Virus scanning processing method and device, equipment and storage medium

Abstract

The invention provides a virus scanning processing method and device, equipment and a storage medium. Relates to the technical field of big data. The method comprises the steps of obtaining a scanning request; the scanning request comprises event information of the to-be-scanned product, and the event information comprises directory information of the to-be-scanned product and files under the directory information. According to the scanning request, the event information of the to-be-scanned product is analyzed, and a product analysis result and the technical component information of the to-be-scanned product are generated. And generating product file version information according to the product analysis result. Based on the product analysis result, the technical component information and the product file version information, performing virus scanning processing on a file and / or a technical component of the to-be-scanned product to generate a virus scanning result; the virus scanning result is used as the scanning result of the same file and / or technical component in the virus scanning process of other products. According to the method, the problem that in the prior art, the virus scanning efficiency of products is low is solved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a virus scanning and processing method, device, equipment and storage medium. Background Art

[0002] At present, the architecture governance of enterprise-level applications has always been a relatively advanced and complex topic in the computer field. Because the architecture itself is a high-level abstraction, based on organizations of different sizes and different analysis perspectives, everyone has different ideas about enterprise-level computer architecture. Enterprise-level architecture can effectively guide business and computer teams to transform enterprise strategic goals and enterprise business knowledge into enterprise computer capabilities and business operation capabilities, and integrate business operations and computer systems.

[0003] In the prior art, in terms of virus scanning of enterprise products, after the product is submitted, the files and / or technical components in the product are usually fully analyzed and scanned one by one according to a silo scanning method, and the overall result of the single product is returned.

[0004] However, in the prior art, since it is necessary to fully analyze and scan the files and / or technical components in the product one by one, if an enterprise has multiple products, each product includes a large number of files and / or technical components, and since enterprise-level computer technology resources are widely reusable across products, each product may include the same files and / or technical components, but in the scanning process of each product, it is necessary to scan independently, which may lead to repeated scanning, which takes a long time and causes huge waste of resources and efficiency. Summary of the invention

[0005] The present application provides a virus scanning processing method, device, equipment and storage medium to solve the problem of low efficiency of virus scanning of products in the prior art.

[0006] In a first aspect, the present application provides a virus scanning processing method, comprising:

[0007] Obtaining a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information;

[0008] Parsing the event information of the product to be scanned according to the scanning request to generate a product parsing result and technical component information of the product to be scanned;

[0009] Generate product file version information according to the product analysis result;

[0010] Based on the product parsing result, the technical component information and the product file version information, virus scanning is performed on the files and / or technical components of the product to be scanned to generate a virus scanning result; wherein the virus scanning result is used in the virus scanning process of other products as the scanning result of the same files and / or technical components.

[0011] In a possible design, based on the product parsing result, the technical component information and the product file version information, performing virus scanning processing on the files and / or technical components of the product to be scanned to generate a virus scanning result includes:

[0012] Based on the product analysis result, the technical component information, the product file version information, and a preset virus library, filtering files and / or technical components of the product to be scanned that do not meet the virus version in the virus library;

[0013] Perform virus scanning on the filtered files and / or technical components to generate virus scanning results.

[0014] In a possible design, performing virus scanning on the filtered files and / or technical components to generate virus scanning results includes:

[0015] According to the product analysis result, product file version information, and a preset virus library, if it is determined that the filtered file includes a file that has not been scanned under the virus library version in the virus library or a changed file, output the file or the changed file to a target scanning space;

[0016] Read the technical component information and the historical killing information of the technical components contained in the technical component information;

[0017] According to the historical killing information of the technical component, if it is determined that the filtered technical component has no scanning record, or the last scanning result does not meet the latest preset scanning rule information, the technical component is output to the target scanning space; wherein the preset scanning rule information represents the scanning requirements of the technical component during the scanning process;

[0018] Perform virus scanning on the target object in the target scanning space to generate a virus scanning result.

[0019] In a possible design, after performing virus scanning processing on the files and / or technical components of the product to be scanned based on the product parsing result, the technical component information and the product file version information to generate a virus scanning result, the method further includes:

[0020] receiving other scan requests for other artifacts;

[0021] If it is determined based on the other scanning requests that the files and / or technical components in the other products are the same as the target objects in the target scanning space, the virus scanning results of the same files and / or technical components in the target scanning space are obtained, and the virus scanning results of the same files and / or technical components are used as the virus scanning results of the files and / or technical components in the other products.

