Method and system for monitoring and analyzing interference of antivirus software on broadcast control software

Abstract

The application provides a monitoring and analyzing method and system for interference of antivirus software to broadcast control software. The method first establishes a benchmark database by constructing two benchmark scenes of completely closing and configuring exceptions of the antivirus software; synchronously collects application software behavior data and marks delay abnormal events by using non-intrusive burying points; constructs a double-path capture mechanism by using explicit logs and kernel state hooks to obtain implicit scanning behaviors of the antivirus software for exception objects in real time; and then performs three-dimensional causal matching based on time, behavior and characteristics, and determines interference reasons and outputs an evaluation report in combination with benchmark difference values. The application breaks through the technical bottleneck that the implicit scanning cannot be monitored under the exception configuration, realizes accurate identification, causal tracing and quantitative evaluation of high real-time software interference, and provides support for software optimization and configuration adjustment of the antivirus software.

Description

Technical Field

[0001] This invention relates to the field of broadcast control software optimization technology, and more specifically, to a method and system for monitoring and analyzing interference from antivirus software on broadcast control software. Background Technology

[0002] In Windows operating systems, antivirus software, as a core component of endpoint security, continuously scans and monitors the processes, files, and network interactions of applications within the system to prevent malicious program attacks. However, for applications with extremely high real-time requirements, such as broadcast control software, multiple device control commands need to be sent precisely at preset time points. Even minor delays in the command transmission process can lead to a decrease in device control accuracy or even cause serious business failures.

[0003] To circumvent antivirus software scanning interference, existing technologies typically add the application software's executable file to the antivirus software's exception configuration list, hoping the antivirus software will skip scanning and monitoring of that application software. However, in real-world applications, due to the existence of hidden scanning mechanisms in antivirus software, such as background process hooks, file integrity checks, or real-time memory page monitoring, even with exception configuration added, the antivirus software may still cause hidden interference to the application software's operation, leading to problems such as decreased application software execution efficiency and instruction sending delays.

[0004] Currently, determining whether antivirus software interferes with application software mainly relies on conventional system performance monitoring methods, such as monitoring CPU usage, memory consumption, or process response time. However, these conventional monitoring methods have significant drawbacks. First, they cannot accurately distinguish the source of interference. High overall system load, hardware performance bottlenecks, and resource consumption by other background processes can all lead to decreased application software execution efficiency, making it difficult to pinpoint whether antivirus software scanning interference is the cause. Second, conventional methods typically have low sampling frequencies, failing to effectively capture the instantaneous interference caused by covert antivirus scanning. This is particularly problematic for scenarios requiring millisecond-level command responses, such as broadcast control software, easily overlooking instantaneous delay events caused by scanning. Finally, existing technologies lack quantitative analysis capabilities, failing to clearly define the specific correlation between antivirus software scanning behavior and application software latency anomalies, making it difficult to prove the causal relationship of interference from multiple dimensions such as time, behavior, and characteristics.

[0005] Therefore, existing monitoring and analysis methods cannot meet the requirements of high real-time application software for antivirus software interference monitoring in terms of accuracy, real-time performance, and causal traceability. There is an urgent need in this field for an innovative monitoring and analysis method to accurately capture the hidden scanning interference of antivirus software on application software under exceptional configurations and clarify the causal relationship of the interference, thereby providing reliable data support for subsequent real-time optimization of application software. Summary of the Invention

[0006] The present invention aims to solve at least one of the aforementioned technical problems existing in the prior art.

[0007] Therefore, the first aspect of the present invention provides a method for monitoring and analyzing interference of antivirus software with broadcast control software.

[0008] The second aspect of this invention provides a system for monitoring and analyzing interference from antivirus software to broadcast control software.

