Computer virus detection system and method, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a computer virus detection system and method, electronic equipment and a storage medium, and relates to the technical field of cloud security. The system at least comprises a local detection layer, a cloud detection layer, a cloud sandbox simulation layer and a data aggregation layer, wherein the cloud detection layer and the cloud sandbox simulation layer are connected with the local detection layer, and the data aggregation layer is connected with the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. Hierarchical detection is carried out through the local detection layer, the cloud detection layer and the cloud sandbox simulation layer, resource occupation can be effectively reduced, the system operation performance is improved, more comprehensive detection results can be covered based on hierarchical detection, and the detection efficiency is improved under the condition that corresponding detection results can be obtained through the local detection layer. According to the method, data uploading is reduced, the probability of user data leakage is reduced, target objects which cannot be detected by both the local and the cloud are detected through cloud sandbox simulation, computer viruses which are not recorded are effectively handled, and the protection capability is improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud security technology, and in particular to a computer virus detection system, a computer virus detection method, an electronic device and a computer readable storage medium. Background Art

[0002] As network security threats continue to evolve, traditional virus detection strategies and methods can no longer meet the high standards of security, efficiency, privacy and resource management in modern society. In the process of detecting computer viruses, there are often problems such as excessive use of device resources, affecting the performance of the device, or being too dependent on the network environment, limiting the practicality of computer virus detection, and easily leaking user data. Summary of the invention

[0003] The embodiments of the present invention provide a computer virus detection system, method, electronic device and computer readable storage medium to solve or partially solve the problems of excessive resource usage, low practicality and easy leakage of user data in the process of computer virus detection.

[0004] The embodiment of the present invention discloses a computer virus detection system, which comprises at least a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data aggregation layer connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer respectively; wherein:

[0005] The local detection layer is used to determine a target object to be detected, perform virus detection on the target object, and generate a first detection result for the target object;

[0006] The cloud detection layer is configured to receive an object identifier corresponding to the target object sent by the local detection layer, and perform virus detection on the target object based on the object identifier to generate a second detection result for the target object if the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus;

[0007] The cloud sandbox simulation layer is used to receive the target object sent by the local detection layer if the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, and in response to performing a simulated operation on the target object, obtain corresponding behavior information during the operation, perform virus detection on the target object according to the behavior information, and generate a third detection result for the target object;

[0008] The data aggregation layer is used to present the first detection result, or to present the first detection result and the second detection result, or to present the first detection result, the second detection result and the third detection result.

[0009] The embodiment of the present invention further discloses a computer virus detection method, which is applied to a computer virus detection system, wherein the computer virus detection system at least comprises a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data convergence layer respectively connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer; wherein the method comprises:

[0010] Determine a target object to be detected through the local detection layer, perform virus detection on the target object, and generate a first detection result for the target object;

[0011] If the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus, the cloud detection layer receives an object identifier corresponding to the target object sent by the local detection layer, and performs virus detection on the target object based on the object identifier to generate a second detection result for the target object;

[0012] If the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, the cloud sandbox simulation layer receives the target object sent by the local detection layer, and in response to simulating the operation of the target object, obtains corresponding behavior information during the operation, performs virus detection on the target object according to the behavior information, and generates a third detection result for the target object;

[0013] The first detection result is presented through the data convergence layer, or the first detection result and the second detection result are presented, or the first detection result, the second detection result and the third detection result are presented.

[0014] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0015] The memory is used to store computer programs;

[0016] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0017] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0018] The embodiments of the present invention include the following advantages:

[0019] In an embodiment of the present invention, a computer virus detection system may include a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data convergence layer respectively connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. In the process of performing virus detection on a target object to be detected, the target object to be detected is determined by the local detection layer, and virus detection is performed on the target object to generate a first detection result for the target object. If the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus, the cloud detection layer receives an object identifier corresponding to the target object sent by the local detection layer, and performs virus detection on the target object based on the object identifier to generate a second detection result for the target object. If the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, the cloud sandbox simulation layer receives the target object sent by the local detection layer, and in response to simulating the operation of the target object, obtains a corresponding behavior information, perform virus detection on the target object according to the behavior information, generate a third detection result for the target object, and present the first detection result through the data aggregation layer, or present the first detection result and the second detection result, or present the first detection result, the second detection result and the third detection result, and perform hierarchical detection through the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. When the detection layer of the previous layer fails to detect whether the target object carries a computer virus, the detection layer of the next layer is used for detection. On the one hand, it can effectively reduce resource usage and improve the performance of system operation. On the other hand, based on hierarchical detection, more comprehensive detection results can be covered. At the same time, when the corresponding detection results can be obtained through the local detection layer, data upload is reduced, which can reduce the probability of leaking user data. In addition, the cloud sandbox simulation is used to detect target objects that cannot be detected locally and in the cloud, which can effectively deal with unrecorded computer viruses and improve the protection capability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a structural block diagram of a computer virus detection system provided in an embodiment of the present invention;

[0021] Figure 2 is a schematic diagram of a scenario of virus detection provided in an embodiment of the present invention;

[0022] Figure 3is a flowchart of a method for detecting a computer virus provided in an embodiment of the present invention;

[0023] Figure 4 It is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] As an example, in the process of detecting computer viruses, there are often problems such as excessive use of device resources, affecting the device's operating performance, or being too dependent on the network environment, limiting the practicality of computer virus detection, and easily leaking user data.