[0022] In a possible design, parsing the event information of the product to be scanned according to the scanning request to generate a product parsing result and technical component information of the product to be scanned includes:

[0023] Based on the preset product rule information and according to the scanning request, scanning the directory information of the product to be scanned and the files under the directory information;

[0024] Decompressing files of a preset type in the directory information to generate product analysis results;

[0025] Perform a technical component scan on files of a preset type in the directory information to generate technical component information of the product to be scanned.

[0026] In a possible design, the artifact analysis result includes the details of the internal file resources of the artifact, and the technical component information includes the component dependency information and dependency version change information of the artifact to be scanned.

[0027] In a second aspect, the present application provides a virus scanning and processing device, comprising:

[0028] An acquisition module, configured to acquire a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information;

[0029] A parsing module, configured to parse the event information of the product to be scanned according to the scanning request, and generate a product parsing result and technical component information of the product to be scanned;

[0030] A generation module, used to generate product file version information according to the product analysis result;

[0031] A virus scanning module is used to perform virus scanning on the files and / or technical components of the product to be scanned based on the product analysis results, the technical component information and the product file version information, and generate virus scanning results; wherein the virus scanning results are used as the scanning results of the same files and / or technical components in the virus scanning process of other products.

[0032] In a possible design, the virus scanning module includes:

[0033] A filtering unit, configured to filter files and / or technical components of the product to be scanned that do not satisfy the virus version in the virus library based on the product parsing result, the technical component information, the product file version information, and a preset virus library;

[0034] The virus scanning unit is used to perform virus scanning processing on the filtered files and / or technical components and generate virus scanning results.

[0035] In a possible design, the virus scanning unit includes:

[0036] A first determination subunit is configured to output the file or the changed file to a target scanning space if it is determined that the filtered file includes a file that has not been scanned under the virus library version in the virus library or a changed file based on the product parsing result, the product file version information, and a preset virus library;

[0037] A reading subunit, used for reading the technical component information and the historical killing information of the technical components contained in the technical component information;

[0038] The second determination subunit is used to output the technical component to the target scanning space if it is determined that the filtered technical component has no scanning record or the last scanning result does not meet the latest preset scanning rule information based on the historical killing information of the technical component; wherein the preset scanning rule information represents the scanning requirements of the technical component during the scanning process;

[0039] The virus scanning subunit is used to perform virus scanning processing on the target object in the target scanning space and generate a virus scanning result.

[0040] In one possible design, the device further includes:

[0041] A receiving module, configured to perform virus scanning processing on the files and / or technical components of the product to be scanned based on the product parsing result, the technical component information and the product file version information, and after generating a virus scanning result, receive other scanning requests for other products;

[0042] A determination module is used to obtain virus scanning results of the same files and / or technical components in the target scanning space if it is determined according to the other scanning requests that there are files and / or technical components in the other products that are the same as the target objects in the target scanning space, and use the virus scanning results of the same files and / or technical components as the virus scanning results of the files and / or technical components in the other products.

[0043] In a possible design, the parsing module includes:

[0044] A first scanning unit, configured to scan the directory information of the product to be scanned and the files under the directory information according to the scanning request based on preset product rule information;

[0045] A decompression unit, used to decompress files of a preset type in the directory information to generate a product parsing result;

[0046] The second scanning unit is used to perform technical component scanning on files of a preset type in the directory information to generate technical component information of the product to be scanned.

[0047] In a possible design, the artifact analysis result includes the details of the internal file resources of the artifact, and the technical component information includes the component dependency information and dependency version change information of the artifact to be scanned.

[0048] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the virus scanning and processing method described in the first aspect and various possible designs of the first aspect.

[0049] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the virus scanning and processing method described in the first aspect and various possible designs of the first aspect is implemented.

[0050] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the virus scanning and processing method described in the first aspect and various possible designs of the first aspect.

