Virus detection method and device

Abstract

The invention relates to the technical field of cloud security virus detection, discloses a virus detection method and device, and provides a transportable virus sandbox in a cloud environment of any cloud host for virus detection. The virus sandbox contains the target virus vector and cooperates with the target execution script to realize manufacturing and destroying processes of the target virus file, so that a convenient and safe detection environment can be formed. The virus sandbox can be integrally transplanted to a server needing to be detected for detection, and different types of target virus files can be covered. When detection is needed, the virus sandbox is transplanted to a cloud host to be detected at any time, a target execution script is executed, a target virus vector can be automatically generated in the virus sandbox, a large number of different types of target virus files are generated, the whole virus sandbox is destroyed after the test is completed, and finally a rapid, safe and reliable detection mode is formed.

Description

[0001] The present invention relates to the technical field of cloud security virus detection, and in particular to a virus detection method and device. Background Art

[0002] Cloud security virus detection refers to the use of cloud computing technology and security strategies to conduct real-time monitoring and virus detection of systems in cloud environments. It can effectively identify, isolate and remove various malicious viruses. As the functions of cloud security products continue to be enriched and improved, data needs to be re-created for regression testing after each change in requirements to ensure the stability and security of the cloud environment.

[0003] Related technology: During the virus detection test of the security guard, every time the user changes the virus detection requirements, different types of virus files need to be temporarily constructed, and the virus files need to be deleted immediately after the test is completed, which makes the test process cumbersome and time-consuming. In addition, during the routine test scan of the cloud host, the test data will be detected by the routine scan due to the long-term retention of the test data, causing false alarms. If the test data is deleted after the test is completed, the test data needs to be uploaded again for the next test. If it is for multiple platforms and multiple servers, the virus files need to be repeatedly uploaded and destroyed. The operation is cumbersome and risky, which is not conducive to the reuse of resources and the stability evaluation of the test. At the same time, after the test is completed, the manual deletion of the virus files is not thorough, which affects the results of the routine scan report. Summary of the invention

[0004] In view of this, the present invention provides a virus detection method to solve the problems in the related art that the virus testing method is cumbersome to produce virus files, the virus detection is unsafe and incomplete, and it is easy to be detected by conventional scanning and the detection is unstable.

[0005] According to a first aspect, the present invention provides a virus detection method, the method comprising:

[0006] Obtain a virus sandbox generated in the security isolation area; wherein the virus sandbox is generated based on a target virus vector and a target execution script;

[0007] Based on the target virus vector, multiple target virus files are generated in the virus sandbox;

[0008] Based on the detection execution instructions, perform virus detection tasks on multiple target virus files in the virus sandbox;

[0009] In response to the completion of the virus detection task execution, the virus sandbox is destroyed by executing the script through the target.

[0010] The disclosed embodiment provides a portable virus sandbox on the cloud environment of any cloud host for virus detection. The virus sandbox contains a target virus carrier and cooperates with a target execution script to implement the process of manufacturing and destroying the target virus file, thereby forming a convenient and safe detection environment. The virus sandbox can be transplanted as a whole to the server that needs to be detected for detection, and different types of target virus files can be covered. When detection is required, the virus sandbox can be transplanted to the cloud host to be detected at any time, and the target execution script can be executed to automatically generate the target virus carrier in the virus sandbox, and generate a large number of different types of target virus files. After the test is completed, the entire virus sandbox is destroyed, and finally a fast, safe and reliable detection method is formed.

[0011] In some optional embodiments, the virus sandbox is generated based on the target virus vector and the target execution script, including:

[0012] Get the original virus file and target execution script;

[0013] Splitting the original virus file into multiple sub-files according to a preset rule; wherein the multiple sub-files are numbered in sequence;

[0014] Selecting a sub-file of the same type from a plurality of sub-files; wherein the sub-files of the same type use the same serial number;

[0015] Encrypt multiple sub-files separately according to preset ciphertexts;

[0016] Loading the encrypted sub-files into the target virus vector according to their corresponding serial numbers;

[0017] A virus sandbox is generated based on the target execution script and the respectively encrypted target virus vectors.

[0018] The disclosed embodiment synthesizes the target virus vector and the target execution text at the same time, thereby generating a virus sandbox, which separates the normal working environment of the cloud host from the sandbox environment of the virus sandbox, thereby ensuring that the cloud host can work normally. In addition, the original virus file is split and encrypted in the virus sandbox, and cannot be detected by virus scanning before the target execution script is triggered, which greatly reduces the possibility of false positives in conventional scanning and lays a foundation for the sustainability of virus detection.