[0009] This invention provides a method for monitoring and analyzing interference from antivirus software to broadcast control software, comprising: Construct a system environment benchmark scenario, collect benchmark performance data of the broadcast control software under the benchmark scenario, and establish a benchmark database; Data points are embedded in the key execution nodes of the broadcast control software to synchronously collect application software behavior data. When the instruction sending delay exceeds a preset threshold, it is marked as a delay abnormal event and an abnormal timestamp is recorded. A dual-path scanning behavior capture mechanism is constructed, which captures the explicit scan data of the antivirus software through explicit log parsing, and captures the implicit scan data of the antivirus software for the exception configuration object through system kernel hooks; Based on the abnormal timestamp of the delayed abnormal event, the explicit scan data and implicit scan data are retrieved within a preset time window, and three-dimensional causal matching is performed. The three-dimensional causal matching includes time correlation matching, behavior correlation matching and feature correlation matching. Based on the results of the three-dimensional causal matching, and in conjunction with the comparison between the performance indicators under the actual monitoring environment and the benchmark performance data, it is determined whether the antivirus software interferes with the broadcast control software.

[0010] The method for monitoring and analyzing interference of antivirus software with broadcast control software according to the above-described technical solution of the present invention may further have the following additional technical features: In the above technical solution, the construction system environment benchmark scenario includes: Under the same hardware and system configuration, a first baseline scenario is constructed in which the antivirus software is completely turned off, and a second baseline scenario is constructed in which the antivirus software is turned on and the executable file of the broadcast control software is added to the exception list.

[0011] In the above technical solution, when synchronously collecting application software behavior data, a microsecond-level sampling frequency is used, and the collected data is stored in a local circular buffer. When the buffer is full, it automatically overwrites historical non-abnormal data and prioritizes retaining abnormal marker data related to the delayed abnormal event.

[0012] In the above technical solution, the mechanism for constructing a dual-path scanning behavior capture includes: The scan log is read by parsing the application programming interface or log file provided by the antivirus software. The interaction between the core scanning process of the antivirus software and the core process of the broadcast control software is monitored using system kernel-mode hook technology, and implicit scanning feature data, including memory page access records, inter-process communication interaction duration, and file handle occupancy records, are captured.

[0013] In the above technical solution, the time correlation matching includes: Extract the abnormal timestamp, and search within a preset time window for whether there is scanning behavior targeting the core process or related files of the broadcast control software. If so, it is determined that the time correlation match is valid.

[0014] In the above technical solution, the behavior correlation matching includes: Analyze the trends in process scheduling delay and file input / output operation duration of the broadcast control software during the scanning period. If they are positively correlated with the scanning duration, the behavior correlation match is determined to be valid.

[0015] In the above technical solution, the feature correlation matching includes: The features of the scanning behavior are compared with a preset interference feature library. If the feature matching degree is greater than or equal to a preset threshold, the feature correlation matching is determined to be successful.

[0016] In the above technical solution, determining whether the antivirus software interferes with the broadcast control software by comparing performance indicators under actual monitoring conditions with the benchmark performance data includes: When both the time correlation matching and the behavior correlation matching are valid and the feature matching degree is greater than or equal to the preset threshold, the difference between the performance index under the actual monitoring environment and the benchmark performance data corresponding to the first benchmark scenario and the second benchmark scenario is calculated. If the difference between the antivirus software and the first benchmark scenario is greater than the difference between the antivirus software and the second benchmark scenario, it is determined that the antivirus software is interfering with the broadcast control software.

[0017] In the above technical solution, after determining that the antivirus software is interfering with the broadcast control software, the method further includes: Quantitative calculations were performed on the incremental delay in command transmission, duration of interference, and frequency of interference caused by antivirus software scanning. Locate the antivirus software process causing the interference, the scan type, and the scan targets; To address hidden scanning interference under exceptional configurations, the system outputs configuration optimization suggestions such as adding associated dynamic link libraries or configuration files to the exception list or adjusting the scanning frequency.