[0051] The virus scanning processing method, device, equipment and storage medium provided by the present application obtain a scanning request; wherein the scanning request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information. According to the scanning request, the event information of the product to be scanned is parsed to generate product parsing results and technical component information of the product to be scanned. According to the product parsing results, product file version information is generated. Based on the product parsing results, technical component information and product file version information, the files and / or technical components of the product to be scanned are subjected to virus scanning processing to generate virus scanning results; wherein the virus scanning results are used as the scanning results of the same files and / or technical components in the virus scanning process of other products. In this scheme, based on the product parsing results, technical component information and product file version information, the files and / or technical components of the product to be scanned are subjected to virus scanning processing to generate virus scanning results. In the subsequent virus scanning process of other products, the virus scanning results of the files and / or technical components can be used as the scanning results of the same files and / or technical components in other products. Therefore, the global sharing mechanism of scanning results at the file (document) and technical component levels for enterprise-level products proposed in this application realizes the reuse of scanning results of the same files and / or technical components based on enterprise-level products and technical components, realizes the product virus scanning process based on enterprise-level sharing, and optimizes the scanning efficiency of products. Compared with the silo-type virus scanning method, it can greatly reduce the number of times that widely reused technical components are repeatedly scanned in different products, and can reduce the scanning resource consumption of unchanged assets in multiple versions of unified products, greatly improve the scanning efficiency, reduce the scanning resource consumption, and solve the problem of low efficiency of virus scanning of products in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0053] Figure 1 A flowchart of a virus scanning method provided in an embodiment of the present application;

[0054] Figure 2 A flowchart of another virus scanning method provided in an embodiment of the present application;

[0055] Figure 3 A schematic diagram of the architecture of a virus scanning processing method provided in an embodiment of the present application;

[0056] Figure 4 A schematic diagram of the structure of a virus scanning and processing device provided in an embodiment of the present application;

[0057] Figure 5A schematic diagram of the structure of another virus scanning and processing device provided in an embodiment of the present application;

[0058] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0059] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0060] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0061] It should be noted that in the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse. In addition, in the embodiments of this application, some existing solutions in the industry such as certain software, components, models, etc. may be mentioned, and they should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or must use the solution.

[0062] At present, the architecture governance of enterprise-level applications has always been a relatively advanced and complex topic in the computer field. Because the architecture itself is a high-level abstraction, based on organizations of different sizes and different analysis perspectives, everyone has different ideas about enterprise-level computer architecture. Enterprise-level architecture can effectively guide business and computer teams to transform enterprise strategic goals and enterprise business knowledge into enterprise computer capabilities and business operation capabilities, and integrate business operations and computer systems.

[0063] From the perspective of most application developers or small businesses, technical components or component frameworks such as Spring Cloud, Dubbo, and SpringFramework are enterprise-level architectures. Distributed service strategies, end-to-end monitoring, and other technologies are usually the responsibility of architects. However, within some large financial companies, based on the industry-leading architectural perspectives and concepts, we will scientifically divide the enterprise-level architecture in an orderly manner based on the company's strategic goals. For example, a large bank has made the following definition of enterprise-level architecture:

[0064] Enterprise architecture is a description of the business operations and computer support framework of an enterprise, including business architecture and computer architecture. Computer architecture includes application architecture, data architecture, technical architecture and security architecture. The above description scientifically and completely describes the scope and hierarchical division of enterprise architecture. It can also effectively guide the business and computer teams to transform enterprise strategic goals and business knowledge into enterprise computer capabilities and business operation capabilities, and integrate business operations and computer systems.

[0065] In traditional large banks, since their main business is banking, the personnel roles of enterprises have a good understanding of banking business and clear governance ideas. Therefore, they often have good division capabilities and management ideas in the management of business architecture and application architecture in computer architecture. However, in other areas of computer architecture, such as technical architecture, there is no clear hierarchical division and effective governance structure due to professional reasons. In practice, although the internal structure of enterprises is divided into architectural levels and governance areas, there is no effective management method and tool implementation.

[0066] In one example, in terms of virus scanning of enterprise products, after the product is submitted, the files and / or technical components in the product are usually fully analyzed and scanned one by one according to the silo scanning method, and the overall results of the single product are returned. However, in the prior art, since the files and / or technical components in the product need to be fully analyzed and scanned one by one, if the enterprise has multiple products, each product includes a large number of files and / or technical components, and because enterprise-level computer technology resources are widely reusable across products, each product may include the same files and / or technical components, but in the scanning process of each product, it is necessary to scan independently, which may lead to repeated scanning, which takes a long time and causes a huge waste of resources and efficiency.