[0026] In this regard, in the present invention, the computer virus detection system may include a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data aggregation layer respectively connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. In the process of performing virus detection on the target object to be detected, the target object to be detected is determined by the local detection layer, and the target object is subjected to virus detection to generate a first detection result for the target object. If the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus, the cloud detection layer receives the object identifier corresponding to the target object sent by the local detection layer, and performs virus detection on the target object based on the object identifier to generate a second detection result for the target object. If the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, the cloud sandbox simulation layer receives the target object sent by the local detection layer, and in response to performing a simulated operation on the target object, obtains the corresponding behavior information, perform virus detection on the target object according to the behavior information, generate a third detection result for the target object, and present the first detection result through the data aggregation layer, or present the first detection result and the second detection result, or present the first detection result, the second detection result and the third detection result, and perform hierarchical detection through the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. When the detection layer of the previous layer fails to detect whether the target object carries a computer virus, the detection layer of the next layer is used for detection. On the one hand, it can effectively reduce resource usage and improve the performance of system operation. On the other hand, based on hierarchical detection, more comprehensive detection results can be covered. At the same time, when the corresponding detection results can be obtained through the local detection layer, data upload is reduced, which can reduce the probability of leaking user data. In addition, the cloud sandbox simulation is used to detect target objects that cannot be detected locally and in the cloud, which can effectively deal with unrecorded computer viruses and improve the protection capability of the system.

[0027] Reference Figure 1 , shows a structural block diagram of a computer virus detection system provided in an embodiment of the present invention, the computer virus detection system at least includes a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data aggregation layer connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer respectively; wherein,

[0028] The local detection layer is used to determine a target object to be detected, perform virus detection on the target object, and generate a first detection result for the target object;

[0029] The cloud detection layer is configured to receive an object identifier corresponding to the target object sent by the local detection layer, and perform virus detection on the target object based on the object identifier to generate a second detection result for the target object if the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus;

[0030] The cloud sandbox simulation layer is used to receive the target object sent by the local detection layer if the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, and in response to performing a simulated operation on the target object, obtain corresponding behavior information during the operation, perform virus detection on the target object according to the behavior information, and generate a third detection result for the target object;

[0031] The data aggregation layer is used to present the first detection result, or to present the first detection result and the second detection result, or to present the first detection result, the second detection result and the third detection result.

[0032] For the computer virus detection system, it can be a system built based on a hierarchical structure, including a local detection layer, a cloud detection layer, a cloud sandbox simulation layer, and a data aggregation layer. The local detection layer is used to filter local data files, etc., and send the unconfirmed data to the cloud detection layer for further matching. If the cloud data of the file is not included, the file can be sent to the cloud sandbox simulation layer for further verification by confirming with the user to cover the virus samples that have not been collected on the current network.

[0033] The target object may include executable files, script files, document files, compressed files, installation packages, network traffic, system files and registries, mobile device files, virtual machine images, and other file types, and the present invention does not limit this.

[0034] Based on the above examples, in the process of computer virus detection, the objects detected may include various types of files and data, which may contain potential malware or viruses. By comprehensively detecting these objects, the overall security of the system can be effectively improved.

[0035] In some feasible implementations, the local detection layer includes at least a local sample comparison component, the local sample comparison component includes at least a local virus file sample and a local security file, and the first detection result includes at least a first virus carrying result, a first security result, and a first unrecognizable result; wherein the local sample comparison component is used to: if the target object successfully matches the local virus file sample, it is confirmed that the target object carries a computer virus, a first virus carrying result for the target object is generated, and the computer virus corresponding to the successfully matched target local virus file sample is used as the target computer virus carried by the target object; if the target object successfully matches the local security file, it is confirmed that the target object does not carry a computer virus, and a first security result for the target object is generated; if the target object fails to match both the local virus file sample and the local security file, a sample matching failure result for the target object is generated.

[0036] In addition, the local detection layer also includes a heuristic virus component, and the first detection result also includes a first unrecognizable result; wherein the heuristic virus component is used to extract static features and dynamic features corresponding to the target object, and detect the virus based on the static features and dynamic features. If there is a first virus feature corresponding to the static feature, and / or there is a second virus feature corresponding to the dynamic feature, then a first virus carrying result for the target object is generated; if there is no first virus feature corresponding to the static feature, and there is no second virus feature corresponding to the dynamic feature, then a first unrecognizable result for the target object is generated.

[0037] In the specific implementation, the local detection layer mainly includes a local sample comparison component and a heuristic virus detection component. The feature samples detected by the local sample comparison component mainly include local virus file samples (blacklist) that are popular in the recent network environment and local security files (whitelist) with a high inspection rate in its own intranet environment. The heuristic virus component can be completed using an open source virus detection engine, such as the clamav engine. The heuristic virus component can identify and prevent previously unknown viruses, as well as adaptive new threats, without being limited to detecting only samples in the known virus database. For the local detection layer, the local detection capability is formed by combining the two components. At the same time, since the hot samples are loaded locally, the resource usage is greatly reduced compared to traditional local detection components.

