Cloud-Based Malicious Program Detection via Index Tag Scripting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus systems face challenges in efficiently detecting and removing malicious programs due to the time-consuming signature database update process, leading to increased malicious program proliferation and potential system instability from erroneous operations.
Innovation Solution
A cloud-based malicious program finding and killing method that calculates an index tag for scanned files, sends it to a server for script retrieval, and executes the received script to identify and eliminate malicious programs, thereby bypassing local engine updates and ensuring targeted and precise operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the local finding and killing engine updates the version according to analysis results, then the finding and killing capability is improved, but the updating time is long causing malicious programs to spread
Solution Approach 1:
The server pre-calculates and stores finding and killing scripts for multiple possible malicious program types in advance. When a file is scanned, the system quickly matches the file's index tag with pre-prepared scripts, avoiding the time-consuming process of analyzing and updating local engines. This preliminary preparation of finding and killing strategies resolves the contradiction between having updated capability and minimizing update time.
2Ease of operation
If universal finding and killing operations are performed locally, then the operation is simple, but erroneous operations cause system or applications unable to work properly
Solution Approach 1:
The server acts as an intermediary that provides customized finding and killing scripts tailored to specific file types and malicious program characteristics. Instead of performing universal local operations that may cause errors, the system retrieves precise scripts from the server that are specifically designed for the scanned file, thereby maintaining operational simplicity while significantly improving reliability and preventing system instability.
3Adaptability or versatility
If the signatures database is continuously updated to cover new malicious programs, then the detection coverage is improved, but the update process is time consuming
Solution Approach 1:
Instead of updating the entire local finding and killing engine with comprehensive signature databases, the system segments the detection capability into file-specific scripts stored on the server. Each script handles specific file types or malicious program categories. This segmentation allows the system to maintain broad detection coverage by having specialized scripts ready for different scenarios without requiring time-consuming full database updates at each terminal.
Data Source
AI summary
Disclosed are a malicious program finding and killing device, method and server. The device comprises: one or more non-transitory computer readable medium configured to store computer-executable instructions; at least one processor to execute the computer-executable instructions to perform operations comprising: sending information to a server, and receiving information returned by the server; starting a scan task to scan an object to be scanned, calculating an index tag of a file scanned, send the index tag to the server, and receiving a script returned by the server, the script being found according to the index tag and corresponding to the file scanned; and executing the received script to find and kill the malicious program in the file scanned.