Low-power-consumption virus detection method and device, storage medium and terminal

Abstract

The embodiment of the invention provides a low-power-consumption virus detection method and device, a storage medium and a terminal.The method comprises the steps that CPU consumption rates of a target virus detection process in N time periods are obtained, weighted average calculation is conducted on the N CPU consumption rates, and a dynamic threshold value is obtained; the CPU consumption rate in the Nth time period is compared with the dynamic threshold value, and if the CPU consumption rate is larger than the dynamic threshold value, a stop signal is sent to the target virus detection process, so that the target virus detection process stops running. By applying the method, the CPU consumption rate of the target virus detection process can be monitored at any time, and the target virus detection process is suspended when the CPU consumption rate is too high, so that the influence of the high CPU consumption rate of a certain process on other processes is avoided, and good use experience is provided for a user.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular, to a low-power virus detection method, device, storage medium, and terminal. Background Art

[0002] With the development of the Internet and the popularization of mobile terminals, the security of mobile terminals has been increasingly emphasized. As an important tool for ensuring device security, the performance of the virus detection engine directly affects the user experience. When the existing virus detection engines detect and kill viruses, due to the need to load and parse a large number of files, the consumption of the CPU is too large, which will affect other service programs of the host. Especially when the services on the host are processing high-concurrency and large-traffic tasks, the high CPU consumption will seriously reduce the service quality, and this high consumption seriously affects the user experience. Summary of the Invention

[0003] Embodiments of the present invention provide a low-power virus detection method, device, storage medium, and terminal, by controlling the CPU consumption rate of the virus detection process to keep it at a low CPU consumption rate. It can avoid the influence of its high CPU consumption rate on other processes and provide a good user experience for users.

[0004] In a first aspect, embodiments of the present invention provide a low-power virus detection method, including:

[0005] Obtaining the CPU consumption rate of a target virus detection process within N time periods; the N time periods are sorted according to time; N>0 and is an integer;

[0006] Performing a weighted average calculation on the N CPU consumption rates to obtain a dynamic threshold;

[0007] Comparing the CPU consumption rate in the Nth time period with the dynamic threshold, if it is greater than the dynamic threshold, sending a stop signal to the target virus detection process to pause the operation of the target virus detection process.

[0008] In a second aspect, embodiments of the present invention provide a low-power virus detection device, including:

[0009] A CPU consumption rate acquisition module, configured to obtain the CPU consumption rate of a target virus detection process within N time periods; the N time periods are sorted according to time; N>0 and is an integer;

[0010] A dynamic threshold calculation module, configured to perform a weighted average calculation on the N CPU consumption rates to obtain a dynamic threshold;

[0011] The target virus detection process control module is used to compare the CPU consumption rate in the Nth time period with the dynamic threshold. If it is greater than the dynamic threshold, a stop signal is sent to the target virus detection process to pause the operation of the target virus detection process.

[0012] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method steps described in the first aspect above are implemented.

[0013] In a fourth aspect, an embodiment of the present invention provides a terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method steps described in the first aspect above are implemented.

[0014] The low-power virus detection method, device, storage medium, and terminal provided by the embodiments of the present invention have the following technical effects:

[0015] In the embodiments of the present invention, the CPU consumption rate of the target virus detection process in N time periods is obtained, and the N CPU consumption rates are weighted and averaged to obtain a dynamic threshold. Then, the CPU consumption rate in the Nth time period is compared with the dynamic threshold. If it is greater than the dynamic threshold, a stop signal is sent to the target virus detection process to pause the operation of the target virus detection process. By applying the above method, the CPU consumption rate of the target virus detection process can be monitored at any time. When its CPU consumption rate is too high, it is paused, avoiding the impact of a high CPU consumption rate of a certain process on other processes and providing a good user experience for users. Description of the Drawings

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0017] Figure 1 It is a flowchart of a low-power virus detection method provided by an embodiment of the present invention;

[0018] Figure 2 It is a schematic structural diagram of a low-power virus detection device provided by an embodiment of the present invention;