[0038] It should be noted that the heuristic virus component can analyze the static and dynamic features of the target object to determine whether the target object is malicious. In some feasible implementations, assuming that the target object is a file, the virus detection process of the heuristic virus component on the file may include:

[0039] For the static feature analysis process, static feature analysis refers to analyzing the code structure and content of a file without executing the file. Specifically, first, the file format can be identified, such as PE files (Windows executable files), ELF files (Linux executable files), PDF files, Office documents, etc.; then the file structure can be parsed to identify the various parts of the file, such as code segments, data segments, resource segments, etc.; then the code in the file can be scanned to identify possible malicious code structures and logic. For example, the code for operations such as encryption, decryption, compression, and decompression can be found, and suspicious functions called in the file, such as system calls, API functions, etc., can be identified. These functions may be used to perform malicious operations; then the YARA rules are used to match the features in the file. YARA rules are a rule language used to describe malware features. They can identify specific malicious code patterns and match the features in the file according to the YARA rules, such as specific strings, code snippets, encryption algorithms, etc.; then the file metadata, such as file attributes, creation time, modification time, etc., can be analyzed to identify abnormal metadata information to identify possible abnormal metadata in the file, such as inconsistency between the file creation time and modification time, abnormal file attributes, etc.

[0040] For the dynamic feature analysis process, dynamic feature analysis refers to executing files in an isolated sandbox environment and observing their behavior. Specifically, the file can be placed in an isolated sandbox environment for execution, and its operations on system resources, such as reading and writing files, modifying the registry, network communication, etc., and the execution of the file can be simulated in the sandbox environment, and its behavior log can be recorded. The execution behavior of the file can be monitored in real time, and its operations on system resources, such as file operations, registry operations, network communication, etc., and all the behaviors of the file in the sandbox can be recorded to form a behavior log, and then the behavior pattern of the file can be identified, such as whether it frequently reads and writes specific files, whether it attempts to connect to a specific IP address, etc., and detect whether the file exhibits abnormal behavior, such as trying to hide itself, modifying key system files, and trying to escalate privileges, etc. At the same time, the network communication behavior of the file can be monitored, and the IP address, port, communication content, etc., to which it is connected can be recorded, and whether the file attempts to connect to a malicious IP address or conduct malicious communication, such as C2 server communication, data leakage, etc.

[0041] After the static analysis process and the dynamic analysis process, the analysis results of static features and dynamic features can be combined to conduct a comprehensive evaluation of the file. Specifically, the results of static feature analysis and dynamic feature analysis can be integrated to form a comprehensive detection result, and the file can be judged whether it is malicious based on the matching results of static features and dynamic features. Then, based on the comprehensive evaluation results, the file can be judged whether it is malicious. If the file exhibits malicious behavior or meets the characteristics of malicious code, it is judged as a malicious file. Finally, a detection report is generated to record the analysis results and judgment basis of the file for subsequent analysis and processing.

[0042] Through the above process, the heuristic virus detection component comprehensively evaluates the maliciousness of the file by analyzing the static and dynamic features of the file. Static feature analysis includes file format recognition, code scanning, YARA rule matching and metadata analysis, and dynamic feature analysis includes sandbox execution, behavior monitoring, behavior pattern recognition and network communication analysis. This multi-level analysis method can effectively detect and prevent unknown malware and improve the overall security of the system.

[0043] In an embodiment of the present invention, when the local detection layer cannot confirm whether the target object carries the corresponding computer virus through the local sample comparison component and the heuristic virus detection component, the virus detection process can be pushed to the cloud detection layer so that the cloud detection layer can perform virus detection on the target object. The cloud detection layer at least includes a cloud sample comparison component, and the second detection result at least includes a second virus carrying result, a second safety result, and a second unrecognizable result. In a specific implementation, the full malicious sample feature library and historical data results reported by the user can be loaded through the cloud sample comparison component, and then the object identifier is converted into a corresponding hash value, and the file feature corresponding to the target object is extracted. If the hash value or file feature of the target object successfully matches the entry in the malicious sample feature library, and / or the target object exists in the historical data results and the target object has been marked as malicious, then it is confirmed that the target object carries a computer virus, and a second virus carrying result for the target object is generated; if the hash value or file feature of the target object fails to match the entry in the malicious sample feature library, and the target object exists in the historical data results and the target object has been marked as safe, then it is confirmed that the target object does not carry a computer virus, and a second safe result for the target object is generated; if the hash value or file feature of the target object fails to match the entry in the malicious sample feature library, and the target object does not exist in the historical data results, then a second unrecognizable result for the target object is generated.

[0044] It should be noted that after filtering the local data, the data needs to be pushed to the cloud for detection. The cloud contains a cloud sample comparison component, which can load the full malicious sample feature library and the historical data results reported by the user, so as to compare the big data based on the two and determine whether the target object carries the corresponding computer virus. In the process of computer virus detection on the target object in the cloud detection layer, in order to reduce the consumption of network resources, the detection can be carried out by only transmitting the unique identifier of the target object, and the corresponding data can be searched in the malicious sample feature library and historical data results through the corresponding object identifier, and the target object can be detected for viruses. Therefore, the method of transmitting only the identifier can effectively reduce the amount of data transmitted. At the same time, the data matching process is stopped when the corresponding result is detected, which can further reduce the consumption of network resources.

