Virus Detection via Stability Feature Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virus detection methods, such as characteristic code matching, struggle to accurately detect virus variants, leading to reduced accuracy in identifying and securing user data and privacy information.
Innovation Solution
A virus detection method involving preprocessing of files to obtain stable information, calculating characteristic parameter values, and comparing these values with a server-based virus library to enhance detection accuracy, allowing for effective virus scanning and killing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If characteristic code matching method is used for virus detection, then detection speed and ease of operation are improved, but detection precision deteriorates because variant viruses cannot be accurately detected
Solution Approach 1:
The patent segments the file into multiple blocks and extracts features from each block independently. Instead of matching the entire file at once, the system divides it into manageable segments, extracts stability features from each segment, and compares them separately. This segmentation allows the system to detect variant viruses more effectively while maintaining operational efficiency.
Solution Approach 2:
The patent introduces stability features as an intermediary between the raw file data and the virus detection comparison. Rather than directly comparing raw codes, the system extracts stability features (such as entropy, byte distribution statistics) that serve as intermediate representations. These features capture essential characteristics while being robust to variations, enabling accurate detection of virus variants.
2Measurement precision
If preprocessing and stability analysis are performed on files, then detection precision is improved, but device complexity and computation time increase
Solution Approach 1:
The patent extracts only the essential stability features from the file rather than analyzing the entire file content. By taking out specific statistical features (entropy, byte frequency distributions, block stability metrics) that are most relevant for virus detection, the system achieves high detection accuracy while avoiding the complexity of comprehensive file analysis.
Solution Approach 2:
The patent transforms the raw file data into different parameter representations by calculating stability features such as entropy values, byte distribution statistics, and block-level metrics. This parameter transformation converts complex binary data into simplified statistical representations that are easier to compare and analyze, reducing system complexity while improving detection precision.
3Loss of energy
If characteristic code matching is used, then system overhead is reduced, but detection scope deteriorates because variant viruses are missed
Solution Approach 1:
The patent enables the system to automatically adapt to virus variants by using stability features that inherently capture the essential characteristics of viruses regardless of specific code variations. The stability feature extraction process serves itself by naturally identifying consistent patterns across different virus variants without requiring manual updates to detection signatures, thereby expanding detection scope while maintaining low overhead.
Data Source
AI summary
A virus detection method, a terminal, and a server are provided. The method includes performing preprocessing on an obtained to-be-processed file according to a preset policy, to obtain a part that is in the to-be-processed file and whose stability is greater than a first threshold as effective information. The effective information is calculated to obtain a first characteristic parameter value. The first characteristic parameter value is transmitted to a server for performing detection by means of virus comparison, and a detection result of the virus comparison is received. Virus scanning is performed on a local file according to the detection result.