[0019] Figure 3 It is a block diagram of a terminal provided by an embodiment of the present invention. Detailed Embodiments

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0021] When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0022] In the description of the present invention, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be construed as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0023] With the development of the Internet and the popularization of mobile terminals, the security of mobile terminals has been increasingly emphasized. As an important tool for ensuring device security, the performance of the virus detection engine directly affects the user experience. When existing virus detection engines detect and kill viruses, since a large number of files need to be loaded and parsed, the consumption of the CPU is too large, which will affect other service programs of the host. Especially when the services on the host are processing high-concurrency and large-traffic tasks, the high CPU consumption will seriously reduce the service quality, and this high consumption seriously affects the user experience.

[0024] To address the above problems, the present invention provides a low-power virus detection method, device, storage medium, and terminal. Below, each step of the low-power virus detection method in the embodiments of the present invention will be described in more detail with reference to the accompanying drawings and embodiments.

[0025] Figure 1 It is a flowchart of a low-power virus detection method provided for the embodiments of the present invention. As Figure 1 shown, the method of the embodiments of the present invention may include the following steps:

[0026] S101, obtain the CPU consumption rate of the target virus detection process within N time periods; the N time periods are sorted according to time; N>0 and is an integer.

[0027] In the embodiments of the present invention, when the target virus detection process is running, the CPU consumption situation is constantly changing. However, the CPU consumption situation of the target virus detection process during operation cannot be obtained at any time. Therefore, the CPU consumption situation of the target virus detection process in each period can be obtained by determining a period.

[0028] Since the CPU consumption of the operating system is also changing at any time, simply obtaining the CPU consumption situation of the target virus detection process cannot show the impact of the target virus detection process on the entire operating system. When the CPU consumption of the target virus detection process is relatively high in a certain period, if the CPU consumption of the operating system is also relatively high at this time, the CPU consumption of the target virus detection process may account for a relatively low proportion in the CPU consumption of the operating system and will not affect other services in the operating system. When the CPU consumption of the target virus detection process is relatively low in a certain period, but if the CPU consumption of the operating system is also relatively small at this time, resulting in the CPU consumption of the target virus detection process accounting for a relatively high proportion in the CPU consumption of the operating system, it may affect other services in the operating system.

[0029] Therefore, the CPU consumption rate of the target virus detection process in N time periods can be further obtained, that is, the ratio of the CPU consumption rate of the target virus detection process in N periods to the CPU consumption rate of the operating system. The length of the period can be determined according to the actual situation, such as one period per second, or one period every 3 seconds, every 5 seconds, etc., which is not limited here. Among them, the N time periods are sorted according to time, N>0 and is an integer. N can be specifically determined according to the actual situation, such as 50, 100, etc.

[0030] Optionally, the specific steps for obtaining the CPU consumption rate of the target virus detection process in N time periods include:

[0031] S101.1, set up a monitoring process, and obtain the CPU time slice consumption data of the operating system and the target virus detection process in N time periods through the monitoring process;

[0032] S101.2, calculate the CPU consumption rate of the target virus detection process in each time period through the CPU time slice consumption data in each time period, so as to obtain N CPU consumption rates.

[0033] Optionally, to periodically obtain the CPU consumption of the target virus detection process, a monitoring process can be set up to run as an independent background service. Through the API interface provided by the operating system, the CPU time slice consumption data of the operating system and the target virus detection process can be obtained periodically. Specifically, set up a monitoring process, initialize the monitoring process, set the monitoring period, and use the Top command, a performance monitoring tool provided by the operating system, to obtain the CPU time slice consumption data of the operating system and the target virus detection process at the beginning and end of each period.

[0034] Then, based on the CPU time slice consumption data within each time period, calculate the CPU consumption rate of the target virus detection process within each time period, thereby obtaining the CPU consumption rate of the target virus detection within N time periods.