[0045] If both the local detection layer and the cloud detection layer cannot determine whether the target object carries a computer virus, that is, the local detection layer and the cloud detection layer can neither determine whether the target object carries a computer virus nor determine whether the target object carries a computer virus, the cloud sandbox simulation layer can be used to perform virus detection on the target object. In some feasible implementations, the cloud sandbox simulation layer includes at least a cloud sandbox component and a behavior analysis component, and then the cloud sandbox component can be used to respond to receiving the target object, create a running container for the target object, and run the target object in the running container; then obtain the virus behavior characteristics used to analyze the file execution behavior through the analysis component, respond to the target object running in the running container, monitor the execution behavior corresponding to the target object, and match the execution behavior with the virus behavior characteristics, and generate a third detection result for the target object based on the matching result. Among them, the third detection result includes at least a third virus carrying result that characterizes that the target object carries a computer virus and a third safety result that characterizes that the target object does not carry a computer virus.

[0046] For the analysis component, it can first obtain the running behavior log generated when the target object is running in the running container, then extract the behavior identifier of the behavior executed when the target object is running from the running behavior log, and then combine the extracted behavior identifiers to obtain the behavior sequence corresponding to the execution behavior. If there is a behavior identifier in the behavior sequence that successfully matches the virus behavior feature, a third virus carrying result for the target object is generated; if there is no behavior identifier in the behavior sequence that successfully matches the virus behavior feature, a third security result for the target object is generated.

[0047] It should be noted that for the cloud sandbox simulation layer, if the local detection layer and the cloud detection layer have no clear conclusion, the user can manually confirm whether to upload the file to the cloud sandbox simulation layer for further behavior analysis. Among them, the sandbox is an isolated logical environment implemented by virtualization technology, which is used to run sample files for analysis. In an embodiment of the present invention, the cloud sandbox can be implemented in a docker+system image manner; and the behavior analysis component can use the open source YARA engine for matching and analysis, so as to perform virus detection on the target point object through the cloud sandbox simulation layer, and the virus program that has no data in the existing network can be identified based on the rules we define.

[0048] In one example, for the sandbox template detection process, a running container can be started on a cloud server, using the previously created Docker image, and each target object will run in a separate Docker container to ensure isolation and security. Then, the target object to be analyzed can be uploaded to the running container through a command line tool or an API interface, and the target object is executed in the running container. During the execution process, the target object's operations on system resources are recorded, such as reading and writing files, modifying the registry, network communication, etc. At the same time, during the operation of the target object, its behavior is monitored in real time, and its operations on system resources are recorded. For example, these behaviors can be captured using a system monitoring tool or a custom script to generate a detailed operation behavior log. Then, the behavior identifier of the behavior executed by the target object during operation is extracted from the operation behavior log. The behavior identifier can be a specific operation type, system call, API function, etc. Parse the operation behavior log, extract each operation performed by the target object during operation, such as file operation, registry operation, network communication, etc., and generate a unique behavior identifier for each operation. The behavior identifier can be a combination of operation type, system call, API function, etc. Combine the extracted behavior identifiers to obtain the behavior sequence corresponding to the execution behavior. The behavior sequence is an ordered list that records all operations performed by the target object during operation. The extracted behavior identifiers are then combined in chronological order to generate an ordered behavior sequence, so that all operations and their order performed by the target object during operation can be recorded through the behavior sequence. For the generated behavior sequence, the generated behavior sequence can be matched with the predefined virus behavior features to determine whether the target object is malicious. Specifically, by loading the predefined virus behavior features (such as features that can be a combination of specific operation types, system calls, API functions, etc., describing known malicious behavior patterns, etc.), the generated behavior sequence is matched with the virus behavior features. If there are behavior identifiers in the behavior sequence that successfully match the virus behavior features, the target object is determined to be malicious.

[0049] For the matching process, if there is a behavior identifier in the behavior sequence that successfully matches the virus behavior feature, a third virus carrying result for the target object is generated. The result will record the matched virus behavior feature and related information. If there is no behavior identifier in the behavior sequence that successfully matches the virus behavior feature, a third safety result for the target object is generated. The result will record the behavior feature and analysis conclusion of the target object.

[0050] Through the above process, for the analysis component, its implementation process includes obtaining the target object's running behavior log, extracting behavior identifiers, combining behavior identifiers to generate behavior sequences, matching virus behavior features, and generating detection results. Through this multi-step analysis method, unknown malware can be effectively detected and prevented, improving the overall security of the system.

[0051] In addition, for the data aggregation layer, it may at least include a scanning result aggregation component and a collection component; wherein the scanning result aggregation component is used to present the first detection result, or to present the first detection result and the second detection result, or to present the first detection result, the second detection result and the third detection result; the collection component is used to collect malicious samples, malicious sample features corresponding to the malicious samples and detection rules for malicious samples from the network, add the malicious samples to the virus sample library, add the malicious sample features to the feature library, and add the first detection result, the second detection result and the third detection result to the virus sample library, synchronize the malicious sample features to the cloud sandbox simulation layer, synchronize the full amount of malicious samples to the cloud detection layer, and synchronize the hotspot data in the malicious samples to the local detection layer.

