Mining virus detection method and device and storage medium

Through a mining virus detection method that combines eBPF tools and reverse engineering tools, file creation information is obtained in real time and mining features are extracted. This solves the problems of missed detection and high false alarm rates of traditional detection methods, and achieves early identification of non-running programs and efficient feature library updates.

CN120597274AActive Publication Date: 2025-09-05INSPUR SUZHOU INTELLIGENT TECH CO LTD
4 Cites 0 Cited by

Patent Information

Application Number
CN202511100083.6
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-08-06
Publication Date
2025-09-05
Estimated Expiration
2045-08-06

AI Technical Summary

Technical Problem

Existing mining virus detection methods have problems such as missed detection, high false alarm rates, and difficulty in detecting low-intensity and non-resource-intensive mining viruses. Traditional feature library detection is inefficient, and system resource monitoring makes it difficult to accurately identify them.

Method used

By mounting the eBPF tool, file creation information is obtained in real time, and reverse engineering tools are used to extract mining features. Virus detection is performed by combining key matching items and bitmap matching technology to identify viruses in non-running programs in real time.

Benefits of technology

It improves the timeliness and accuracy of virus detection, reduces dependence on third-party tools, can quickly integrate and update feature libraries, reduce false positive rates, and comprehensively monitor files, network behavior, and operating parameters.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention provides a mining virus detection method and device and a storage medium, and the method comprises the steps: obtaining file creation information in real time through an eBPF tool which is mounted to a first system call; obtaining a file path of the first program file based on the file creation information; obtaining the first program file based on the file path of the first program file; according to the method, mining feature extraction is performed on the first program file through a reverse tool, and whether the first program file is the mining virus or not is detected based on the extracted mining feature, so that the instantaneity and accuracy of virus detection are improved.
Need to check novelty before this filing date? Find Prior Art