[0067] In response to the above technical problems, the present application proposes the following technical concept: virus scanning is performed on the files and / or technical components of the product to be scanned, and a global sharing mechanism is implemented for the obtained virus scanning results, that is, the virus scanning results of the same files and / or technical components can be reused. In this way, the problem of low efficiency of virus scanning of products in the prior art can be solved.

[0068] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0069] Figure 1 A flowchart of a virus scanning method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0070] Step 101: Obtain a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information.

[0071] For example, the execution subject of this embodiment may be an electronic device, or a terminal device, or a virus scanning processing device or device, or other devices or equipment that can execute this embodiment, and there is no limitation to this. In this embodiment, the execution subject is introduced as an electronic device.

[0072] First, obtain a scan request. The scan request can be initiated by a computer management platform. The computer management platform has key business information of the product, which includes the directory structure of the product and the standard files under the directory structure. Relevant personnel can upload multiple products on the computer management platform according to the key business information and initiate a scan request for product verification; the scan request includes event information of the product to be scanned, which includes the directory information of the product to be scanned and the files recorded under the directory information.

[0073] Step 102: According to the scanning request, the event information of the product to be scanned is parsed to generate a product parsing result and technical component information of the product to be scanned.

[0074] Exemplarily, according to the scanning request, according to the directory structure of the key business information of the product provided by the computer management platform, according to the preset product rule information, the directory information in the event information of the product to be scanned is scanned, and the files of the preset type under the directory information are decompressed to form the product analysis result, which includes the product internal file (document) resource details. The event information of the product to be scanned is analyzed to generate the technical component information of the product to be scanned, and the technical component information includes component dependency information and dependency version change information. Furthermore, an enterprise-level component dependency view can be formed based on the technical component information.

[0075] Step 103: Generate product file version information based on the product analysis result.

[0076] Exemplarily, according to the artifact internal file (document) resource details in the artifact parsing result, artifact file (document) version information may be generated.

[0077] Step 104: Based on the product analysis results, technical component information, and product file version information, virus scanning is performed on the files and / or technical components of the product to be scanned to generate virus scanning results; wherein the virus scanning results are used in the virus scanning process of other products as the scanning results of the same files and / or technical components.

[0078] Exemplarily, the products are all composed of files and / or technical components. Based on the product parsing results, technical component information, and product file version information, virus scanning is performed on the files and / or technical components of the product to be scanned to generate virus scanning results. During the virus scanning process of other products, if the other products include the same files and / or technical components, the same files and / or technical components do not need to be scanned repeatedly, and the virus scanning results of the files and / or technical components of the product to be scanned can be directly used as the scanning results of the same files and / or technical components.

[0079] In an embodiment of the present application, a scan request is obtained; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information. According to the scan request, the event information of the product to be scanned is parsed to generate product parsing results and technical component information of the product to be scanned. According to the product parsing results, product file version information is generated. Based on the product parsing results, technical component information, and product file version information, virus scanning processing is performed on the files and / or technical components of the product to be scanned, and virus scanning results are generated; wherein the virus scanning results are used as the scanning results of the same files and / or technical components in the virus scanning process of other products. In this solution, based on the product parsing results, technical component information, and product file version information, virus scanning processing is performed on the files and / or technical components of the product to be scanned, and virus scanning results are generated. In the subsequent virus scanning process of other products, the virus scanning results of the files and / or technical components can be used as the scanning results of the same files and / or technical components in other products. Therefore, the global sharing mechanism of scanning results at the file (document) and technical component levels for enterprise-level products proposed in this application realizes the reuse of scanning results of the same files and / or technical components based on enterprise-level products and technical components, realizes the product virus scanning process based on enterprise-level sharing, and optimizes the scanning efficiency of products. Compared with the silo-type virus scanning method, it can greatly reduce the number of times that widely reused technical components are repeatedly scanned in different products, and can reduce the scanning resource consumption of unchanged assets in multiple versions of unified products, greatly improve the scanning efficiency, reduce the scanning resource consumption, and solve the problem of low efficiency of virus scanning of products in the prior art.