[0052] In the specific implementation, the data aggregation layer can be responsible for summarizing the scan results and updating the sample libraries that each layer depends on. It mainly includes two components. One is the scan result aggregation component, which is used to integrate the results reported by each layer into a complete scan result for final presentation. The other is the collection component, which is used to collect live malicious samples and detection rules from various mainstream security compliance platforms and security research communities, supplement the existing virus sample library and feature library, and at the same time include the reported detection results into the full sample library, synchronize the malicious behavior features to the cloud sandbox simulation layer, and then synchronize the full samples to the cloud data matching layer, and synchronize the hotspot data to the local detection layer.

[0053] It should be noted that the embodiments of the present invention include but are not limited to the above examples. It is understandable that those skilled in the art can also make settings according to actual needs under the guidance of the ideas of the embodiments of the present invention, and the present invention is not limited to this.

[0054] In an embodiment of the present invention, a computer virus detection system may include a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data convergence layer respectively connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. In the process of performing virus detection on a target object to be detected, the target object to be detected is determined by the local detection layer, and virus detection is performed on the target object to generate a first detection result for the target object. If the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus, the cloud detection layer receives an object identifier corresponding to the target object sent by the local detection layer, and performs virus detection on the target object based on the object identifier to generate a second detection result for the target object. If the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, the cloud sandbox simulation layer receives the target object sent by the local detection layer, and in response to simulating the operation of the target object, obtains a corresponding behavior information, perform virus detection on the target object according to the behavior information, generate a third detection result for the target object, and present the first detection result through the data aggregation layer, or present the first detection result and the second detection result, or present the first detection result, the second detection result and the third detection result, and perform hierarchical detection through the local detection layer, the cloud detection layer and the cloud sandbox simulation layer. When the detection layer of the previous layer fails to detect whether the target object carries a computer virus, the detection layer of the next layer is used for detection. On the one hand, it can effectively reduce resource usage and improve the performance of system operation. On the other hand, based on hierarchical detection, more comprehensive detection results can be covered. At the same time, when the corresponding detection results can be obtained through the local detection layer, data upload is reduced, which can reduce the probability of leaking user data. In addition, the cloud sandbox simulation is used to detect target objects that cannot be detected locally and in the cloud, which can effectively deal with unrecorded computer viruses and improve the protection capability of the system.

[0055] In order to help those skilled in the art better understand the technical solutions in the embodiments of the present invention, the following examples are used for exemplary description:

[0056] Reference Figure 2 , shows a schematic diagram of a scenario of virus detection provided in an embodiment of the present invention. For a computer virus detection system, it may include a local detection layer, a cloud detection layer, a cloud sandbox simulation layer, and a data aggregation layer, etc. Among them, the local detection layer may include a local sample comparison component and a heuristic analysis component, the cloud detection layer may include a cloud sample comparison component, the cloud sandbox simulation layer may include a cloud sandbox and a behavior analysis component, and the data aggregation layer may include a scan result aggregation component, a sample / feature collection component, etc.

[0057] In the process of virus detection on the target file, the virus detection can be performed on it through the local detection layer first. If it is determined that the target file carries the corresponding computer virus, or it is determined that the target file is a safe file, the corresponding detection process can be ended; if it is not possible to determine whether the target file is a file carrying a computer virus, or it is not possible to determine whether the target file is a safe file, the file content feature information can be passed to the cloud detection layer. The cloud detection layer can perform virus detection on the target file through the cloud sample comparison component. If it is determined that the target file carries the corresponding computer virus, or it is determined that the target file is a safe file through sample matching, the corresponding detection process can be ended; if it is not possible to determine whether the target file is a file carrying a computer virus, or it is not possible to determine whether the target file is a safe file, the corresponding detection result can be returned to the local detection layer, so that the user can manually report the original file of the target file to the cloud sandbox simulation layer through the local detection layer, and the cloud sandbox simulation layer will perform virus detection on the target file through the cloud sandbox and behavior analysis components to determine whether the target file is a safe file. After the cloud sandbox simulation layer detection is completed, the corresponding behavior feature data can be uploaded to the data convergence layer so that the data convergence layer can update the database. For the data aggregation layer, the scanning result aggregation component can be used to integrate the results reported by each layer into a complete scanning result for final presentation, and the sample / feature collection component can be used to collect existing malicious samples and detection rules from various mainstream security compliance platforms and security research communities, supplement the existing virus sample library and feature library, and at the same time include the reported detection results into the full sample library, synchronize the malicious behavior features to the cloud sandbox simulation layer, synchronize the full samples to the cloud data matching layer, and synchronize the hotspot data to the local detection layer.

