden in the file File infects other files in User A's operating system, and the computer virus is hidden in other files.

[0005] Example 2: When using his own file system, User B finds that the file system often cannot be opened or files are hidden. Through computer antivirus system detection, it is found that the computer file system is infected with computer viruses. These viruses destroy file attributes, infect certain files in the computer and destroy the user's operation of using files in the computer, thus affecting User B's use of the computer system.

[0006] Example 3: When Company A was using a computer file system, some files had abnormal lengths and garbled content. When using computer antivirus software for detection, it was found that the file system was infected with a computer virus. These files affected the use of the computer file system and caused damage to the file system.

[0007] Computer viruses not only destroy the file management of the operating system, but also have the characteristics of being contagious and hidden. Therefore, they will bring great security threats to all users and cause certain economic and property losses. At present, most anti-virus software uses signature codes to identify viruses, and it is difficult to provide a parallel anti-virus process; one of the main reasons is that parallel programming is more complicated than serial programming, and there is no unified standard for the interface based on parallel programming, which is still in the development stage; secondly, with the increase of the number of signature codes, the speed of detection and killing is significantly reduced.

[0008] Therefore, how to effectively solve the threat of computer viruses faced by the file system in the computer system is a security issue that users and some companies need to face. Summary of the invention

[0009] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to protect the computer file system, resist the damage of computer viruses to the file system, build a safer computer defense system, and thus achieve the purpose of protecting the file system. The hash value of the virus signature code is established by chaotic hashing, and the pattern recognition algorithm is used to detect whether the virus signature code stored in the database matches the current computer virus code, thereby detecting whether there is a computer virus in the system and identifying whether the file is safe.

[0010] To achieve the above object, the present invention provides a virus signature parallel detection system based on scalable precision chaotic hash, comprising:

[0011] Virus signature database, a virus signature database established using a scalable precision chaotic hashing process;

[0012] The main service program unit is used to implement the virus signature database configuration; to start the virus signature database verification process in the slave service program; and to receive the file virus infection judgment result;

[0013] The slave service program unit includes n slave service program modules, each of which performs computer virus detection in parallel. The slave service program module matches and identifies the feature code in the file to be detected with the virus feature code in the virus feature code database, and determines whether the file is infected with a virus based on the matching and identification results.

[0014] Furthermore, the slave service program unit includes a first slave service program module and a second slave service program module, wherein the first slave service program module is used to perform computer virus detection of the executable file "exe", and the second slave service program module is used to perform computer virus detection of the "macro virus" file category.

[0015] The second aspect of the present invention provides a parallel virus signature detection method based on scalable precision chaotic hashing, comprising the following steps:

[0016] The step of establishing a virus signature database is to use a scalable precision chaotic hashing process to establish a virus signature database;

[0017] The main service program steps include configuring the virus signature database; verifying computer viruses; and receiving the file virus infection judgment results;

[0018] In the slave service program step, computer virus detection is performed in parallel by n slave service programs, wherein the slave service program matches and identifies the feature code in the file to be detected with the virus feature code in the virus feature code database, and determines whether the file is infected with a virus based on the matching and identification result.

[0019] Furthermore, the method for constructing the virus signature database includes:

[0020] Introduce virus code CVCode and virus number CVID through static link library S ;

[0021] The type of virus will be marked according to the classification of computer viruses;

[0022] Extract the virus code, obtain the scalable precision chaotic output array ChaosOutBuf after processing it with the scalable precision chaotic hash function, format the scalable precision chaotic output array ChaosOutBuf and assign it to the hash array HashArray;

[0023] The virus code is the virus ID CVID S The virus ID CVID assigned to the virus signature database T , format the virus category CVType of the virus code and assign it to the database location DBLocation of the virus signature database;

[0024] Repeat the above steps until all virus codes in the static link library are added to the virus signature database.

[0025] Furthermore, the scalable precision chaotic hashing process includes:

[0026] Set the scalable precision chaos equation ChaosMap of the scalable precision chaos hash function, the initial parameters and control parameters of the scalable precision chaos equation ChaosMap, the scalable precision chaos precision ChaosPositions and the scalable precision chaos initial iteration value IniItrNum; perform initial iteration of the extended precision chaos equation ChaosMap;

[0027] After extracting the code key bit array of the virus code CVCode and formatting it, it is assigned to the scalable precision chaos input array ChaosInBuf. After one iteration of the scalable precision chaos equation ChaosMap, the result is saved in the scalable precision chaos output array ChaosOutBuf.