[0019] In some optional embodiments, based on the target virus vector, multiple target virus files are generated in the virus sandbox, including:

[0020] Decrypt multiple sub-files from the virus sandbox according to the preset ciphertext;

[0021] Selecting a sub-file of the same type from a plurality of sub-files; wherein the sub-files of the same type use the same serial number;

[0022] Based on sub-files belonging to the same category, multiple target virus files are generated in the virus sandbox through target execution scripts.

[0023] The disclosed embodiment runs a virus sandbox in a cloud environment of a cloud host and decrypts batches of multiple target virus files of different types from the virus sandbox, thereby avoiding the problem that the user needs to temporarily construct different types of virus files every time the virus detection requirements are changed, resulting in a cumbersome and time-consuming testing process.

[0024] In some optional implementations, based on the detection execution instruction, virus detection tasks are performed on multiple target virus files in the virus sandbox, including:

[0025] Based on the target execution script, a detection request instruction is sent to the virus detection service center;

[0026] Receive the detection execution instructions issued by the virus detection service center;

[0027] Call the detection execution instruction from the virus detection interface through the target execution script;

[0028] Based on the detection execution instruction, the virus detection task is performed on various target virus files in the virus sandbox.

[0029] The disclosed embodiment is based on interactive instructions between the cloud host and the detection service center. On the premise that the detection service center allows detection, a virus sandbox is run in the cloud environment of the cloud host to perform virus detection tasks, ensure the safe operation of the cloud host, and use the virus sandbox in combination with user needs to quickly and accurately complete virus detection tasks.

[0030] In some optional implementations, the virus detection method in the disclosed embodiment further includes:

[0031] Get virus test results;

[0032] Upload the virus detection results to the virus detection service center.

[0033] After the virus detection task is completed, the embodiment of the present disclosure uploads the virus detection result to the virus detection service center, which is conducive to the virus detection service center configuring a virus removal strategy based on the virus detection result.

[0034] In some optional implementations, during the execution of a virus detection task, a virus monitoring instruction is called in real time from a virus detection interface through a target execution script to poll and monitor the current progress of multiple virus detection tasks in a virus sandbox.

[0035] The disclosed embodiment monitors the current progress of multiple virus detection tasks in real time, which is conducive to timely knowing the current detection status of the virus detection task at any time.

[0036] According to a second aspect, an embodiment of the present disclosure provides a virus detection device, the device comprising:

[0037] An acquisition module is used to acquire a virus sandbox generated in a secure isolation area; wherein the virus sandbox is generated based on a target virus vector and a target execution script;

[0038] A generation module, used to generate multiple target virus files in the virus sandbox based on the target virus vector;

[0039] An execution module, used to perform virus detection tasks on multiple target virus files in a virus sandbox based on the detection execution instruction;

[0040] The destruction module is used to destroy the virus sandbox by executing the target script in response to the completion of the virus detection task.

[0041] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the virus detection method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0042] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the virus detection method of the first aspect or any corresponding embodiment thereof.

[0043] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the virus detection method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 is a schematic flow chart of a virus detection method according to an embodiment of the present invention;

[0046] Figure 2 is a schematic diagram of a virus sandbox according to an embodiment of the present invention;

[0047] Figure 3 is a schematic flow chart of another virus detection method according to an embodiment of the present invention;

[0048] Figure 4 is a schematic flow chart of another virus detection method according to an embodiment of the present invention;

[0049] Figure 5 is a schematic flow chart of another virus detection method according to an embodiment of the present invention;

[0050] Figure 6 is a schematic diagram of interaction between a virus detection service center and a cloud host according to an embodiment of the present invention;

[0051] Figure 7 is a flow chart of another virus detection method according to an embodiment of the present invention;

[0052] Figure 8 is a schematic diagram of configuring a cloud host cluster with a virus sandbox according to an embodiment of the present invention;

[0053] Fig. 9 is a structural block diagram of a virus detection device according to an embodiment of the present invention;

[0054] Fig.10 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0056] According to an embodiment of the present invention, an embodiment of a virus detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0057] In this embodiment, a virus detection method is provided, which can be used in cloud servers, mobile terminals, such as mobile phones, tablet computers, etc. Figure 1 : is a flow chart of a virus detection method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0058] Step S101, obtaining a virus sandbox generated in a secure isolation area; wherein the virus sandbox is generated based on a target virus vector and a target execution script.