[0035] Optionally, the CPU consumption rate is obtained according to the following formula:

[0036] T i = (tb1-ta1) / (tb2-ta2) (1)

[0037] In the above formula, 0 < i ≤ N, and i is an integer. T i is the CPU consumption rate of the target virus detection process in the i-th time period; tb1 is the CPU time slice consumption number of the target virus detection process at the end of the i-th time period, ta1 is the CPU time slice consumption number of the target virus detection process at the beginning of the i-th time period; tb2 is the CPU time slice consumption number of the operating system at the end of the i-th time period, ta2 is the CPU time slice consumption number of the operating system at the beginning of the i-th time period. That is, the CPU consumption rate is the ratio of the CPU time slice consumption number of the target virus detection process in the i-th time period to the CPU time slice consumption number of the operating system in the i-th time period.

[0038] For example, if the CPU time slice consumption number of the target virus detection process at the end of the i-th time period is 200, the CPU time slice consumption number of the target virus detection process at the beginning of the i-th time period is 100, the CPU time slice consumption number of the operating system at the end of the i-th time period is 1000, and the CPU time slice consumption number of the operating system at the beginning of the i-th time period is 500, then the CPU consumption rate of the target virus detection process in the i-th time period is (200 - 100) / (1000 - 500) = 1 / 5.

[0039] Through the above method, the CPU consumption rate of the target virus detection process within N time periods can be calculated, thereby obtaining N CPU consumption rates.

[0040] Based on any of the above optional embodiments, in S102, a weighted average calculation is performed on the N CPU consumption rates to obtain a dynamic threshold.

[0041] Optionally, after calculating the N CPU consumption rates of the target virus detection process, a weighted average calculation is performed on the N CPU consumption rates to obtain a dynamic threshold. The specific steps include:

[0042] S102.1, generate N weight values; the sum of the N weight values is equal to 1 and increases sequentially;

[0043] S102.2, perform a weighted calculation on the N weight values and the N CPU consumption rates to obtain a dynamic threshold.

[0044] Optionally, when performing a weighted average calculation on the N CPU consumption rates, first generate N weight values. Since the CPU consumption rate in the Nth time period will be compared with the dynamic threshold later, the closer the CPU consumption rate is to that in the Nth time period, the greater its statistical analysis value, so the corresponding weight value should be higher. Therefore, the sum of the N weight values generated is equal to 1 and increases sequentially. Each weight value can be obtained according to the following formula:

[0045]

[0046] In the above formula, 0 < i ≤ N and i is an integer. w i is the i-th weight value, and S is calculated according to the formula For example, if N is 100, then When i = 1, When i = 2, 100 weight values can be calculated sequentially.

[0047] After calculating the N weight values according to the above method, perform a weighted calculation on the N weight values and the N CPU consumption rates to obtain a dynamic threshold. That is

[0048] Based on any of the above optional embodiments, in S103, compare the CPU consumption rate in the Nth time period with the dynamic threshold. If it is greater than the dynamic threshold, send a stop signal to the target virus detection process to pause the operation of the target virus detection process.

[0049] Optionally, after calculating the dynamic threshold, compare the CPU consumption rate in the Nth time period with the dynamic threshold. If it is greater than the dynamic threshold, send a stop signal to the target virus detection process to pause the operation of the target virus detection process. If it is less than or equal to the dynamic threshold, continue monitoring.

[0050] When the CPU consumption rate in the Nth time period is greater than the dynamic threshold, it indicates that the CPU consumption rate of the target virus detection process is relatively high at this time. To avoid affecting the operation of other processes, a stop signal is sent to the target virus detection process to pause its operation and reduce the CPU consumption rate of the target virus detection process.

[0051] To ensure the smooth completion of tasks in the target virus detection process, after the target virus detection process pauses, the monitoring process will continue to monitor the CPU consumption of the target virus detection process. When the CPU consumption rate of the target virus detection process decreases, it will be allowed to continue running.

[0052] Optionally, the monitoring process obtains the CPU consumption rate and the new dynamic threshold in the (N + 1)th time period of the target virus detection process. The new dynamic threshold is calculated based on the CPU consumption rates in the most recent N time periods, that is, the N time periods counted backward from the (N + 1)th time period, namely the 2nd to the (N + 1)th time periods. The calculation process of the CPU consumption rate and the new dynamic threshold can refer to the above-mentioned calculation process of the CPU consumption rate and the dynamic threshold, which will not be elaborated here.