[0018] This invention provides a monitoring and analysis system for interference of antivirus software with broadcast control software, comprising: The benchmark monitoring module is used to construct a system environment benchmark scenario, collect benchmark performance data of the broadcast control software under the benchmark scenario, and establish a benchmark database. The application behavior monitoring module is used to embed points at key execution nodes of the broadcast control software, synchronously collect application software behavior data, and mark the instruction sending delay as a delay abnormal event and record the abnormal timestamp when the monitoring detects that the instruction sending delay exceeds a preset threshold. The scanning and capture module is used to build a dual-path scanning behavior capture mechanism. It captures the explicit scanning data of the antivirus software by parsing explicit logs, and captures the implicit scanning data of the antivirus software for exception configuration objects by using system kernel hooks. The causal matching module is used to retrieve the explicit scan data and implicit scan data within a preset time window based on the abnormal timestamp of the delayed abnormal event, and perform three-dimensional causal matching. The three-dimensional causal matching includes time correlation matching, behavior correlation matching and feature correlation matching. The interference determination module is used to determine whether the antivirus software interferes with the broadcast control software based on the results of the three-dimensional causal matching and the comparison between the performance indicators under the actual monitoring environment and the benchmark performance data.

[0019] In summary, due to the adoption of the above-mentioned technical features, the beneficial effects of the present invention are: This invention overcomes the technical bottleneck of failing to detect hidden scans under exceptional configurations. Through a dual-path scan capture mechanism combining explicit log parsing and system kernel-mode hooking technology, this invention achieves accurate capture of hidden scan behaviors of antivirus software under exceptional configurations, such as memory page verification and associated file scanning, effectively solving the technical pain point that existing conventional methods cannot capture such hidden interference.

[0020] This invention offers high accuracy in interference identification and traceable causal relationships. It innovatively employs a three-dimensional causal matching model that integrates temporal, behavioral, and feature correlations, combined with difference calibration based on a system environment benchmark scenario. This effectively eliminates interference from irrelevant factors such as overall system load fluctuations or hardware performance bottlenecks. This multi-dimensional joint analysis method can accurately pinpoint the causal relationship between antivirus software scanning behavior and abnormal application software instruction delays, fundamentally avoiding misjudgments in interference detection.

[0021] The monitoring mechanism of this invention is deeply adapted to the needs of high real-time scenarios. By adopting a non-intrusive data entry design at key execution nodes of the application software and combining it with microsecond-level high-frequency sampling, this invention ensures extremely high real-time performance of the monitoring process, accurately capturing millisecond-level or even microsecond-level instantaneous delays in the broadcast control software during operation, while avoiding additional performance loss and interference to the original execution efficiency of the application software caused by the data acquisition and monitoring behavior itself.

[0022] Furthermore, this invention possesses powerful capabilities for interference quantification analysis and optimization guidance. It can not only qualitatively determine the existence of interference, but also quantitatively calculate the latency increment caused by interference, and accurately pinpoint the specific antivirus software process, scan type, and scan target causing the interference. For confirmed hidden scanning interference under exceptional configurations, this invention can automatically output highly targeted configuration optimization suggestions, directly serving the real-time optimization of application software and the precise adjustment of antivirus software security policies, demonstrating significant practical value.

[0023] This invention possesses strong system versatility and application scalability. The entire implementation process requires no modification to the underlying source code of the target application software and antivirus software. It can seamlessly adapt to mainstream Windows operating systems and various mainstream antivirus software on the market, and can be flexibly extended to other complex application scenarios with extremely high real-time requirements, such as industrial control software and medical equipment control software, making it widely applicable.

[0024] Additional aspects and advantages of the invention will become apparent in the following description or may be learned by practice of the invention. Attached Figure Description

[0025] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a flowchart of a method for monitoring and analyzing interference of antivirus software with broadcast control software, according to an embodiment of the present invention. Detailed Implementation

[0026] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0027] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0028] The following reference Figure 1 This invention describes a method and system for monitoring and analyzing interference of antivirus software with broadcast control software, provided by some embodiments of the present invention.

[0029] Some embodiments of this application provide a method for monitoring and analyzing interference of antivirus software with broadcast control software.