[0059] Specifically, the disclosed embodiments are applied in the scenario of performing virus detection on the cloud host in the cloud server, and specifically can be virus detection of the cloud host in the startup state or the running state. Among them, the secure isolation area is an isolation area specially used for virus detection, which is isolated from the normal working area by the secure isolation area. Viruses are detected in the secure isolation area to ensure the safety of the cloud host in performing other work tasks in the normal working area. The virus sandbox is an isolated environment formed in the secure isolation area to detect virus files in the target virus carrier through the target execution script. Therefore, the virus sandbox is generated based on the target virus carrier and the target execution script. The target virus carrier is a medium that can carry virus components. It does not pose a threat itself, but can cause a metamorphosis reaction through the triggering of other substances, thereby generating one or more virus files. The target execution script is some program execution code written by the user, which is mainly used to perform virus detection tasks and destroy virus files. If you want to add more functions, you can program the corresponding function in the target execution script. Figure 2 , which is a schematic diagram of a virus sandbox in an embodiment of the present disclosure.

[0060] In addition, the virus sandbox is pre-generated and portable, suitable for any cloud host, which improves the flexibility of virus reuse. It is more convenient and efficient to change the test content using the pre-generated virus sandbox.

[0061] Step S102, based on the target virus vector, generating multiple target virus files in the virus sandbox.

[0062] Specifically, the target virus carrier carries multiple virus files, and the multiple virus files are combined in the virus sandbox to generate multiple target virus files. The specific process of generating multiple target virus files is shown in the following process.

[0063] The disclosed embodiment uses a target virus carrier to directly generate batches of multiple types of target virus files in a virus sandbox, thereby avoiding the problem that the user temporarily constructs different types of virus files after each change of virus detection requirements, resulting in a cumbersome and time-consuming testing process. Therefore, directly generating batches of multiple types of target virus files in the virus sandbox not only meets the different detection requirements of users, but also can significantly improve virus detection efficiency and simplify the detection process.

[0064] Step S103: Based on the detection execution instruction, a virus detection task is executed on a plurality of target virus files in the virus sandbox.

[0065] Specifically, the detection execution instruction here may come from a virus detection service center. The virus detection task here may be one or more.

[0066] The disclosed embodiment runs a virus sandbox in a cloud environment of a cloud host to perform virus detection tasks and ensure the safe operation of the cloud host.

[0067] Step S104, in response to the completion of the virus detection task execution, destroying the virus sandbox through the target execution script.

[0068] Specifically, after the virus detection task is completed, the virus sandbox is automatically destroyed through the target execution script to avoid manual destruction of virus files that is not thorough and affects the accuracy of virus detection. Therefore, the automatic destruction of the virus sandbox is safe and has no residue. Even if it is attacked, it will not affect normal business, ensuring the security and stability of the detection environment.

[0069] In addition, the virus sandbox of the disclosed embodiment is portable and can be configured in any cloud host based on the target execution script and the target virus carrier. The configuration process is convenient and simple. Since the target virus file is loaded in the target virus carrier of the virus sandbox, even if the cloud host is performing routine test scanning, it will not be detected by routine scanning due to the long-term retention of test data, thereby causing false alarms. Moreover, the virus sandbox is generated in advance and can be called at any time, avoiding the tedious process of repeatedly uploading batch test data. Performing virus detection tasks in the virus sandbox not only has low risks but also is conducive to the reuse of resources and the stability evaluation of tests.

[0070] In this embodiment, a virus detection method is provided, which can be used in cloud servers, mobile terminals, such as mobile phones, tablet computers, etc. Figure 3 : is a flow chart of a virus detection method according to an embodiment of the present invention. Figure 3 As shown, the virus sandbox is generated based on the target virus vector and the target execution script, including:

[0071] Step S301, obtaining the original virus file and the target execution script.

[0072] Specifically, the original virus file is a virus file that is initially constructed, and the original virus file is uploaded to the cloud host by a user.

[0073] The target execution script is some program execution code written by the user. The target execution script is mainly used to perform virus detection tasks and destroy virus files. If you want to add more functions, you can compile the program code of the corresponding function into the target execution script.

[0074] Step S302: split the original virus file into multiple sub-files according to a preset rule; wherein the multiple sub-files are numbered in sequence.

[0075] Specifically, the original virus file is split into multiple parts according to a preset rule, each part is a sub-file, and the multiple sub-files are numbered in ascending order. The preset rule can be a rule flexibly set based on user needs, for example, the original virus file is split according to the data size. Figure 3 As shown in the figure, it is a schematic diagram of the virus sandbox running in the cloud host. Figure 3 In the cloud, the virus sandbox runs in the cloud host to perform virus detection tasks.