[0080] Figure 2 A flowchart of another virus scanning method provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the method includes:

[0081] Step 201: Obtain a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information.

[0082] For example, this step can be referred to Figure 1 Step 101 in the above is not described in detail.

[0083] Step 202: Based on the preset product rule information and according to the scanning request, scan the directory information of the product to be scanned and the files under the directory information.

[0084] Exemplarily, the product rule information represents the internal structure of the product, that is, the directory information of the product and the files under the directory information. Based on the preset product rule information, according to the scanning request, the directory information of the product to be scanned and the files under the directory information are scanned.

[0085] Step 203: decompress files of preset types in the directory information to generate product analysis results.

[0086] In one example, the artifact parsing result includes the artifact internal file resource details.

[0087] Exemplarily, the directory information includes multiple types of files, the multiple types of files are identified, files of a preset type are determined, and the files of the preset type are decompressed to generate a product parsing result.

[0088] Step 204: Perform a technical component scan on files of a preset type in the directory information to generate technical component information of the product to be scanned.

[0089] In one example, the technical component information includes component dependency information and dependency version change information of the artifact to be scanned.

[0090] Exemplarily, the electronic device may perform a technical component scan on files of a preset type in the directory information to generate technical component information of the product to be scanned, where the technical component information includes component dependency information and dependency version change information of the product to be scanned.

[0091] Step 205: Generate product file version information based on the product analysis result.

[0092] Exemplarily, the electronic device generates product file version information according to the product analysis result. The product file version information may also be expressed as product file (document) version information.

[0093] Step 206: Based on the product analysis result, technical component information, product file version information, and a preset virus library, files and / or technical components of the product to be scanned that do not satisfy the virus version in the virus library are filtered.

[0094] In one example, step 206 includes: based on the product analysis results, product file version information, and a preset virus library, if it is determined that the filtered files include files that have not been scanned under the virus library version in the virus library or have been changed, then the files or changed files are output to the target scanning space; the technical component information and the historical killing information of the technical components contained in the technical component information are read; based on the historical killing information of the technical components, if it is determined that the filtered technical components have no scanning records, or the last scanning result does not meet the latest preset scanning rule information, then the technical components are output to the target scanning space; wherein the preset scanning rule information represents the scanning requirements of the technical components during the scanning process; virus scanning is performed on the target objects in the target scanning space to generate virus scanning results.

[0095] Exemplarily, for the files in the product to be scanned, the electronic device reads the product analysis result, and matches and judges the files one by one according to the product file version information and the update status of the virus library version in the preset virus library. If it is determined that there are files that have not been scanned under the virus library version in the virus library or have been changed, the files or changed files are output to the target scanning space. Other scanned files that meet the virus library version are ignored and do not need to be output to the target scanning space for rescanning.

[0096] For the technical components in the product to be scanned, read the technical component information, which includes the component dependency information and dependency version change information of the product to be scanned. According to the historical killing information of the technical components, such as the killing record, the killing virus library version, etc., determine whether the technical component needs to be re-scanned. If there is no scanning record or the last scanning result no longer meets the latest preset scanning rule information, then the technical component is included in the target scanning scope again. Among them, the preset scanning rule information represents the scanning requirements of the technical component during the scanning process, and the preset scanning rule information can be updated at any time.

[0097] Step 207: Perform virus scanning on the filtered files and / or technical components to generate virus scanning results; wherein the virus scanning results are used in the virus scanning process of other products as the scanning results of the same files and / or technical components.

[0098] Exemplarily, after filtering the files and / or technical components, the electronic device performs a virus scan on the filtered files and / or technical components that enter the target scanning space to obtain a virus scan result. It should be noted that there are multiple products in the enterprise, and there are a large number of reused files and technical components in the same product, or in different versions of the same product, or between different products. When a global virus scan is performed on any product, that is, when a resource (file, technical component) is scanned once, the generated virus scan result can be reused in all products, that is, there is no need to repeat the virus scan.

[0099] Step 208: Receive other scan requests for other products.