[0028] Furthermore, the method for the main service program to configure the virus signature database includes:

[0029] Before performing computer virus detection, the i-th database location DBLocation_L of the virus signature database is i Assigned to the i-th slave program Slave_i, the slave program Slave_i detects computer viruses of the i-th category file File_i;

[0030] When performing computer virus detection, according to the category of the file to be detected, it is sent to the database location DBLocation_L of the virus signature database i The slave program Slave_i is used for detection.

[0031] Furthermore, the virus verification includes verifying the virus category, verifying the number of newly added virus codes from the service program, verifying the total number of virus codes from the service program and verifying the total number of virus categories.

[0032] Furthermore, the main service program step also includes a step of screening key detection files, including:

[0033] Set the critical value P of virus occurrence frequency;

[0034] Calculate the virus occurrence frequency of each virus category. When the virus occurrence frequency P of the i-th virus category CVType_i i When it is greater than the virus occurrence frequency critical value P, the corresponding computer virus category CVType_i is set as the key detection file type.

[0035] The method for executing computer virus detection from the service program includes:

[0036] Extracting the code key bit array of the file to be detected, formatting the code key bit array, and obtaining an expandable precision chaos input array ChaosInBuf;

[0037] The scalable precision chaotic input array ChaosInBuf is used as input, and the scalable precision chaotic output array ChaosOutBuf is obtained after iterating the scalable precision chaotic hash function. The scalable precision chaotic output array ChaosOutBuf is compared with the hash array HashArray. If the match is successful, the file to be detected is a virus-infected file, otherwise, it is a safe file.

[0038] Compared with the prior art, the present invention has the following technical effects:

[0039] 1. The present invention uses virus signature codes as the main method for identifying computer viruses. It establishes a virus signature code database of scalable precision chaotic hashing, fully utilizing the good spatial traversal and low characteristic degradation of scalable precision chaos, reducing the probability of hash collision and false detection during virus identification, and effectively identifying computer viruses.

[0040] 2. The present invention adopts a parallel computing mode based on message passing, which can make full use of the multi-core computing resources of the computer. Its master-slave service program mode performs virus identification. The master service program effectively schedules and controls at a macro level, and assigns files to different slave service programs for virus identification according to their categories. Multiple slave service programs execute computer virus detection work in parallel, realizing efficient configuration of computing resources of multi-core processors, making full use of the multi-core computing resources inside the computer, and giving play to the technical advantages of parallel computing.

[0041] 3. In the present invention, the slave service program effectively prevents computer viruses from infecting the file system by scanning the feature code. As the number of computing cores increases, the scanning speed will be effectively improved. The index-based design is more conducive to the parallelization and rapid scanning of the slave service program. Therefore, efficient scanning of computer viruses can be achieved.

[0042] 4. The present invention is based on the parallel computing characteristics of multi-core processors, and accelerates the speed of data processing and database retrieval through parallel computing, thereby detecting system targets more quickly.

[0043] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a structural principle diagram of a virus signature parallel detection system based on scalable precision chaotic hashing according to a specific embodiment of the present invention;

[0045] Figure 2 It is a flow chart of a method for parallel virus signature detection using scalable precision chaotic hashing according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0047] like Figure 1 As shown, in a specific embodiment, a virus signature code parallel detection system based on scalable precision chaotic hash is provided, including a virus signature code database, a main service program unit and a slave service program unit.

[0048] The virus signature database is a virus signature database established by adopting an extensible precision chaotic hashing process.

[0049] The process of computer system virus defense usually adopts the method of identifying and marking viruses. Virus signature code is the basic feature of virus code. Computer virus or malicious program code in files can be identified through virus signature code. Virus identification method is realized by identifying viruses through virus signature code. In this embodiment, the computer virus code described in the embodiment is obtained by scalable precision chaotic hash function method to obtain computer virus code signature code, and then a virus signature code database is constructed.