[0053] Then, the CPU consumption rate in the (N + 1)th time period is compared with the new dynamic threshold. If it is less than or equal to the new dynamic threshold, a resume signal is sent to the target virus detection process to make it continue running. Since the target virus detection process pauses in the (N + 1)th time period, its CPU consumption rate will drop to a relatively low level, and the new dynamic threshold is calculated based on the CPU consumption rates in the 2nd to the (N + 1)th time periods, where the CPU consumption rates in the 2nd to the Nth time periods are relatively high. Therefore, generally, the CPU consumption rate in the (N + 1)th time period will be less than or equal to the new dynamic threshold.

[0054] In summary, the embodiment of the present invention provides a low-power virus detection method. By obtaining the CPU consumption rates of the target virus detection process in N time periods and calculating the weighted average of the N CPU consumption rates to obtain the dynamic threshold, and then comparing the CPU consumption rate in the Nth time period with the dynamic threshold. If it is greater than the dynamic threshold, a stop signal is sent to the target virus detection process to pause its operation. Applying the above method, the CPU consumption rate of the target virus detection process can be monitored at any time. When its CPU consumption rate is too high, it is paused to avoid the impact of a high CPU consumption rate of a certain process on other processes, providing a good user experience for users.

[0055] The following is an embodiment of the device of the present invention, which can be used to execute the embodiment of the method of the present invention. For the details not disclosed in the embodiment of the device of the present invention, please refer to the embodiment of the method of the present invention.

[0056] Please refer to Figure 2 , which is a schematic structural diagram of a low-power virus detection device provided by an embodiment of the present invention.

[0057] The low-power virus detection device 200 in the embodiment of the present invention includes: a CPU consumption rate acquisition module 201, a dynamic threshold calculation module 202, and a target virus detection process control module 203.

[0058] The CPU consumption rate acquisition module is used to acquire the CPU consumption rate of the target virus detection process within N time periods; the N time periods are sorted according to time; N>0 and is an integer;

[0059] The dynamic threshold calculation module is used to perform a weighted average calculation on the N CPU consumption rates to obtain a dynamic threshold;

[0060] The target virus detection process control module is used to compare the CPU consumption rate in the Nth time period with the dynamic threshold. If it is greater than the dynamic threshold, a stop signal is sent to the target virus detection process to pause the operation of the target virus detection process.

[0061] It should be noted that when the low-power virus detection device provided in the above embodiment executes the low-power virus detection method, only the above-mentioned division of each functional module is used for illustration. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the low-power virus detection device provided in the above embodiment and the embodiment of the low-power virus detection method belong to the same concept. Therefore, for the details not disclosed in the embodiment of the device of the present invention, please refer to the embodiment of the above-mentioned low-power virus detection method of the present invention, which will not be repeated here.

[0062] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments.

[0063] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the method in any of the foregoing embodiments are implemented. Among them, the computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disk, optical disk, DVD, CD-ROM, microdrive, and magneto-optical disk, ROM, RAM, EPROM, EEPROM, DRAM, VRAM, flash memory device, magnetic card or optical card, nano system (including molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0064] An embodiment of the present invention further provides a terminal, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the method in any of the above embodiments are implemented.

[0065] Figure 3 It is a block diagram of a terminal provided by an embodiment of the present invention. Please refer to Figure 3 An embodiment of the present invention provides a terminal 300, including: a processor 301, a communication interface 302, a memory 303, and a communication bus 304. Among them, the processor 301, the communication interface 302, and the memory 303 complete mutual communication through the communication bus 304. The processor 301 can call the logical instructions in the memory 303 to execute the following method, including: obtaining the CPU consumption rate of the target virus detection process in N time periods; the N time periods are sorted according to time; N>0 and is an integer; performing a weighted average calculation on the N CPU consumption rates to obtain a dynamic threshold; comparing the CPU consumption rate in the Nth time period with the dynamic threshold, and if it is greater than the dynamic threshold, sending a stop signal to the target virus detection process to pause the operation of the target virus detection process.