[0030] like Figure 1 As shown, the first embodiment of this invention proposes a method for monitoring and analyzing interference from antivirus software to broadcast control software. The overall process encompasses the construction of a baseline environment, bidirectional capture of software behavior and scanning behavior, and final causal matching and quantitative analysis. It should be noted that the method and system provided by this invention are widely applicable to various Windows operating systems. Furthermore, the application software applicable to this method is software with high real-time requirements; it is not limited to broadcast control software but can also be applied to high real-time programs such as industrial control software and medical equipment control software, depending on actual industrial or medical scenarios. Correspondingly, the antivirus software includes not only Windows Defender but also various mainstream antivirus software commonly found on the market, such as 360 Antivirus and Kingsoft Antivirus. The monitoring logic of this embodiment is universally applicable to all of the above-mentioned software.

[0031] In this embodiment, the implementation environment is configured as a Windows 10 Professional terminal equipped with an Intel Core i7 processor, 32GB of memory, and an NVMe solid-state drive. When configuring the hardware environment, hardware-level input / output performance bottlenecks should be avoided as much as possible to prevent them from affecting the monitoring results. The target antivirus software is Windows Defender with real-time protection enabled; the target application software is the broadcast control software of the broadcast control terminal, which supports preset command sending and device control. The preset sending interval for its control commands is 100ms, and the preset threshold for abnormal latency is 10ms. The method of this disclosure specifically includes the following steps S1 to S5.

[0032] S1. Construct a system environment benchmark scenario, collect benchmark performance data of the broadcast control software under the benchmark scenario, and establish a benchmark database.

[0033] In one specific embodiment, under the same hardware and system configuration, a first baseline scenario is constructed where the antivirus software is completely disabled. The broadcast control software is then started and continuously sends 1000 device control commands. The system uses a baseline monitoring module to collect performance data such as the sending delay, process scheduling delay, and file input / output operation duration for each command. The average latency baseline value corresponding to each performance data point is calculated and used as baseline value 1 (baseline performance data under the first baseline scenario). A second baseline scenario is constructed by enabling the antivirus software and adding the executable file of the broadcast control software to the exception list. The same operation is performed to collect the average latency baseline value corresponding to each performance data point, which is used as baseline value 2 (baseline performance data under the second baseline scenario). All the above raw test data and baseline performance data are stored in the baseline database.

[0034] S2. Insert data points at key execution nodes of the broadcast control software, synchronously collect application software behavior data, and when the instruction sending delay exceeds a preset threshold, mark it as a delay abnormal event and record the abnormal timestamp.

[0035] Specifically, for target application software (such as broadcast control software), lightweight behavioral tracking points are embedded in its key execution nodes (instruction generation node, instruction sending node, and device response receiving node). The following core data are collected simultaneously: Command-related data: Command ID, preset command sending time, actual command sending time, command sending delay (actual sending time - preset sending time), command type, and target device of the command; Process-related data: application software core process ID, instantaneous CPU / memory usage of the process, process thread scheduling latency, and process file I / O operation duration (for instruction-related configuration files and log files); Anomaly marking data: When the instruction sending delay exceeds the preset threshold (set according to the application software business requirements, such as 10ms for broadcast control software), it is automatically marked as a delay anomaly event, and the timestamp of the anomaly and the duration of the anomaly delay are recorded.

[0036] In some embodiments, the application software behavior monitoring module uses a microsecond-level sampling frequency, and the collected data is stored in a local circular buffer to avoid I / O operations having an additional impact on the real-time performance of the application software. When the buffer is full, it automatically overwrites historical non-abnormal data and prioritizes the retention of abnormal marker data related to delayed abnormal events.

[0037] In one specific embodiment, the behavior tracking adopts a non-intrusive design (using dynamic hooking technology without modifying the application software source code), collecting instruction and process status (including instruction ID, preset sending time, actual sending time, process ID, CPU / memory usage, etc.) at a sampling frequency of 100μs. The system operates under real-time monitoring to ensure overall load stability, i.e., CPU utilization not exceeding 30% and memory utilization not exceeding 50% (to eliminate irrelevant interference). When a transmission delay of more than 10ms is detected for an instruction, the system marks it as a delay anomaly event and records the anomaly timestamp, for example, the 10,000th millisecond, represented as T=10000ms.