[0050] In this embodiment, the computer virus code is characterized by the following data items 1-7 and auxiliary features in the virus detection and killing process. The specific data items are defined as follows:

[0051] Data item 1, Item_1: Computer virus ID CVID S ;

[0052] Data item 2, Item_2: computer virus code CVCode;

[0053] Data item 3, Item_3: computer virus category CVType;

[0054] Data item 4, Item_4: total number of computer virus categories CVAllType;

[0055] Data item 5, Item_5: total number of computer virus codes CVAllNum;

[0056] Data item 6, Item_6: computer virus code new number CVNewNum;

[0057] Data item 7, Item_7: computer virus occurrence frequency CVProbability;

[0058] Chaotic equations can generate random sequences. Chaotic hashing uses "hashing" implemented by chaotic technology. Chaotic equations have good random characteristics and space traversal characteristics. The definition of the scalable precision chaotic equation used in this embodiment is:

[0059] Data item 1, Item_1: Scalable precision chaos equation ChaosMap;

[0060] Data item 2, Item_2: Scalable precision chaos precision ChaosPositions;

[0061] Data item 3, Item_3: Scalable precision chaos initial iteration value IniItrNum;

[0062] Data item 4, Item_4: scalable precision chaos input array ChaosInBuf;

[0063] Data item 5, Item_5: scalable precision chaos output array ChaosOutBuf;

[0064] The scalable precision chaotic hashing process includes:

[0065] Set the initial parameters, control parameters, scalable precision chaos precision ChaosPositions and scalable precision chaos initial iteration value IniItrNum of the scalable precision chaos equation ChaosMap. For example, when the scalable precision chaos equation ChaosMap adopts the Logistic equation, set the initial parameter x0 (x0=0.17) of the Logistic equation and the value ctlval (ctlval=3.99) of its control parameter, format the initial parameter x0 and the control parameter to the scalable precision chaos input array ChaosInBuf, the scalable precision chaos equation ChaosMap iterates IniItrNum, formats the hash value and stores it in the scalable precision chaos input array ChaosInBuf, and ChaosMap outputs the result to the scalable precision chaos output array ChaosOutBuf after one iteration to complete the scalable precision chaos hashing.

[0066] In this embodiment, the virus signature database is defined as follows:

[0067] Data item 1, Item_1: database primary key;

[0068] Data item 2, Item_2: Computer virus ID CVID T ;

[0069] Data item 3, Item_3: HashArray;

[0070] Data item 4, Item_4: code key bit array;

[0071] Data item 5, Item_5: database location DBLocation;

[0072] The main service program unit is used to implement virus signature database configuration; start the virus signature database verification process in the slave service program; receive the file virus infection judgment result;

[0073] The slave service program unit includes n slave service program modules, each of which performs computer virus detection in parallel. The slave service program module matches and identifies the feature code in the file to be detected with the virus feature code in the virus feature code database, and determines whether the file is infected with a virus based on the matching and identification results.

[0074] This embodiment is based on the fact that scalable precision chaos has good spatial traversal and low characteristic degradation capabilities. It uses scalable precision chaotic hashing for filtering, which to a certain extent reduces the probability of hash collision and false detection during virus identification. It can effectively identify computer viruses, especially when the virus signature database is very large, and still has a high virus detection efficiency.

[0075] Based on the virus signature code parallel detection system based on scalable precision chaotic hash described in the above embodiment, in a specific embodiment, a virus signature code parallel detection method based on scalable precision chaotic hash is proposed, such as Figure 2 As shown, the following steps are included:

[0076] S1. Establish a virus signature database, and use a scalable precision chaotic hash function to establish the virus signature database;

[0077] In this embodiment, the method for constructing the virus signature database includes:

[0078] S11. Introduce virus code CVCode and virus number CVID through static link library S ;

[0079] S12, marking the virus type according to the classification of computer viruses;

[0080] The virus type marking method can determine the virus type according to the method that has been manually marked in the data set, or classify by virus number, for example, classify every 100 into one category, or other methods can be used for classification and marking as needed.