[0076] Step S303: selecting subfiles of the same type from the multiple subfiles; wherein the subfiles of the same type use the same serial number.

[0077] Specifically, multiple subfiles are classified, and subfiles of the same category are identified using the same serial number. For example, multiple subfiles using the serial number AL00S10 are subfiles numbered 1, 3, 5, 9, and 11, respectively.

[0078] Step S304: encrypt multiple sub-files respectively according to the preset ciphertext.

[0079] Specifically, the preset ciphertext is a preset password, and the plurality of sub-files are encrypted respectively using the preset ciphertext.

[0080] The disclosed embodiment splits and encrypts the original virus file in the virus sandbox, and cannot be detected by the virus scanner before the target execution script is triggered, which greatly reduces the possibility of false positives in conventional scanning and lays the foundation for the sustainability of virus detection.

[0081] Step S305: Generate a virus sandbox based on the target execution script and the encrypted target virus vectors.

[0082] The target virus vector and the target execution text are synthesized simultaneously to generate a virus sandbox, which separates the normal working environment of the cloud host from the sandbox environment of the virus sandbox, thereby ensuring that the cloud host can work normally.

[0083] The disclosed embodiment runs a virus sandbox in the cloud environment of a cloud host, and generates batches of multiple target virus files of different types in the virus sandbox and loads them into a target virus carrier, thereby avoiding the problem that users need to temporarily construct different types of virus files each time they change their virus detection requirements, which results in a cumbersome and time-consuming testing process. The disclosed embodiment pre-forms multiple types of target virus files in the virus sandbox to meet different detection requirements of users, without the need to temporarily construct batches of different types of virus files, thus simplifying the virus detection process and improving virus detection efficiency.

[0084] In addition, the virus sandbox of the disclosed embodiment is portable and can be configured in any cloud host based on the target execution script and the target virus carrier. The configuration process is convenient and simple. Since the target virus file is loaded in the target virus carrier of the virus sandbox, even if the cloud host is performing routine test scanning, it will not be detected by routine scanning due to the long-term retention of test data, thereby causing false alarms. Moreover, the virus sandbox is generated in advance and can be called at any time, avoiding the tedious process of repeatedly uploading batch test data. Performing virus detection tasks in the virus sandbox not only has low risks but is also conducive to the reuse of resources and the stability evaluation of tests.

[0085] In this embodiment, a virus detection method is provided, which can be used in cloud servers, mobile terminals, such as mobile phones, tablet computers, etc. Figure 4 : is a flow chart of a virus detection method according to an embodiment of the present invention. Figure 4 As shown, based on the target virus vector, multiple target virus files are generated in the virus sandbox. The process includes the following steps:

[0086] Step S401, decrypting multiple sub-files from the virus sandbox according to the preset ciphertext.

[0087] Specifically, the decryption process here is the reverse process of the above encryption process, and multiple sub-files are decrypted from the virus sandbox according to the preset ciphertext.

[0088] Step S402: selecting subfiles of the same type from a plurality of subfiles; wherein the subfiles of the same type use the same serial number.

[0089] Specifically, sub-files belonging to the same category are selected. Please refer to the above examples for details, which will not be described here.

[0090] Step S403, based on the sub-files belonging to the same type, multiple target virus files are generated in the virus sandbox through the target execution script.

[0091] Specifically, the target execution file is triggered, and multiple target virus files are generated in the virus sandbox according to the same seed file with the same serial number.

[0092] The disclosed embodiment runs a virus sandbox in a cloud environment of a cloud host and decrypts batches of multiple target virus files of different types from the virus sandbox, thereby avoiding the problem that the user needs to temporarily construct different types of virus files every time the virus detection requirements are changed, resulting in a cumbersome and time-consuming testing process.

[0093] In this embodiment, a virus detection method is provided, which can be used in cloud servers, mobile terminals, such as mobile phones, tablet computers, etc. Figure 5 : is a flow chart of a virus detection method according to an embodiment of the present invention. Figure 5As shown, based on the detection execution instruction, the virus detection task is performed on multiple target virus files in the virus sandbox. The process includes the following steps:

[0094] Step S501, based on the target execution script, a detection request instruction is sent to a virus detection service center.

[0095] Step S502: receiving a detection execution instruction issued by a virus detection service center.