[0100] Exemplarily, since the computer management platform stores a variety of products, other scanning requests for other products may be received.

[0101] Step 209: If, based on other scanning requests, it is determined that the files and / or technical components in other products are the same as the target objects in the target scanning space, the virus scanning results of the same files and / or technical components in the target scanning space are obtained, and the virus scanning results of the same files and / or technical components are used as the virus scanning results of the files and / or technical components in other products.

[0102] Exemplarily, the electronic device can determine whether there are reused files and / or technical components in other products based on other scanning requests. If it is determined that the files and / or technical components in other products are the same as the target objects in the target scanning space, the virus scanning results of the same files and / or technical components in the target scanning space are obtained, and the virus scanning results of the same files and / or technical components are used as the virus scanning results of the files and / or technical components in other products, so the reused files and / or technical components in other products do not need to be scanned repeatedly; wherein the target object refers to the files and / or technical components in the target scanning space.

[0103] In an embodiment of the present application, a scan request is obtained; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information. Based on the preset product rule information, the directory information of the product to be scanned and the files under the directory information are scanned according to the scan request. The files of the preset type in the directory information are decompressed to generate a product parsing result. The files of the preset type in the directory information are scanned for technical components to generate technical component information of the product to be scanned. According to the product parsing result, the product file version information is generated. Based on the product parsing result, the technical component information, the product file version information, and the preset virus library, the files and / or technical components of the product to be scanned that do not meet the virus version in the virus library are filtered. The filtered files and / or technical components are scanned for viruses to generate virus scanning results; wherein the virus scanning results are used as the scanning results of the same files and / or technical components in the virus scanning process of other products. Other scanning requests for other products are received. If, according to other scanning requests, it is determined that there are files and / or technical components in other products that are the same as the target object in the target scanning space, the virus scanning results of the same files and / or technical components in the target scanning space are obtained, and the virus scanning results of the same files and / or technical components are used as the virus scanning results of files and / or technical components in other products. Therefore, the global sharing mechanism for scanning results at the file (document) and technical component levels for enterprise-level products proposed in this application realizes the reuse of scanning results of the same files and / or technical components based on enterprise-level products and technical components, realizes the product virus scanning process based on enterprise-level sharing, and optimizes the scanning efficiency of products. Compared with the silo-type virus scanning method, it can greatly reduce the number of times that widely reused technical components are repeatedly scanned in different products, and can reduce the scanning resource consumption of assets that have not been changed in multiple versions of unified products, greatly improve the scanning efficiency, reduce the scanning resource consumption, and solve the problem of low efficiency of virus scanning of products in the prior art. At the same time, it also realizes the role of global virus risk control of technical components and product files (documents) at the enterprise level.

[0104] In one example, Figure 3 A schematic diagram of the architecture of a virus scanning processing method provided in an embodiment of the present application is shown as follows: Figure 3 As shown, the device is used for virus detection and killing of enterprise-level products, including: an enterprise computer management platform, a product parsing module, a product scanning module, a file (document) management module, a technical component management module, and a virus detection and killing module.

[0105] Based on the computer management platform: establish key business information of products, including the catalog structure and standard content information of products. Provide relevant personnel with a process for uploading products and initiating product inspection.

[0106] Product parsing module: Based on the product internal structure provided by the computer management platform, according to specific rules, scan the directory structure, and decompress the files of the preset type to form the product parsing results, including the product internal file (document) resource details. Based on the product parsing results, the product file (document) version information is formed.

[0107] Technical component management module: Perform technical component scans on files of preset types to obtain the technical component information of the product. The technical component information includes component dependency information and dependency version change information, forming an enterprise-level component dependency view.

[0108] Virus detection module: Based on the product analysis results, product file (document) version information, and product technical component related information, use the antivirus engine to scan the product content for viruses. Specifically, it includes: reading the product analysis results, matching and judging based on file (document) change information and virus library update status, and outputting files that have not been scanned under the required virus library version or changed files to the scan target space. Other scanned files that meet the rules are ignored. Read the product's technical component information, and determine whether the technical component needs to be rescanned based on the historical detection information of the technical component (including detection records, virus library version, etc.). If there is no scan record or the last scan result no longer meets the current scan rule requirements, the component will be included in the scan scope again.