[0081] S13, extracting the virus code, and obtaining the scalable precision chaotic output array ChaosOutBuf after processing it through the scalable precision chaotic hash process, and formatting the scalable precision chaotic output array ChaosOutBuf and assigning it to the hash array HashArray, specifically including:

[0082] S131, setting a scalable precision chaotic equation ChaosMap of a scalable precision chaotic hash function, initial parameters and control parameters of the scalable precision chaotic equation ChaosMap, scalable precision chaotic precision ChaosPositions, and scalable precision chaotic initial iteration value IniItrNum; performing an initial iteration of the extended precision chaotic equation ChaosMap;

[0083] S132, extract the code key bit array of the virus code CVCode and format it, assign it to the scalable precision chaos input array ChaosInBuf, iterate the scalable precision chaos equation ChaosMap once, and save the result in the scalable precision chaos output array ChaosOutBuf. The formatting process described in this embodiment is a computer string processing process, for example: connecting the strings, removing the redundant separators between them, etc.

[0084] S14, the virus code virus number CVID S The virus ID CVID assigned to the virus signature database T , format the virus category CVType of the virus code, and then assign it to the database location DBLocation of the virus signature database; the virus type CVType can be a character array or an integer of fixed length, etc., and the virus category CVType formatting method is to convert it into CVType using the sprintf function in C language.

[0085] S15. Repeat steps S11-S14 until all virus codes in the static link library are added to the virus signature database.

[0086] In a specific embodiment, the process of constructing the virus signature database is described by taking two virus categories as examples.

[0087] In Windows system, extract the computer virus code static link library cv.lib computer virus number CVID S=01, at this time, the computer virus category CVType of the computer virus code is the executable file "exe" category. The scalable precision chaotic equation is selected according to the needs, for example, a linear chaotic equation or a nonlinear chaotic equation can be selected. In this embodiment, the Logistic map is used as the scalable precision chaotic equation of the scalable precision chaotic hash function and its parameters are initialized. The Logistic map is: x[k+1]=ctlval*x[k]*(1-x[k]), where x[k] represents the kth iteration value of the chaotic equation, ctlval represents the control parameter of the equation in this example, and the initial value of the parameter is: x[0]=0.17 and ctlval=3.99. Assume that the virus code CVCode in this embodiment is data with a length of 20 characters, and extract the 1st, 2nd, 4th, 7th, 11th, 16th and 20th bits as the key bit array. The key bit array can be determined by statistical analysis, which is more scientific but requires regular maintenance; or the system default extraction method can be used, which is more suitable for simple and fast processes and does not require regular maintenance. After the initial iteration of the scalable precision chaos equation, the code key bit array characters of the virus code CVCode are converted into digital values ​​and assigned to the scalable precision chaos input array ChaosInBuf. The result obtained after one iteration of the scalable precision chaos equation is saved in the scalable precision chaos output array ChaosOutBuf. After the scalable precision chaos output array ChaosOutBuf is formatted, it is assigned to the hash array HashArray = "7s2Ut8P". The computer virus number CVID of the computer virus code is S =01 Assigned to the computer virus number CVID of the virus signature database T =01, and format and assign it to the database location DBLocation=L1.

[0088] Continue to extract the computer virus code static link library cv.lib computer virus number CVID S=02, at this time, the computer virus category CVType of the computer virus code is the "macro virus" file category. Assume that the virus code CVCode in this embodiment is data with a length of 20 characters, extract the 1st, 2nd, 4th, 7th, 11th, 16th and 20th bits as the key bit array, after the initial iteration of the scalable precision chaotic equation, convert the code key bit array characters of CVCode into digital values ​​and assign them to the scalable precision chaotic input array ChaosInBuf, convert the code key bit array characters of the virus code CVCode into digital values ​​and assign them to the scalable precision chaotic input array ChaosInBuf, format the scalable precision chaotic input array ChaosOutBuf and assign it to the hash array HashArray = "Gd334a1". Set the computer virus number CVID of the computer virus code S =02 Computer virus number CVID assigned to the virus signature database T =02, and format and assign it to the database location DBLocation=L2.

[0089] Repeat the above process until all CVCodes in the static link library are added to the virus signature database, completing the establishment of the virus signature database.

[0090] S2, start the main service program and configure the virus signature database;

[0091] The present invention adopts MPI parallel program and performs parallel virus detection through master-slave service mode. The master service program is used for scheduling from a macro perspective, which mainly includes the following steps:

[0092] S21. Initialize MPI parameters.