[0058] Reference Figure 3 , shows a flowchart of the steps of a computer virus detection method provided in an embodiment of the present invention, which is applied to a computer virus detection system, wherein the computer virus detection system at least includes a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data aggregation layer respectively connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer, and specifically may include the following steps:

[0059] Step 301, determining a target object to be detected through the local detection layer, and performing virus detection on the target object to generate a first detection result for the target object;

[0060] Step 302: If the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus, the cloud detection layer receives an object identifier corresponding to the target object sent by the local detection layer, and performs virus detection on the target object based on the object identifier to generate a second detection result for the target object;

[0061] Step 303: if the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, the cloud sandbox simulation layer receives the target object sent by the local detection layer, and in response to simulating the operation of the target object, obtains corresponding behavior information during the operation, performs virus detection on the target object according to the behavior information, and generates a third detection result for the target object;

[0062] Step 304: present the first detection result through the data convergence layer, or present the first detection result and the second detection result, or present the first detection result, the second detection result and the third detection result.

[0063] In some feasible implementations, the local detection layer includes at least a local sample comparison component, the local sample comparison component includes at least a local virus file sample and a local safety file, the first detection result includes at least a first virus carrying result, a first safety result, and a first unrecognizable result, and the virus detection on the target object to generate the first detection result for the target object includes:

[0064] If the target object successfully matches the local virus file sample, the local sample comparison component confirms that the target object carries a computer virus, generates a first virus carrying result for the target object, and uses the computer virus corresponding to the successfully matched target local virus file sample as the target computer virus carried by the target object;

[0065] If the target object successfully matches the local security file, the local sample comparison component confirms that the target object does not carry a computer virus, and generates a first security result for the target object;

[0066] If the target object fails to match both the local virus file sample and the local security file, a sample matching failure result for the target object is generated through the local sample comparison component.

[0067] In some feasible implementations, the local detection layer further includes a heuristic virus component, the first detection result further includes a first unrecognizable result, and the performing virus detection on the target object to generate the first detection result for the target object further includes:

[0068] Extracting static features and dynamic features corresponding to the target object through the heuristic virus component;

[0069] The virus is detected by the heuristic virus component according to the static feature and the dynamic feature. If there is a first virus feature corresponding to the static feature and / or there is a second virus feature corresponding to the dynamic feature, a first virus carrying result for the target object is generated; if there is no first virus feature corresponding to the static feature and there is no second virus feature corresponding to the dynamic feature, a first unrecognizable result for the target object is generated.

[0070] In some feasible implementations, the cloud detection layer includes at least a cloud sample comparison component, the second detection result includes at least a second virus carrying result, a second safety result, and a second unrecognizable result, and the virus detection on the target object based on the object identifier to generate the second detection result for the target object includes:

[0071] Loading the full malicious sample feature library and historical data results reported by users through the cloud sample comparison component;

[0072] The object identifier is converted into a corresponding hash value by the cloud sample comparison component to extract the file features corresponding to the target object;

[0073] If the hash value or the file feature of the target object successfully matches an entry in the malicious sample feature library, and / or the target object exists in the historical data result and has been marked as malicious, the cloud sample comparison component confirms that the target object carries a computer virus, and generates a second virus carrying result for the target object;

[0074] If the hash value or the file feature of the target object fails to match the entry in the malicious sample feature library, and the target object exists in the historical data result and has been marked as safe, then the cloud sample comparison component is used to confirm that the target object does not carry a computer virus, and a second safety result for the target object is generated;

[0075] If the hash value or the file feature of the target object fails to match the entry in the malicious sample feature library, and the target object does not exist in the historical data result, a second unrecognizable result for the target object is generated by the cloud sample comparison component.

[0076] In some feasible implementations, the cloud sandbox simulation layer includes at least a cloud sandbox component and a behavior analysis component, and the response to simulating the operation of the target object, obtaining corresponding behavior information during the operation, performing virus detection on the target object according to the behavior information, and generating a third detection result for the target object include:

[0077] In response to receiving the target object, the cloud sandbox component creates a running container for the target object and runs the target object in the running container;

[0078] Acquire virus behavior features for analyzing file execution behaviors through the analysis component, monitor execution behaviors corresponding to the target object in response to the target object running in the running container, match the execution behaviors with the virus behavior features, and generate a third detection result for the target object based on the matching result;

[0079] The third detection result at least includes a third virus carrying result indicating that the target object carries a computer virus and a third safety result indicating that the target object does not carry a computer virus.

[0080] In some feasible implementations, monitoring the execution behavior corresponding to the target object, matching the execution behavior with the virus behavior feature, and generating a third detection result for the target object based on the matching result includes:

[0081] Acquire, by the analysis component, a running behavior log generated when the target object runs in the running container;

[0082] Extracting, by the analysis component, from the running behavior log, a behavior identifier of the behavior executed when the target object is running;

[0083] Combining the extracted behavior identifiers through the analysis component to obtain a behavior sequence corresponding to the execution behavior;

[0084] If there is a behavior identifier in the behavior sequence that successfully matches the virus behavior feature, generating a third virus carrying result for the target object through the analysis component;

[0085] If there is no behavior identifier in the behavior sequence that successfully matches the virus behavior feature, a third security result for the target object is generated through the analysis component.

[0086] In some feasible implementations, the data aggregation layer includes at least a scanning result aggregation component and a collection component, and the presenting of the first detection result, or the presenting of the first detection result and the second detection result, or the presenting of the first detection result, the second detection result and the third detection result, includes:

[0087] The first detection result is presented through the scanning result aggregation component, or the first detection result and the second detection result are presented, or the first detection result, the second detection result and the third detection result are presented.