[0066] The block diagram of the terminal structure shown in the embodiment of the present invention does not limit the terminal 300. The terminal 300 may include more or fewer components than shown in the figure, or combine some components, or adopt a different component layout.

[0067] An embodiment of the present invention discloses a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided in the above method embodiments, for example, including: obtaining the CPU consumption rate of the target virus detection process in N time periods; the N time periods are sorted according to time; N>0 and is an integer; performing a weighted average calculation on the N CPU consumption rates to obtain a dynamic threshold; comparing the CPU consumption rate in the Nth time period with the dynamic threshold, and if it is greater than the dynamic threshold, sending a stop signal to the target virus detection process to pause the operation of the target virus detection process.

[0068] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A low-power virus detection method, characterized in that: include: Obtain the CPU consumption rate of the target virus detection process in N time periods; the N time periods are sorted by time; the N>0 and is an integer; Perform weighted average calculation on N CPU consumption rates to obtain a dynamic threshold; The CPU consumption rate in the Nth time period is compared with the dynamic threshold. If the CPU consumption rate is greater than the dynamic threshold, a stop signal is sent to the target virus detection process to suspend the target virus detection process.

2. The method according to claim 1, characterized in that: The obtaining of the CPU consumption rate of the target virus detection process in N time periods includes: Setting a monitoring process, and obtaining CPU time slice consumption data of the operating system and the target virus detection process within N time periods through the monitoring process; The CPU consumption rate of the target virus detection process in each time period is calculated through the CPU time slice consumption data in each time period, thereby obtaining N CPU consumption rates.

3. The method according to claim 2, characterized in that: The CPU consumption rate is obtained according to the following formula: T i =(tb1-ta1) / (tb2-ta2) where 0 < i ≤ N, and i is an integer, T i is the CPU consumption rate of the target virus detection process in the i-th time period; tb1 is the number of CPU time slices consumed by the target virus detection process at the end of the i-th time period, and ta1 is the number of CPU time slices consumed by the target virus detection process at the beginning of the i-th time period; tb2 is the number of CPU time slices consumed by the operating system at the end of the i-th time period, and ta2 is the number of CPU time slices consumed by the operating system at the beginning of the i-th time period.

4. The method according to claim 3, characterized in that: The weighted average calculation of the N CPU consumption rates to obtain the dynamic threshold value includes: Generate N weight values; the sum of the N weight values ​​is equal to 1, and increases in sequence; The N weight values ​​and the N CPU consumption rates are weightedly calculated to obtain a dynamic threshold.

5. The method according to claim 4, characterized in that: The N weight values ​​are obtained according to the following formula: where 0 < i ≤ N, and i is an integer, w i is the i-th weight value, and S is calculated according to the formula as follows.

6. The method according to any one of claims 1 to 5, characterized in that: After comparing the CPU consumption rate in the Nth time period with the dynamic threshold, and if the CPU consumption rate is greater than the dynamic threshold, sending a stop signal to the target virus detection process to suspend the target virus detection process, the method further includes: Obtaining the CPU consumption rate and the new dynamic threshold value of the target virus detection process in the N+1th time period; the new dynamic threshold value is calculated based on the CPU consumption rate in the most recent N time periods; If the CPU consumption rate in the N+1th time period is less than or equal to the new dynamic threshold, a recovery signal is sent to the target virus detection process to enable the target virus detection process to continue running.

7. A low-power virus detection device, characterized in that: include: A CPU consumption rate acquisition module, used to acquire the CPU consumption rate of the target virus detection process in N time periods; the N time periods are sorted by time; N>0 and is an integer; The dynamic threshold calculation module is used to perform weighted average calculation on N CPU consumption rates to obtain a dynamic threshold; The target virus detection process control module is used to compare the CPU consumption rate in the Nth time period with the dynamic threshold, and if it is greater than the dynamic threshold, send a stop signal to the target virus detection process to suspend the target virus detection process.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

Images