[0038] S3. Construct a dual-path scanning behavior capture mechanism, which captures the explicit scan data of the antivirus software through explicit log parsing, and captures the implicit scan data of the antivirus software for the exception configuration object through system kernel hooks.

[0039] In some embodiments, this mechanism, on the one hand, reads explicit scan logs through application programming interfaces (such as the Windows Defender API) or log files provided by the antivirus software, reads the antivirus software's scan logs in real time, and extracts scan timestamps, scan objects (process ID, file path, network connection), scan types (file scan, process scan, memory scan), scan duration, and scan results; for application software with exceptional configurations, it focuses on capturing abnormal logs of "exception objects triggering scans" (such as background verification scans of exception exe by the antivirus software).

[0040] On the other hand, the system kernel hook technology is used to monitor the interaction between the core scanning process of the antivirus software (such as the Defender core process MsMpEng.exe) and the core process of the broadcast control software, and to capture hidden scanning feature data, including memory page access records, inter-process communication interaction duration, and file handle occupancy records (even if the target exe is set as an exception, the antivirus software may secretly access its associated dynamic link libraries and configuration files).

[0041] The scanning monitoring data and application software behavior monitoring data are synchronized using a timestamp mechanism (based on a high-precision clock on the Windows system) to ensure that the temporal correlation between the two types of data is traceable.

[0042] In one specific embodiment, the capture module successfully recorded that the antivirus software core process MsMpEng.exe performed a 40ms hidden memory scan on the associated dynamic link library file Control.dll of the broadcast control software between 9980ms and 10020ms.

[0043] S4. Based on the abnormal timestamp of the delayed abnormal event, retrieve the explicit scan data and implicit scan data within a preset time window, and perform three-dimensional causal matching. The three-dimensional causal matching includes time correlation matching, behavior correlation matching and feature correlation matching.

[0044] In some embodiments, the time correlation matching includes: Extract the abnormal timestamp, and search within a preset time window for whether there is scanning behavior targeting the core process or related files of the broadcast control software. If so, it is determined that the time correlation match is valid.

[0045] Specifically, extract the timestamp (T) of application software delay exception events. 异常 ), in the antivirus software scan monitoring data, the time window [T 异常 -ΔT,T 异常 Within +ΔT] (ΔT is set to 50ms, which can be adjusted according to the scenario), all scanning behaviors (including explicit and implicit) are recorded. If there are scanning behaviors that target the core process of the target application software or related files (such as exe, dll, configuration files), it is initially determined that there is a time correlation, and the scanning duration and scanning type of the scanning behavior are recorded.

[0046] In one specific embodiment, the abnormal timestamp at 10000ms is extracted, and a preset time window is set for 50ms before and after it, i.e., from 9950ms to 10050ms. The aforementioned 40ms implicit memory scan (located in the interval of 9980ms-10020ms) falls exactly within this window, and the time correlation match is determined to be valid.

[0047] In some embodiments, the behavioral correlation matching includes: Analyze the trends in process scheduling delay and file input / output operation duration of the broadcast control software during the scanning period. If they are positively correlated with the scanning duration, the behavior correlation match is determined to be valid.

[0048] Specifically, for scanning behaviors that successfully match time correlations, analyze their behavioral correlation with application software latency anomalies, including: Process interaction correlation: Determine whether the scanning behavior triggers memory access or thread interception of the target application software process. If the scanning duration and process scheduling delay change in the same trend (the process scheduling delay increases synchronously when the scanning duration increases), then the behavior correlation is determined to be valid. I / O association: Determine whether the scanning behavior involves files related to the target application software's command sending (such as command configuration files, device communication logs). If the file I / O operation time of the application software increases significantly when the scanning behavior occurs, and is positively correlated with the scanning time, then the behavior association is determined to be valid. Command delay correlation: Determine whether the time period of the scanning behavior coincides with the time period when multiple commands of the application software have abnormal delays. If the overlap exceeds 80%, the behavior correlation determination is strengthened.

