Thread-Level Virus Detection and Process Creation Prohibition

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing virus processing methods face challenges in thoroughly eradicating viruses due to their replicative nature, which complicates the identification and removal of infected files, leading to potential re-infection and difficulty in ensuring system security.

Innovation Solution

A virus processing method and apparatus that perform attribute analysis on threads within a target process to determine if they match virus attribute information, prohibiting process creation operations based on the identified virus type, thereby preventing replication and enhancing system security by isolating and repairing infected files.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If attribute analysis is performed on the entire file to detect viruses, then the detection coverage is comprehensive, but the analysis granularity is too coarse to effectively prevent virus replication

Engineering Contradiction:
Improvedetection precisionVSAvoidvirus removal efficiency
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the file analysis from traditional whole-file scanning to thread-level attribute analysis. By dividing the analysis unit from file to thread, the system achieves finer granularity detection that can identify virus characteristics at the thread level, thereby improving both detection precision and the effectiveness of preventing virus replication.

Inventive Principle:
Principle #1Segmentation

2Reliability

If the system prohibits all process creation operations to prevent virus replication, then system security is improved, but normal system operations are affected

Engineering Contradiction:
Improvesystem securityVSAvoidsystem operation normality
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent applies local quality by making the process creation prohibition specific and targeted rather than universal. The system prohibits process creation only for threads that match virus attribute information, while allowing normal process creation to continue. This localized approach maintains system security without disrupting normal operations.

Inventive Principle:
Principle #3Local quality

3Ease of manufacture

If traditional virus scanning methods are used to identify infected files, then the scanning process is simple, but the ability to thoroughly eradicate replicable viruses is insufficient

Engineering Contradiction:
Improvescanning simplicityVSAvoidvirus eradication completeness
Core Design Contradiction:
Ease of manufactureVSReliability

Solution Approach 1:

The patent implements preliminary action by performing attribute analysis on threads before virus replication can occur. The system proactively identifies threads with virus attributes and prohibits their process creation operations in advance, preventing the spread of replicable viruses before they can infect other files.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2874090B1Virus processing method and apparatus
Publication Date: 2018.01.17 BAIDU ONLINE NETWORK TECH (BEIJIBG) CO LTD
  • EP2874090B1 patent drawingFigure 1~2
  • EP2874090B1 patent drawingFigure 3

AI summary

Embodiments of the present disclosure provide a virus processing method and apparatus. In embodiments of the present disclosure, attribute analysis on the threads contained in the target process is performed to determine whether at least one of the threads contained in the target process matches virus attribute information. If at least one of the threads contained in the target process matches virus attribute information, virus type information is determined based on the matched virus attribute information, so that execution of process creation operation is prohibited based on the virus type information. Due to the measures of prohibiting execution of process creation operation, replication of virus in the system can be effectively prevented so as to improve security performance of the system.