[0096] Specifically, this involves the interaction scenario between the virus detection service center and the cloud host. Figure 6 As shown, the cloud host sends a detection request instruction to the detection service center based on the target execution script, and the target execution script contains the user's detection requirements. The virus detection service center sends a detection execution instruction to the cloud host based on the detection request instruction. Therefore, the cloud host receives the detection execution instruction sent by the detection service center.

[0097] Step S503: calling a detection execution instruction from a virus detection interface through a target execution script.

[0098] Step S504: executing virus detection tasks on multiple target virus files in the virus sandbox based on the detection execution instruction.

[0099] Specifically, after the target virus file is created, the detection execution instruction from the virus detection service center is called from the virus detection interface of the cloud host through the target execution script, and the virus detection task is performed on multiple virus files in the virus sandbox.

[0100] The disclosed embodiment is based on interactive instructions between the cloud host and the detection service center. On the premise that the detection service center allows detection, a virus sandbox is run in the cloud environment of the cloud host to perform virus detection tasks, ensure the safe operation of the cloud host, and use the virus sandbox in combination with user needs to quickly and accurately complete virus detection tasks.

[0101] In this embodiment, a virus detection method is provided, which can be used in cloud servers, mobile terminals, such as mobile phones, tablet computers, etc. Figure 7 : is a flow chart of a virus detection method according to an embodiment of the present invention. Figure 7 As shown, it also includes:

[0102] Step S105, obtaining virus detection results.

[0103] Step S106, uploading the virus detection result to the virus detection service center.

[0104] Specifically, see Figure 6After the virus detection task is completed, the virus detection result is uploaded to the virus detection service center, which is conducive to the virus detection service center to configure the virus removal strategy based on the virus detection result.

[0105] In some optional implementations, during the execution of a virus detection task, a virus monitoring instruction is called in real time from a virus detection interface through a target execution script to poll and monitor the current progress of multiple virus detection tasks in a virus sandbox.

[0106] Specifically, after the target virus file is created, the virus detection interface is called through the target execution script, the virus monitoring instruction is called in real time, and the current progress of multiple virus detection tasks is monitored by polling in the virus sandbox.

[0107] The disclosed embodiment monitors the current progress of multiple virus detection tasks in real time, which is conducive to timely knowing the current detection status of the virus detection task at any time.

[0108] Therefore, if Figure 8 As shown, the disclosed embodiment provides a portable virus sandbox on the cloud environment of any cloud host for virus detection. The virus sandbox contains a target virus carrier and cooperates with a target execution script to implement the process of manufacturing and destroying the target virus file, thereby forming a convenient and safe detection environment. The virus sandbox can be transplanted as a whole to the server that needs to be detected for detection, and different types of target virus files can be covered. When detection is required, the virus sandbox can be transplanted to the cloud host to be detected at any time, and the target execution script can be executed to automatically generate the target virus carrier in the virus sandbox, and generate a large number of different types of target virus files. After the test is completed, the entire virus sandbox is destroyed, and finally a fast, safe and reliable detection method is formed.

[0109] In this embodiment, a virus detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0110] This embodiment provides a virus detection device, such as Fig. 9 As shown, including:

[0111] An acquisition module 91 is used to acquire a virus sandbox generated in a secure isolation area; wherein the virus sandbox is generated based on a target virus vector and a target execution script;

[0112] A generating module 92, for generating a plurality of target virus files in a virus sandbox based on a target virus vector;

[0113] An execution module 93, configured to execute virus detection tasks on a plurality of target virus files in a virus sandbox based on the detection execution instruction;

[0114] The destruction module 94 is used to destroy the virus sandbox by executing the target script in response to the completion of the virus detection task.

[0115] In some optional implementations, the acquisition module 91 includes a sandbox generation submodule, and the sandbox generation submodule includes:

[0116] An acquisition unit, used to acquire the original virus file and the target execution script;

[0117] A splitting unit is used to split the original virus file into multiple sub-files according to a preset rule; wherein the multiple sub-files are numbered in sequence;

[0118] A selection unit, used for selecting sub-files belonging to the same category from a plurality of sub-files; wherein the sub-files belonging to the same category use the same serial number;

[0119] An encryption unit, used to encrypt multiple sub-files respectively according to preset ciphertexts;

[0120] A loading unit, used for loading the encrypted sub-files into the target virus vector according to the corresponding serial numbers;

[0121] The generating unit is used to generate a virus sandbox based on the target execution script and the respectively encrypted target virus vectors.