[0093] Set the total number of multi-core computing cores in the system, designate computing core No. 0 as the main program, define it as Master, and the other slave service programs are 1, 2, .... The total number of multi-core computing cores can be set according to user needs. For example, if the user processor has 4 computing cores, the user can set it to 4, and if the user processor has 8 computing cores, the user can set it to 8. When the user setting is higher than the number of computing cores of the system itself, other processes of the system will be restricted from running. For example, the computing core set in the system is CoreSets = {core_0, core_1, core_2, ...}, core_0 is the first element of CoreSets, specifying core_1 as the first slave processor, core_2 as the second slave processor, ..., and so on. Correspondingly, define Slave_0 as the main service program, and define the slave service programs as Slave_1, Slave_2, ..., and so on. Based on the two types of computer viruses described in the above embodiment, this embodiment includes 2 slave service programs, namely Slave_1 and Slave_2.

[0094] S22, the main program Master executes the MPI message transmission instruction to start the virus signature database configuration process, the virus signature database includes:

[0095] S221, initializing the database location DBLocation of the virus signature database according to the computer virus category CVType;

[0096] S222: Virus signature codes classified according to computer virus category CVType are stored in the slave service program, and different types of file detection are delivered to the designated slave service program for identification.

[0097] In a specific embodiment, the i-th database location DBLocation_Li of the virus signature database is assigned to the i-th slave program Slave_i, and the slave program Slave_i detects computer viruses of the i-th category of file File_i. Based on the two slave service programs described in the above embodiment, the first database location DBLocation_L1 in the virus signature database is assigned to the slave service program Slave_1, and the second database location DBLocation_L2 in the virus signature database is assigned to the slave service program Slave_2. The slave service program Slave_1 detects computer viruses of the executable file "exe" category, and the slave service program Slave_2 detects the "macro virus" file category.

[0098] S223. When performing computer virus detection, according to the category of the file to be detected, the file is sent to the slave program Slave_i at the database location DBLocation_Li of the virus signature database for detection.

[0099] S23, the main program Master executes the MPI message transmission instruction to start the virus signature database verification process from the service program. The database verification process is: randomly extract a data of each computer virus category CVType for verification. If the verification is correct, return the verification success, otherwise, execute step S22 again until the computer virus of this category is successfully installed. In this embodiment, the verification process verifies each item of information in the database. Correct verification means that each item in the database meets the virus signature to avoid ambiguous data. The verification process is used to verify each computer virus to avoid the situation of empty data in the database.

[0100] S24, the master program Master executes the MPI message transmission instruction to verify the number of new computer virus codes CVNewNum in the slave service program. If the verification is successful, a successful task execution flag is returned. Otherwise, the verification process of the number of new computer virus codes CVNewNum is repeated until it succeeds. The verification process in this embodiment is to check the CVNewNum information of each slave service program. The successful verification means that the number is correct to avoid ambiguity. By checking CVNewNum, inconsistent data in the database can be avoided.

[0101] S25, the master program Master executes the MPI message transmission instruction to verify the total number of computer virus codes CVAllNum in the slave service program. If the verification is successful, a successful task execution flag is returned, otherwise, the total number of computer virus codes is repeated until success. The verification in this embodiment verifies the CVAllNum information of each slave service program. The successful verification means that the number is correct to avoid ambiguity. By checking CVAllNum, inconsistent data in the database is avoided.

[0102] S26, the main program Master executes the MPI message passing instruction to verify the total number of computer virus categories CVAllType. If the verification is successful, a successful task execution flag is returned. Otherwise, the total number of computer virus categories is repeated until it succeeds. The verification described in this embodiment refers to checking the CVAllType information, checking the total number of CVAllType, and avoiding the situation of inconsistent data in the database. The successful verification means that the number is correct to avoid ambiguity.

[0103] The verification process of steps S23-S26 is used to ensure that the given data is correct data that can be used.

[0104] S3, starting the slave service program, and executing computer virus detection in parallel through n slave service programs, wherein the slave service program matches and identifies the feature code in the file to be detected with the virus feature code in the virus feature code database, and determines whether the file is infected with a virus according to the matching and identification result.