[0049] In one specific embodiment, analysis revealed that during the aforementioned covert scanning behavior, the process scheduling delay of the broadcast control software increased from 2ms to 8ms from the baseline value 2, and the I / O operation duration increased from 1ms to 6ms from the baseline value 2, showing a positive correlation with the scanning duration (40ms). Furthermore, during this scanning period, a total of 3 instructions exhibited abnormal delays (12ms, 15ms, and 11ms respectively), with a 100% overlap, thus confirming the behavioral correlation match.

[0050] In some embodiments, the feature association matching includes: The features of the scanning behavior are compared with a preset interference feature library. If the feature matching degree is greater than or equal to a preset threshold, the feature correlation matching is determined to be successful.

[0051] Specifically, an antivirus software scanning interference feature library is constructed. The feature library contains interference features corresponding to different antivirus software and different scan types (such as memory scanning causing process thread scheduling delay to increase by more than 30%, and file verification scanning causing I / O operation time to increase by more than 50%). Scan behavior features that successfully match the time and behavior correlation are compared with the features in the interference feature library, and the feature matching degree is calculated. If the matching degree exceeds a preset threshold (such as 70%), it is determined that the scanning behavior is the main cause of abnormal application software delay.

[0052] In one specific embodiment, based on the above-mentioned stealth scanning behavior, the interference feature library is queried. The interference feature corresponding to the stealth memory scan of Windows Defender is "process scheduling delay increased by ≥300%, I / O operation duration increased by ≥500%". The process scheduling delay caused by this scan increased by 300% (8ms / 2ms) and I / O operation duration increased by 500% (6ms / 1ms). The feature matching degree is 85% (≥70% threshold). At the same time, the difference between the actual delay (12ms) and the baseline value 1 (3ms) is 9ms, and the difference between the actual delay and the baseline value 2 (5ms) is 7ms. When the two differences are significant (greater than the set threshold, such as 1ms), normal system fluctuations can be ruled out.

[0053] S5. Based on the results of the three-dimensional causal matching, and in conjunction with the comparison between the performance indicators under the actual monitoring environment and the benchmark performance data, determine whether the antivirus software interferes with the broadcast control software.

[0054] Specifically, determining whether the antivirus software interferes with the broadcast control software by comparing performance indicators under actual monitoring conditions with the benchmark performance data includes: When both the time correlation matching and the behavior correlation matching are valid and the feature matching degree is greater than or equal to the preset threshold, the difference between the performance index under the actual monitoring environment and the benchmark performance data corresponding to the first benchmark scenario and the second benchmark scenario is calculated. If the difference between the antivirus software and the first benchmark scenario is greater than the difference between the antivirus software and the second benchmark scenario, it is determined that the antivirus software is interfering with the broadcast control software.

[0055] Among them, time correlation matching is used to prove the existence of synchronous scanning behavior, behavior correlation matching is used to prove that there is a clear interaction between scanning behavior and delay anomaly, and feature correlation matching and comparison of the two differences are used to exclude normal system fluctuations under exceptional configurations.

[0056] In some embodiments, after determining that the antivirus software is interfering with the broadcast control software, the method further includes: performing quantitative analysis on the delay anomaly event determined to be caused by antivirus software interference, and outputting an interference assessment report, specifically including: The quantitative calculation of the instruction sending delay increment, interference duration, and interference frequency caused by antivirus software scanning is as follows: Specifically, the calculation of the application software instruction sending delay increment (actual delay - baseline delay under antivirus software shutdown scenario), interference duration (duration from the start of scanning to the recovery of the delay anomaly), and interference frequency (number of interference events per unit time) caused by antivirus software scanning behavior are as follows. Locate the antivirus software process causing the interference, the scan type (explicit / implicit), and the scan targets (such as application software exe, associated dll). For hidden scanning interference under exceptional configurations, the system outputs configuration optimization suggestions, such as adding associated dynamic link libraries or configuration files to the exception list or adjusting the scan frequency. Specifically, this is output in the form of visual reports (including interference time-series curves, feature matching degrees, and quantitative indicators) and log files. Additionally, for hidden scanning interference under exceptional configurations, the system automatically provides antivirus software configuration optimization suggestions (such as adding associated DLLs or configuration files to the exception list and adjusting the scan frequency).