[0122] In some optional implementations, the generating module 92 includes:

[0123] The decryption submodule is used to decrypt multiple subfiles from the virus sandbox according to the preset ciphertext;

[0124] A selection sub-module is used to select sub-files belonging to the same category from multiple sub-files; wherein the sub-files belonging to the same category use the same serial number;

[0125] The generation submodule is used to generate multiple target virus files in the virus sandbox through a target execution script based on sub-files belonging to the same type.

[0126] In some optional implementations, the execution module 93 includes:

[0127] The sending submodule is used to execute the script based on the target and send a detection request instruction to the virus detection service center;

[0128] A receiving submodule, used to receive a detection request instruction issued by a virus detection service center;

[0129] A calling submodule, used to call the detection execution instruction from the virus detection interface through the target execution script;

[0130] The execution submodule is used to perform virus detection tasks on multiple target virus files in the virus sandbox based on the detection execution instruction.

[0131] In some optional embodiments, it also includes:

[0132] A detection result output module is used to obtain virus detection results;

[0133] The detection result uploading module is used to upload the virus detection results to the virus detection service center.

[0134] In some optional implementations, the execution module 93 is also used to call the virus monitoring instruction from the virus detection interface in real time through the target execution script to poll and monitor the current progress of multiple virus detection tasks in the virus sandbox during the execution of the virus detection task.

[0135] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0136] The virus detection device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0137] An embodiment of the present invention further provides a computer device having the above-mentioned virus detection device.

[0138] See also Fig.10 , Fig.10 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Fig.10As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.10 A processor 10 is taken as an example.

[0139] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0140] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0141] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0142] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0143] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0144] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0145] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0146] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A virus detection method, characterized in that: The method comprises: Obtain a virus sandbox generated in a secure isolation area; wherein the virus sandbox is generated based on a target virus vector and a target execution script; Based on the target virus vector, generating multiple target virus files in the virus sandbox; Based on the detection execution instruction, executing a virus detection task on the multiple target virus files in the virus sandbox; In response to the completion of the virus detection task, the virus sandbox is destroyed by executing the target script.

2. The method according to claim 1, characterized in that The virus sandbox is generated based on the target virus vector and the target execution script, including: Get the original virus file and target execution script; Splitting the original virus file into multiple sub-files according to a preset rule; wherein the multiple sub-files are numbered in sequence; Selecting subfiles belonging to the same category from the multiple subfiles; wherein the subfiles belonging to the same category use the same serial number; Encrypt the multiple sub-files respectively according to preset ciphertexts; Loading the plurality of sub-files that have been encrypted respectively into the target virus vector according to the sequence numbers corresponding thereto; The virus sandbox is generated based on the target execution script and the respectively encrypted target virus vectors.

3. The method according to claim 2, characterized in that Based on the target virus vector, multiple target virus files are generated in the virus sandbox, including: Decrypting the multiple sub-files from the virus sandbox according to the preset ciphertext; Selecting subfiles belonging to the same category from the multiple subfiles; wherein the subfiles belonging to the same category use the same serial number; Based on the sub-files belonging to the same category, the multiple target virus files are generated in the virus sandbox through the target execution script.

4. The method according to claim 1, characterized in that Based on the detection execution instruction, performing virus detection tasks on the multiple target virus files in the virus sandbox includes: Execute the script based on the target and send a detection request instruction to the virus detection service center; Receiving a detection execution instruction issued by the virus detection service center; Calling the detection execution instruction from the virus detection interface through the target execution script; Based on the detection execution instruction, a virus detection task is performed on the multiple target virus files in the virus sandbox.

5. The method according to claim 1, characterized in that Also includes: Get virus test results; The virus detection result is uploaded to a virus detection service center.

6. The method according to any one of claims 1 to 5, characterized in that In the process of executing the virus detection task, the target execution script calls the virus monitoring instruction from the virus detection interface in real time to poll and monitor the current progress of multiple virus detection tasks in the virus sandbox.

7. A virus detection device, characterized in that: The device comprises: An acquisition module, used to acquire a virus sandbox generated in a secure isolation area; wherein the virus sandbox is generated based on a target virus vector and a target execution script; A generation module, used to generate multiple target virus files in the virus sandbox based on the target virus vector; An execution module, configured to execute a virus detection task on the multiple target virus files in the virus sandbox based on a detection execution instruction; A destruction module is used to destroy the virus sandbox by executing the target script in response to the completion of the execution of the virus detection task.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the virus detection method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the virus detection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the virus detection method according to any one of claims 1 to 6.

Images