[0109] Virus detection module: After filtering according to the above files and technical components, perform virus scanning on the files entering the target scanning space to obtain virus scanning results.

[0110] File (document) management module: records virus scan results, specific files (documents) with viruses

[0111] poison

[0112] Scan results. Technical component management module: records the virus scan results of technical components. The above virus scan results can be shared in the scans of multiple products of this version.

[0113] Figure 4 A schematic diagram of the structure of a virus scanning and processing device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the device comprises:

[0114] The acquisition module 31 is used to acquire a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information.

[0115] The parsing module 32 is used to parse the event information of the product to be scanned according to the scanning request, and generate the product parsing result and the technical component information of the product to be scanned.

[0116] The generation module 33 is used to generate product file version information according to the product analysis result.

[0117] The virus scanning module 34 is used to perform virus scanning on the files and / or technical components of the scanned product based on the product analysis results, technical component information and product file version information, and generate virus scanning results; wherein the virus scanning results are used as the scanning results of the same files and / or technical components in the virus scanning process of other products.

[0118] The device of this embodiment can execute the technical solution in the above method. Its specific implementation process and technical principles are the same and will not be repeated here.

[0119] Figure 5 A schematic diagram of the structure of another virus scanning and processing device provided in an embodiment of the present application, in Figure 4 Based on the embodiment shown, Figure 5 As shown, the virus scanning module 34 includes:

[0120] The filtering unit 341 is used to filter the files and / or technical components of the scanned product that do not meet the virus version in the virus library based on the product analysis result, technical component information, product file version information, and a preset virus library.

[0121] The virus scanning unit 342 is used to perform virus scanning processing on the filtered files and / or technical components to generate virus scanning results.

[0122] In one example, the virus scanning unit 342 includes:

[0123] The first determination subunit 3421 is used to output the files or changed files to the target scanning space based on the product analysis results, product file version information, and the preset virus library if it is determined that the filtered files include files that have not been scanned under the virus library version in the virus library or changed files.

[0124] The reading subunit 3422 is used to read the technical component information and the historical killing information of the technical components contained in the technical component information.

[0125] The second determination subunit 3423 is used to output the technical component to the target scanning space based on the historical detection and killing information of the technical component. If it is determined that the filtered technical component has no scanning record, or the last scanning result does not meet the latest preset scanning rule information, the preset scanning rule information represents the scanning requirements of the technical component during the scanning process.

[0126] The virus scanning subunit 3424 is used to perform virus scanning processing on the target object in the target scanning space and generate a virus scanning result.

[0127] In one example, the device further includes:

[0128] The receiving module 41 is used to perform virus scanning on the files and / or technical components of the product to be scanned based on the product analysis results, technical component information and product file version information, and after generating the virus scanning results, receive other scanning requests for other products.

[0129] The determination module 42 is used to obtain the virus scanning results of the same files and / or technical components in the target scanning space if it is determined based on other scanning requests that there are files and / or technical components in other products that are the same as the target objects in the target scanning space, and use the virus scanning results of the same files and / or technical components as the virus scanning results of the files and / or technical components in other products.

[0130] In one example, the parsing module 32 includes:

[0131] The first scanning unit 321 is used to scan the directory information of the product to be scanned and the files under the directory information based on the preset product rule information and the scanning request.

[0132] The decompression unit 322 is used to decompress files of a preset type in the directory information to generate product parsing results.

[0133] The second scanning unit 323 is used to perform technical component scanning on files of a preset type in the directory information to generate technical component information of the product to be scanned.

[0134] In one example, the artifact analysis result includes the artifact internal file resource details, and the technical component information includes the component dependency information and dependency version change information of the artifact to be scanned.

[0135] The device of this embodiment can execute the technical solution in the above method. Its specific implementation process and technical principles are the same and will not be repeated here.

[0136] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. Each module can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The functions of each module. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0137] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the electronic device may include: a transceiver 121 , a processor 122 , and a memory 123 .

[0138] The processor 122 executes the computer execution instructions stored in the memory, so that the processor 122 executes the scheme in the above embodiment. The processor 122 can be a general-purpose processor, including a central processing unit CPU, a network processor (network processor, NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0139] The memory 123 is connected to the processor 122 via a system bus and completes communication between them. The memory 123 is used to store computer program instructions.