[0105] In this embodiment, the instruction is defined as Command. When the main program Master needs to send a command to be executed to the slave service program, the main program Master sends the Command information to the slave service program through the MPI system function MPI_Send. The slave service program receives the instruction Command of the Master through the MPI system function MPI_Recv function. The slave service program parses the Command and completes the instruction Command task. The slave service program sends the execution result to the main program Master through MPI_Send. The main program Master recovers the information returned by the slave service program through MPI_Recv. The main program Master starts and enters the scheduling and monitoring process. When the system receives a file identification process, the main program Master queries the computer virus category CVType according to the category of the file, and sends it to the slave service program at the database location DBLocation of the corresponding virus signature database for detection. The method for executing computer virus detection in the slave service program includes:

[0106] S31. After receiving the instruction from the service program, extract the code key bit array of the file to be detected, and format the extracted code key bit array to the scalable precision chaos input array ChaosInBuf; in this embodiment, the formatting process is to use the sprintf function in the C language to convert the key bit array, and remove unnecessary control characters such as redundant spacing characters.

[0107] S32, taking the scalable precision chaotic input array ChaosInBuf as input, obtaining the scalable precision chaotic output array ChaosOutBuf after iterating the scalable precision chaotic hash function, comparing the scalable precision chaotic output array ChaosOutBuf with the hash array HashArray, if ChaosOutBuf and HashArray are exactly the same, the match is successful, indicating that the file to be detected is a virus-infected file; then using the computer virus number CVID of the current virus signature database T Find the corresponding computer virus number CVID in the computer virus code SIf the match is successful, the slave service program reports to the master program Master that the file is infected with a virus, and increases the value of the computer virus occurrence frequency CVProbability by 1. Otherwise, it indicates that no virus is detected, indicating that the file is a safe file, and reports the final detection result to the master service program. This embodiment uses a two-step method to detect viruses. First, the hash function can be used to locate the file with one search, and the hash detection is used for filtering. If the hash detection is successful, the second step detection is performed. If the second step detection is successful, the virus is confirmed. In other cases, it cannot be determined as a virus.

[0108] S33, the main program Master calculates the numerical value of the computer virus occurrence frequency CVProbability according to the key value P set by the system, and compares the value of the computer virus occurrence frequency CVProbability with the key value P. When the numerical value of the computer virus occurrence frequency CVProbability is higher than the key value P, the computer virus category is used as the key detection file type. When the file category entering the computer system belongs to the above-mentioned key detection file type, the main program Master sends the file to the slave service program for matching and identifying the feature code, and the key value P is a numerical value set artificially based on experience. The high-incidence viruses are determined by statistical analysis through the computer virus occurrence frequency value. These high-incidence viruses are paid special attention and focused detection in actual virus detection and file protection. When the frequency is greater than the key value P, the database will automatically extract the feature data of this virus during retrieval.

[0109] In this embodiment, based on the above two computer virus cases, when detecting two files myfile1.exe and myfile2.doc in the mobile storage device, when the main program Master queries the computer virus category CVType according to the file category and finds it is the executable file "exe" category, the myfile1.exe file is sent to the slave service program Slave_1 at the database location DBLocation_L1 of the corresponding virus signature database for detection; when the main program Master queries the computer virus category CVType according to the file category and finds it is the "macro virus" file category, the myfile2.doc file is sent to the slave service program Slave_2 at the database location DBLocation_L2 of the corresponding virus signature database for detection.

[0110] The slave service program executes the program in parallel, including:

[0111] Parallel execution program 1: From the service program Slave_1, perform virus detection on the executable file "exe" type file.

[0112] After receiving the instruction from the service program, the code key bit array of the current file is extracted, and the code key bit array is formatted and converted to the scalable precision chaos input array ChaosInBuf. After the scalable precision chaos hash function is iterated, the output ChaosOutBuf = "7s2Ut8P" is output. The output array ChaosOutBuf is compared with the hash array HashArray and a match is successful. The computer virus number CVID of the current virus signature database is obtained. T Find the corresponding computer virus number CVID in the computer virus code S After comparing the computer virus code, the match is successful. The service program reports to the main program Master that the myfile1.exe file is infected with the virus, and the value of the computer virus occurrence frequency CVProbability of the executable file "exe" is increased by 1. At this time, the computer virus occurrence frequency CVProbability of the executable file "exe" is calculated to be 10.

[0113] Parallel execution program 2: Perform virus detection on "macro virus" type files from service program Slave_2.