[0088] In some feasible implementations, the data aggregation layer further includes a collection component, and the method further includes:

[0089] Collecting malicious samples, malicious sample features corresponding to the malicious samples, and detection rules for the malicious samples from the network through the collection component;

[0090] Adding the malicious sample to the virus sample library and adding the malicious sample feature to the feature library through the collection component;

[0091] Adding the first detection result, the second detection result, and the third detection result to the virus sample library through the collection component;

[0092] Synchronizing the malicious sample features to the cloud sandbox simulation layer through the collection component;

[0093] Synchronize the entire amount of the malicious samples to the cloud detection layer through the collection component;

[0094] The hot spot data in the malicious sample is synchronized to the local detection layer through the collection component.

[0095] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0096] As for the method embodiment, since it is basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0097] In addition, an embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned computer virus detection method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0098] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned computer virus detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0099] Figure 4 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0100] The electronic device 400 includes but is not limited to: a radio frequency unit 401, a network module 402, an audio output unit 403, an input unit 404, a sensor 405, a display unit 406, a user input unit 407, an interface unit 408, a memory 409, a processor 410, and a power supply 411. Those skilled in the art will appreciate that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0101] It should be understood that in the embodiment of the present invention, the radio frequency unit 401 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 410 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 401 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 401 can also communicate with the network and other devices through a wireless communication system.

[0102] The electronic device provides users with wireless broadband Internet access through the network module 402, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0103] The audio output unit 403 can convert the audio data received by the RF unit 401 or the network module 402 or stored in the memory 409 into an audio signal and output it as sound. Moreover, the audio output unit 403 can also provide audio output related to a specific function performed by the electronic device 400 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 403 includes a speaker, a buzzer, a receiver, etc.

[0104] The input unit 404 is used to receive audio or video signals. The input unit 404 may include a graphics processor (GPU) 4041 and a microphone 4042, and the graphics processor 4041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 406. The image frame processed by the graphics processor 4041 can be stored in the memory 409 (or other storage medium) or sent via the radio frequency unit 401 or the network module 402. The microphone 4042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 401 in the case of a telephone call mode.

[0105] The electronic device 400 also includes at least one sensor 405, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 4061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 4061 and / or the backlight when the electronic device 400 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 405 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0106] The display unit 406 is used to display information input by the user or information provided to the user. The display unit 406 may include a display panel 4061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0107] The user input unit 407 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 407 includes a touch panel 4071 and other input devices 4072. The touch panel 4071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 4071 or near the touch panel 4071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 4071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the contact point coordinates, and then sends it to the processor 410, receives the command sent by the processor 410 and executes it. In addition, the touch panel 4071 can be implemented using various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 4071, the user input unit 407 may also include other input devices 4072. Specifically, other input devices 4072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which are not described in detail here.

[0108] Further, the touch panel 4071 may be covered on the display panel 4061. When the touch panel 4071 detects a touch operation on or near it, it is transmitted to the processor 410 to determine the type of the touch event, and then the processor 410 provides a corresponding visual output on the display panel 4061 according to the type of the touch event. It can be understood that in one embodiment, the touch panel 4071 and the display panel 4061 are used as two independent components to implement the input and output functions of the electronic device, but in some embodiments, the touch panel 4071 and the display panel 4061 can be integrated to implement the input and output functions of the electronic device, which is not limited here.

[0109] The interface unit 408 is an interface for connecting an external device to the electronic device 400. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 408 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 400 or may be used to transmit data between the electronic device 400 and an external device.

[0110] The memory 409 can be used to store software programs and various data. The memory 409 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 409 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0111] The processor 410 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 409, and calling data stored in the memory 409, so as to monitor the electronic device as a whole. The processor 410 may include one or more processing units; preferably, the processor 410 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 410.

[0112] The electronic device 400 may also include a power supply 411 (such as a battery) for supplying power to each component. Preferably, the power supply 411 may be logically connected to the processor 410 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0113] In addition, the electronic device 400 includes some functional modules not shown, which will not be described in detail here.

[0114] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0115] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0116] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0117] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0118] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0119] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0121] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0122] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0123] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A computer virus detection system, characterized in that: The computer virus detection system at least includes a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data aggregation layer connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer respectively; wherein, The local detection layer is used to determine a target object to be detected, perform virus detection on the target object, and generate a first detection result for the target object; The cloud detection layer is configured to receive an object identifier corresponding to the target object sent by the local detection layer, and perform virus detection on the target object based on the object identifier to generate a second detection result for the target object if the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus; The cloud sandbox simulation layer is used to receive the target object sent by the local detection layer if the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, and in response to performing a simulated operation on the target object, obtain corresponding behavior information during the operation, perform virus detection on the target object according to the behavior information, and generate a third detection result for the target object; The data aggregation layer is used to present the first detection result, or to present the first detection result and the second detection result, or to present the first detection result, the second detection result and the third detection result.