[0140] The transceiver 121 may be used to obtain tasks to be executed and configuration information of the tasks to be executed.

[0141] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.

[0142] The electronic device provided in the embodiment of the present application may be the terminal device of the above embodiment.

[0143] The embodiment of the present application also provides a chip for running instructions, which is used to execute the technical solution of the virus scanning processing method in the above embodiment.

[0144] The embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution of the virus scanning processing method of the above embodiment.

[0145] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the technical solution of the virus scanning processing method in the above embodiment can be implemented.

[0146] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0147] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0148] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0149] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0150] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0151] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0152] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0153] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0154] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic control unit or a main control device.

[0155] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0156] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A virus scanning processing method, characterized in that: include: Obtaining a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information; Parsing the event information of the product to be scanned according to the scanning request to generate a product parsing result and technical component information of the product to be scanned; Generate product file version information according to the product analysis result; Based on the product parsing result, the technical component information and the product file version information, virus scanning is performed on the files and / or technical components of the product to be scanned to generate a virus scanning result; wherein the virus scanning result is used in the virus scanning process of other products as the scanning result of the same files and / or technical components.

2. The method according to claim 1, characterized in that The step of performing virus scanning on the files and / or technical components of the product to be scanned based on the product parsing result, the technical component information and the product file version information to generate a virus scanning result includes: Based on the product analysis result, the technical component information, the product file version information, and a preset virus library, filtering files and / or technical components of the product to be scanned that do not meet the virus version in the virus library; Perform virus scanning on the filtered files and / or technical components to generate virus scanning results.

3. The method according to claim 2, characterized in that The virus scanning process is performed on the filtered files and / or technical components to generate virus scanning results, including: According to the product analysis result, product file version information, and a preset virus library, if it is determined that the filtered file includes a file that has not been scanned under the virus library version in the virus library or a changed file, output the file or the changed file to a target scanning space; Read the technical component information and the historical killing information of the technical components contained in the technical component information; According to the historical killing information of the technical component, if it is determined that the filtered technical component has no scanning record, or the last scanning result does not meet the latest preset scanning rule information, the technical component is output to the target scanning space; wherein the preset scanning rule information represents the scanning requirements of the technical component during the scanning process; Perform virus scanning on the target object in the target scanning space to generate a virus scanning result.

4. The method according to claim 3, characterized in that After performing virus scanning processing on the files and / or technical components of the product to be scanned based on the product parsing result, the technical component information and the product file version information to generate a virus scanning result, the method further includes: receiving other scan requests for other artifacts; If it is determined based on the other scanning requests that the files and / or technical components in the other products are the same as the target objects in the target scanning space, the virus scanning results of the same files and / or technical components in the target scanning space are obtained, and the virus scanning results of the same files and / or technical components are used as the virus scanning results of the files and / or technical components in the other products.

5. The method according to any one of claims 1 to 4, characterized in that: The step of parsing the event information of the product to be scanned according to the scanning request to generate a product parsing result and technical component information of the product to be scanned includes: Based on the preset product rule information and according to the scanning request, scanning the directory information of the product to be scanned and the files under the directory information; Decompressing files of a preset type in the directory information to generate product analysis results; Perform a technical component scan on files of a preset type in the directory information to generate technical component information of the product to be scanned.

6. The method according to claim 5, characterized in that The artifact analysis result includes the details of the internal file resources of the artifact, and the technical component information includes the component dependency information and dependency version change information of the artifact to be scanned.

7. A virus scanning and processing device, characterized in that: include: An acquisition module, configured to acquire a scan request; wherein the scan request includes event information of the product to be scanned, and the event information includes directory information of the product to be scanned and files under the directory information; A parsing module, configured to parse the event information of the product to be scanned according to the scanning request, and generate a product parsing result and technical component information of the product to be scanned; A generation module, used to generate product file version information according to the product analysis result; A virus scanning module is used to perform virus scanning on the files and / or technical components of the product to be scanned based on the product analysis results, the technical component information and the product file version information, and generate virus scanning results; wherein the virus scanning results are used as the scanning results of the same files and / or technical components in the virus scanning process of other products.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images