[0114] After receiving the instruction from the service program, the code key bit array of the current file is extracted, and the code key bit array is formatted and converted to the scalable precision chaos input array ChaosInBuf. After the scalable precision chaos hash function is iterated, ChaosOutBuf = "Hglj732" is output. ChaosOutBuf is compared with the hash array HashArray. No match is successful. The computer virus number CVID of the current virus signature database is obtained. T Find the corresponding computer virus number CVID in the computer virus code S If the computer virus code is compared and matched successfully, the service program reports to the main program Master that the myfile2.doc file is infected with a virus. Otherwise, the service program Slave_2 sends a return message that myfile2.doc is safe.

[0115] When the key value set by the system for the main program Master is 9, the occurrence frequency of computer viruses in the executable file "exe" CVProbability = 10, which is higher than the current key value P = 9. Therefore, when processing the executable file "exe" in the computer file system, the system will focus on detecting the file type. When the file category of the computer system used by the user belongs to the above-mentioned key detection file type, the main program Master sends the file to the slave service program for feature code matching and identification.

[0116] S4. Receive the computer virus detection result obtained from the service program and end the main service program.

[0117] The main program Master receives the instructions input by the user. When the user needs to end the detection, the main program Master receives the end instruction input by the user, and the main program Master executes the MPI end process to end the current detection process. After the system receives the MPI end instruction, it ends the tasks of all current slave service programs Slave_1, Slave_2 and the remaining slave service programs. The main program Master sends the end task execution information to the slave service program through the MPI system function MPI_Send. The slave service program receives the Master's instructions through the MPI system function MPI_Recv function. The slave service program sends the detection results to the main service program Master through MPI_Send, and the main service program Master recovers the results returned by the slave service program through MPI_Recv. When all slave service programs complete their tasks, the main service program Master executes the end MPI system function to complete the MPI end process.

[0118] In this embodiment, the main program Master executes the MPI end process including:

[0119] After receiving the MPI end instruction, the following two parallel execution parts will be executed in parallel in the slave server program.

[0120] Parallel execution part 1: The main program Master sends the task execution end information to the slave service program Slave_1 through the MPI system function MPI_Send. The slave service program receives the Master's instructions through the MPI system function MPI_Recv function. The slave service program Slave_1 sends the current detection result to the main program Master through MPI_Send, and the main program Master recovers the result returned by the slave service program through MPI_Recv.

[0121] Parallel execution part 2: The main program Master sends the task execution end information to the slave service program Slave_2 through the MPI system function MPI_Send. The slave service program receives the Master's instructions through the MPI system function MPI_Recv function. The slave service program Slave_2 sends the current detection result to the main program Master through MPI_Send, and the main program Master recovers the result returned by the slave service program through MPI_Recv.

[0122] After the slave service programs Slave_1 and Slave_2 complete their tasks, the main program Master executes the end MPI system function to complete the MPI end process.

[0123] In existing computer systems, multi-core processors are usually used, so there are multiple CPUs available in the system. In the above embodiment, two types of viruses are detected as an example. Based on the parallel computing mode of message passing, the slave service program Slave_1 is used to perform computer virus detection of the executable file "exe". At the same time, the slave service program Slave_2 is used to perform computer virus detection of the "macro virus" file category. Therefore, the master-slave computer mode based on MPI adopted in this embodiment is effectively scheduled and controlled by the main program, and the slave processor is responsible for virus detection, which effectively utilizes the multi-core computing resources inside the computer, and gives full play to the technical advantages of parallel computing by effectively configuring the computing resources of the multi-core processor.

[0124] In practical applications, more parallel programs can be used for scanning. The parallel virus detection mode can efficiently realize virus detection. When the number of computing cores in the system increases, the slave service programs of different categories can obtain parallel scanning feature codes to timely identify files infected by computer viruses, which can effectively prevent computer viruses from infecting the file system. The index-based parallel scanning method is more conducive to the parallelization and rapid scanning of slave service programs, and can achieve the purpose of efficiently scanning computer viruses.

[0125] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A virus signature parallel detection system based on scalable precision chaotic hashing, characterized in that: include: Virus signature database, a virus signature database established using a scalable precision chaotic hashing process; The main service program unit is used to implement the virus signature database configuration; to start the virus signature database verification process in the slave service program; and to receive the file virus infection judgment result; The slave service program unit includes n slave service program modules, each of which performs computer virus detection in parallel. The slave service program module matches and identifies the feature code in the file to be detected with the virus feature code in the virus feature code database, and determines whether the file is infected with a virus based on the matching and identification results.

