Thread-Level Virus Detection and Process Creation Prohibition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virus processing methods face challenges in thoroughly eradicating viruses due to their replicative nature, which complicates the identification and removal of infected files, leading to potential re-infection and difficulty in ensuring system security.
Innovation Solution
A virus processing method and apparatus that perform attribute analysis on threads within a target process to determine if they match virus attribute information, prohibiting process creation operations based on the identified virus type, thereby preventing replication and enhancing system security by isolating and repairing infected files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If attribute analysis is performed on the entire file to detect viruses, then the detection coverage is comprehensive, but the analysis granularity is too coarse to effectively prevent virus replication
Solution Approach 1:
The patent segments the file analysis from traditional whole-file scanning to thread-level attribute analysis. By dividing the analysis unit from file to thread, the system achieves finer granularity detection that can identify virus characteristics at the thread level, thereby improving both detection precision and the effectiveness of preventing virus replication.
2Reliability
If the system prohibits all process creation operations to prevent virus replication, then system security is improved, but normal system operations are affected
Solution Approach 1:
The patent applies local quality by making the process creation prohibition specific and targeted rather than universal. The system prohibits process creation only for threads that match virus attribute information, while allowing normal process creation to continue. This localized approach maintains system security without disrupting normal operations.
3Ease of manufacture
If traditional virus scanning methods are used to identify infected files, then the scanning process is simple, but the ability to thoroughly eradicate replicable viruses is insufficient
Solution Approach 1:
The patent implements preliminary action by performing attribute analysis on threads before virus replication can occur. The system proactively identifies threads with virus attributes and prohibits their process creation operations in advance, preventing the spread of replicable viruses before they can infect other files.
Data Source
Figure 1~2
Figure 3
AI summary
Embodiments of the present disclosure provide a virus processing method and apparatus. In embodiments of the present disclosure, attribute analysis on the threads contained in the target process is performed to determine whether at least one of the threads contained in the target process matches virus attribute information. If at least one of the threads contained in the target process matches virus attribute information, virus type information is determined based on the matched virus attribute information, so that execution of process creation operation is prohibited based on the virus type information. Due to the measures of prohibiting execution of process creation operation, replication of virus in the system can be effectively prevented so as to improve security performance of the system.