[0057] In one specific embodiment, the instruction transmission delay increment caused by the interference is calculated as 12ms - 3ms = 9ms, the duration of the interference is 10020ms - 9980ms = 40ms, and the number of interference events occurring per unit time (1 minute) is 5. The source of the interference was identified as the core process of Windows Defender, MsMpEng.exe. The scan type was hidden memory scan, and the scan target was the associated DLL file (Control.dll) of the broadcast control software. Generate visual reports that display interference timing curves (correlation curves between scan duration and command latency), feature matching degree, and quantitative indicators; and provide optimization suggestions: add the Control.dll file to the Windows Defender exception list to reduce the background scan frequency.

[0058] After the maintenance personnel adjusted the configuration according to the recommendations, subsequent monitoring confirmed that the command sending delay had recovered to the baseline level of less than five milliseconds, which fully verified the effectiveness of the system.

[0059] Corresponding to the above monitoring and analysis methods, other embodiments of the present invention also provide a monitoring and analysis system for antivirus software interference with broadcast control software, used to execute the methods described in any of the above embodiments. This system includes a baseline monitoring module, an application behavior monitoring module, a scan capture module, a causal matching module, and an interference determination module.

[0060] The benchmark monitoring module is used to construct a system environment benchmark scenario, collect benchmark performance data of the broadcast control software under the benchmark scenario, and establish a benchmark database. The application behavior monitoring module is used to embed points at key execution nodes of the broadcast control software, synchronously collect application software behavior data, and mark it as a delay anomaly event and record the abnormal timestamp when the detected instruction sending delay exceeds a preset threshold. The scan capture module is used to construct a dual-path scan behavior capture mechanism, capture the explicit scan data of the antivirus software through explicit log parsing, and capture the implicit scan data of the antivirus software for exception configuration objects through system kernel hooks. The causal matching module is used to retrieve the explicit scan data and implicit scan data within a preset time window based on the abnormal timestamp of the delay anomaly event, and perform three-dimensional causal matching, which includes time correlation matching, behavior correlation matching, and feature correlation matching. The interference judgment module is used to determine whether the antivirus software interferes with the broadcast control software based on the results of the three-dimensional causal matching and the comparison between the performance indicators under the actual monitoring environment and the benchmark performance data.

[0061] In this specification, the illustrative expressions of the terms used do not necessarily refer to the same embodiments or examples. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0062] Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this invention shall be included within the scope of protection of this invention.

Claims

1. A method for monitoring and analyzing interference from antivirus software to broadcast control software, characterized in that, include: Construct a system environment benchmark scenario, collect benchmark performance data of the broadcast control software under the benchmark scenario, and establish a benchmark database; Data points are embedded in the key execution nodes of the broadcast control software to synchronously collect application software behavior data. When the instruction sending delay exceeds a preset threshold, it is marked as a delay abnormal event and an abnormal timestamp is recorded. A dual-path scanning behavior capture mechanism is constructed, which captures the explicit scan data of the antivirus software through explicit log parsing, and captures the implicit scan data of the antivirus software for the exception configuration object through system kernel hooks; Based on the abnormal timestamp of the delayed abnormal event, the explicit scan data and implicit scan data are retrieved within a preset time window, and three-dimensional causal matching is performed. The three-dimensional causal matching includes time correlation matching, behavior correlation matching and feature correlation matching. Based on the results of the three-dimensional causal matching, and in conjunction with the comparison between the performance indicators under the actual monitoring environment and the benchmark performance data, it is determined whether the antivirus software interferes with the broadcast control software.

2. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 1, characterized in that, The benchmark scenarios for building the system environment include: Under the same hardware and system configuration, a first baseline scenario is constructed in which the antivirus software is completely turned off, and a second baseline scenario is constructed in which the antivirus software is turned on and the executable file of the broadcast control software is added to the exception list.

3. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 1, characterized in that, When synchronously collecting application software behavior data, a microsecond-level sampling frequency is used, and the collected data is stored in a local circular buffer. When the buffer is full, it automatically overwrites historical non-abnormal data and prioritizes retaining abnormal marker data related to the delayed abnormal event.

4. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 1, characterized in that, The mechanism for capturing dual-path scanning behavior includes: The scan log is read by parsing the application programming interface or log file provided by the antivirus software. The interaction between the core scanning process of the antivirus software and the core process of the broadcast control software is monitored using system kernel-mode hook technology, and implicit scanning feature data, including memory page access records, inter-process communication interaction duration, and file handle occupancy records, are captured.

5. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 1, characterized in that, The time-related matching includes: Extract the abnormal timestamp, and search within a preset time window for whether there is scanning behavior targeting the core process or related files of the broadcast control software. If so, it is determined that the time correlation match is valid.

6. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 5, characterized in that, The behavioral correlation matching includes: Analyze the trends in process scheduling delay and file input / output operation duration of the broadcast control software during the scanning period. If they are positively correlated with the scanning duration, the behavior correlation match is determined to be valid.

7. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 6, characterized in that, The feature association matching includes: The features of the scanning behavior are compared with a preset interference feature library. If the feature matching degree is greater than or equal to a preset threshold, the feature correlation matching is determined to be successful.

8. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 2, characterized in that, The determination of whether the antivirus software interferes with the broadcast control software by comparing performance indicators under actual monitoring conditions with the benchmark performance data includes: When both the time correlation matching and the behavior correlation matching are valid and the feature matching degree is greater than or equal to the preset threshold, the difference between the performance index under the actual monitoring environment and the benchmark performance data corresponding to the first benchmark scenario and the second benchmark scenario is calculated. If the difference between the antivirus software and the first benchmark scenario is greater than the difference between the antivirus software and the second benchmark scenario, it is determined that the antivirus software is interfering with the broadcast control software.

9. The method for monitoring and analyzing interference of antivirus software with broadcast control software according to claim 1, characterized in that, After determining that the antivirus software is interfering with the broadcast control software, the method further includes: Quantitative calculations were performed on the incremental delay in command transmission, duration of interference, and frequency of interference caused by antivirus software scanning. Locate the antivirus software process causing the interference, the scan type, and the scan targets; To address hidden scanning interference under exceptional configurations, the system outputs configuration optimization suggestions such as adding associated dynamic link libraries or configuration files to the exception list or adjusting the scanning frequency.

10. A monitoring and analysis system for interference of antivirus software with broadcast control software, characterized in that, include: The benchmark monitoring module is used to construct a system environment benchmark scenario, collect benchmark performance data of the broadcast control software under the benchmark scenario, and establish a benchmark database. The application behavior monitoring module is used to embed points at key execution nodes of the broadcast control software, synchronously collect application software behavior data, and mark the instruction sending delay as a delay abnormal event and record the abnormal timestamp when the monitoring detects that the instruction sending delay exceeds a preset threshold. The scanning and capture module is used to build a dual-path scanning behavior capture mechanism. It captures the explicit scanning data of the antivirus software by parsing explicit logs, and captures the implicit scanning data of the antivirus software for exception configuration objects by using system kernel hooks. The causal matching module is used to retrieve the explicit scan data and implicit scan data within a preset time window based on the abnormal timestamp of the delayed abnormal event, and perform three-dimensional causal matching. The three-dimensional causal matching includes time correlation matching, behavior correlation matching and feature correlation matching. The interference determination module is used to determine whether the antivirus software interferes with the broadcast control software based on the results of the three-dimensional causal matching and the comparison between the performance indicators under the actual monitoring environment and the benchmark performance data.

Images