2. The virus signature parallel detection system based on scalable precision chaotic hashing according to claim 1 is characterized in that: The slave service program unit includes a first slave service program module and a second slave service program module, wherein the first slave service program module is used to perform computer virus detection of executable file "exe", and the second slave service program module is used to perform computer virus detection of "macro virus" file category.

3. A parallel virus signature detection method based on scalable precision chaotic hashing, characterized in that: The steps include: The step of establishing a virus signature database is to use a scalable precision chaotic hashing process to establish a virus signature database; The main service program steps include configuring the virus signature database; verifying computer viruses; and receiving the file virus infection judgment results; In the slave service program step, computer virus detection is performed in parallel by n slave service programs, wherein the slave service program matches and identifies the feature code in the file to be detected with the virus feature code in the virus feature code database, and determines whether the file is infected with a virus based on the matching and identification result.

4. The virus signature code parallel detection method based on scalable precision chaotic hashing according to claim 3 is characterized in that: The method for constructing the virus signature database includes: Introduce virus code CVCode and virus number CVID through static link library S ; The type of virus will be marked according to the classification of computer viruses; The virus code obtains an expandable precision chaotic output array ChaosOutBuf through an expandable precision chaotic hash process, and the expandable precision chaotic output array ChaosOutBuf is formatted and assigned to a hash array HashArray; The virus code is the virus ID CVID S The virus ID CVID assigned to the virus signature database T , format the virus category CVType of the virus code and assign it to the database location DBLocation of the virus signature database; Repeat the above steps until all virus codes in the static link library are added to the virus signature database.

5. The virus signature parallel detection method based on scalable precision chaotic hashing according to claim 4 is characterized in that: The scalable precision chaotic hashing process includes: Set the scalable precision chaos equation ChaosMap, the initial parameters and control parameters of the scalable precision chaos equation ChaosMap, the scalable precision chaos precision ChaosPositions and the scalable precision chaos initial iteration value IniItrNum; perform initial iteration of the extended precision chaos equation ChaosMap; After extracting the code key bit array of the virus code CVCode and formatting it, it is assigned to the scalable precision chaos input array ChaosInBuf. After one iteration of the scalable precision chaos equation ChaosMap, the result is saved in the scalable precision chaos output array ChaosOutBuf.

6. The virus signature code parallel detection method based on scalable precision chaotic hashing according to claim 3 is characterized in that: The method for the main service program to configure the virus signature database includes: Before performing computer virus detection, the i-th database location DBLocation_L of the virus signature database is i Assigned to the i-th slave program Slave_i, the slave program Slave_i detects computer viruses in the i-th category file File_i; When performing computer virus detection, according to the category of the file to be detected, it is sent to the database location DBLocation_L of the virus signature database i The slave program Slave_i is used for detection.

7. The virus signature code parallel detection method based on scalable precision chaotic hashing according to claim 3 is characterized in that: The virus verification includes verifying the virus category, verifying the number of newly added virus codes in the service program, verifying the total number of virus codes in the service program and verifying the total number of virus categories.

8. The virus signature code parallel detection method based on scalable precision chaotic hashing according to claim 3 is characterized in that: The main service program step also includes a step of screening key detection files, including: Set the critical value P of virus occurrence frequency; Calculate the virus occurrence frequency of each virus category. When the virus occurrence frequency P of the i-th virus category CVType_i i When it is greater than the virus occurrence frequency critical value P, the corresponding computer virus category CVType_i is set as the key detection file type.

9. The virus signature code parallel detection method based on scalable precision chaotic hashing according to claim 3 is characterized in that: The method for executing computer virus detection from the service program includes: Extracting the code key bit array of the file to be detected, formatting the code key bit array, and obtaining an expandable precision chaos input array ChaosInBuf; The scalable precision chaotic input array ChaosInBuf is used as input, and the scalable precision chaotic output array ChaosOutBuf is obtained after iterating the scalable precision chaotic hash function. The scalable precision chaotic output array ChaosOutBuf is compared with the hash array HashArray. If the match is successful, the file to be detected is a virus-infected file, otherwise, it is a safe file.

Images