2. The system according to claim 1, characterized in that The local detection layer at least includes a local sample comparison component, the local sample comparison component includes at least a local virus file sample and a local safe file, and the first detection result includes at least a first virus carrying result, a first safe result, and a first unrecognizable result; wherein the local sample comparison component is used to: If the target object successfully matches the local virus file sample, it is confirmed that the target object carries a computer virus, a first virus carrying result for the target object is generated, and the computer virus corresponding to the successfully matched target local virus file sample is used as the target computer virus carried by the target object; If the target object successfully matches the local security file, it is confirmed that the target object does not carry a computer virus, and a first security result for the target object is generated; If the target object fails to match both the local virus file sample and the local security file, a sample matching failure result for the target object is generated.

3. The system according to claim 2, characterized in that The local detection layer also includes a heuristic virus component, and the first detection result also includes a first unrecognizable result; wherein, The heuristic virus component is used to extract static features and dynamic features corresponding to the target object, and detect the virus according to the static features and the dynamic features. If there is a first virus feature corresponding to the static feature, and / or there is a second virus feature corresponding to the dynamic feature, a first virus carrying result for the target object is generated; if there is no first virus feature corresponding to the static feature, and there is no second virus feature corresponding to the dynamic feature, a first unrecognizable result for the target object is generated.

4. The system according to any one of claims 1 to 3, characterized in that: The cloud detection layer at least includes a cloud sample comparison component, and the second detection result at least includes a second virus carrying result, a second safety result, and a second unrecognizable result; wherein the cloud sample comparison component is used to: Load the full malicious sample feature library and historical data results reported by users; Convert the object identifier into a corresponding hash value, and extract the file features corresponding to the target object; If the hash value or the file feature of the target object successfully matches an entry in the malicious sample feature library, and / or the target object exists in the historical data result and has been marked as malicious, it is confirmed that the target object carries a computer virus, and a second virus carrying result for the target object is generated; If the hash value or the file feature of the target object fails to match the entry in the malicious sample feature library, and the target object exists in the historical data result and has been marked as safe, then confirming that the target object does not carry a computer virus, and generating a second safety result for the target object; If the hash value or the file feature of the target object fails to match the entry in the malicious sample feature library, and the target object does not exist in the historical data result, a second unrecognizable result for the target object is generated.

5. The system according to claim 4, characterized in that The cloud sandbox simulation layer includes at least a cloud sandbox component and a behavior analysis component; wherein, The cloud sandbox component is configured to, in response to receiving the target object, create a running container for the target object and run the target object in the running container; The analysis component is used to obtain virus behavior features for analyzing file execution behavior, monitor the execution behavior corresponding to the target object in response to the target object running in the running container, and match the execution behavior with the virus behavior features, and generate a third detection result for the target object based on the matching result; The third detection result at least includes a third virus carrying result indicating that the target object carries a computer virus and a third safety result indicating that the target object does not carry a computer virus.

6. The system according to claim 5, characterized in that The analysis component is specifically used for: Obtaining a running behavior log generated when the target object runs in the running container; Extracting, from the operation behavior log, an action identifier of the action performed when the target object is running; Combining the extracted behavior identifiers to obtain a behavior sequence corresponding to the execution behavior; If there is a behavior identifier in the behavior sequence that successfully matches the virus behavior feature, generating a third virus carrying result for the target object; If there is no behavior identifier in the behavior sequence that successfully matches the virus behavior feature, a third safety result for the target object is generated.

7. The system according to claim 1, characterized in that The data aggregation layer includes at least a scanning result aggregation component and a collection component; wherein, The scanning result aggregation component is used to present the first detection result, or present the first detection result and the second detection result, or present the first detection result, the second detection result and the third detection result; The collection component is used to collect malicious samples, malicious sample features corresponding to the malicious samples, and detection rules for the malicious samples from the network, add the malicious samples to the virus sample library, add the malicious sample features to the feature library, and add the first detection result, the second detection result, and the third detection result to the virus sample library, synchronize the malicious sample features to the cloud sandbox simulation layer, synchronize the full amount of the malicious samples to the cloud detection layer, and synchronize the hotspot data in the malicious samples to the local detection layer.

8. A method for detecting a computer virus, characterized in that: Applied to a computer virus detection system, the computer virus detection system at least comprises a local detection layer, a cloud detection layer and a cloud sandbox simulation layer connected to the local detection layer, and a data aggregation layer respectively connected to the local detection layer, the cloud detection layer and the cloud sandbox simulation layer; wherein the method comprises: Determine a target object to be detected through the local detection layer, perform virus detection on the target object, and generate a first detection result for the target object; If the first detection result indicates that the local detection layer fails to identify whether the target object carries a computer virus, the cloud detection layer receives an object identifier corresponding to the target object sent by the local detection layer, and performs virus detection on the target object based on the object identifier to generate a second detection result for the target object; If the second detection result indicates that the cloud detection layer fails to identify whether the target object carries a computer virus, the cloud sandbox simulation layer receives the target object sent by the local detection layer, and in response to simulating the operation of the target object, obtains corresponding behavior information during the operation, performs virus detection on the target object according to the behavior information, and generates a third detection result for the target object; The first detection result is presented through the data convergence layer, or the first detection result and the second detection result are presented, or the first detection result, the second detection result and the third detection result are presented.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to claim 8 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method of claim 8.

Images