CN103679021B - Virus scan method and virus scan device - Google Patents
Virus scan method and virus scan device Download PDFInfo
- Publication number
- CN103679021B CN103679021B CN201210345537.2A CN201210345537A CN103679021B CN 103679021 B CN103679021 B CN 103679021B CN 201210345537 A CN201210345537 A CN 201210345537A CN 103679021 B CN103679021 B CN 103679021B
- Authority
- CN
- China
- Prior art keywords
- file
- scanned
- scanning
- virus
- result
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Measuring Or Testing Involving Enzymes Or Micro-Organisms (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The present invention relates to a kind of virus scan method, including：Load the confidence packets that multiple virus scanning engines are directed to different scanning result；A file to be scanned is obtained from the queue of file to be scanned；Choose a virus scanning engine not being scanned to the file to be scanned；Carry out the first judgment step：If scanning engine of the file that file to be scanned is not scanned or this is to be scanned with scanning result but selection may be drawn than scanning result of the scanning result with higher confidence level：The file to be scanned is scanned using the virus scanning engine of selection.Above-mentioned scan method can draw the virus scan result of optimization.In addition, the present invention also provides a kind of virus scan device.
Description
Technical field
The present invention relates to virus scan technology, more particularly to a kind of virus scan method and virus scan device.
Background technology
In order to improve the recall rate to virus, increasing anti-viral software starts to carry out using multiple Anti- Virus Engines
Virus investigation, relatively common is exactly that a local Anti- Virus Engine adds a high in the clouds Anti- Virus Engine, and some anti-viral softwares are also
Multiple local Anti- Virus Engines can be used.Anti-viral software is scanned using multiple Anti- Virus Engines for same file
Afterwards, scanning result is collected, then draws a final result.
However, multiple Anti- Virus Engines scan the problem of being possible to bring scanning result inconsistent simultaneously, if properly
Handle the problem of these inconsistent scanning results just turn into multi engine while necessarily considered when scanning.
The content of the invention
In view of this, it is necessary to provide a kind of virus scan method and virus scan device, it can make full use of various
The advantage of virus scanning engine, and draw the virus scan result of optimization.
A kind of virus scan method, including：Load the credible number of degrees that multiple virus scanning engines are directed to different scanning result
According to；A file to be scanned is obtained from the queue of file to be scanned；One is chosen not to be scanned the file to be scanned
Virus scanning engine；Carry out the first judgment step：If the file that file to be scanned is not scanned or this is to be scanned
Scanning engine with scanning result but selection may be drawn than scanning result of the scanning result with higher confidence level
Then：The file to be scanned is scanned using the virus scanning engine of selection.
A kind of virus scan method, including：Load the credible number of degrees that multiple virus scanning engines are directed to different scanning result
According to；Obtain the queue of file to be scanned；The plurality of virus scanning engine is respectively adopted to each file to be scanned in the queue
It is scanned；Confidence level highest conduct in the scanning result of the plurality of virus scanning engine is chosen for each file to be scanned
The scanning result of the file to be scanned.
A kind of virus scan device, including：Confidence level loading unit, for loading multiple virus scanning engines for difference
The confidence packets of scanning result；File obtaining unit, for obtaining a text to be scanned from the queue of file to be scanned
Part；Engine chooses unit, for choosing a virus scanning engine not being scanned to the file to be scanned；First judges list
Member, for carrying out the first judgment step：Judge whether the file to be scanned is not scanned or this is to be scanned file
The scanning knot with higher confidence level than the scanning result whether may be drawn through the scanning engine with scanning result but selection
Fruit；Call the engine to choose the virus scanning engine of unit selection if being to be if the first judgment step result and scan the text to be scanned
Part.
A kind of virus scan device, including：Confidence level loading unit, load multiple virus scanning engines and be directed to different scanning
As a result confidence packets；Queue acquiring unit, for obtaining the queue of file to be scanned；Virus scan unit, for respectively
Each file to be scanned in the queue is scanned using the plurality of virus scanning engine；Scanning result returning unit, use
Confidence level highest is waited to sweep as this in the scanning result that the plurality of virus scanning engine is chosen for each file to be scanned
Retouch the scanning result of file.
In above-mentioned virus scan method and device, for each scanned file, what is taken is with highest confidence level
Scanning result, accuracy rate during virus scan can be lifted.In addition, by the way that basis can before formally scanning and after scanning
Reliability data judge whether to need to be scanned so as to reduce invalid scanning times, when improving multi engine virus scan
Efficiency.
For the above and other objects, features and advantages of the present invention can be become apparent, preferred embodiment cited below particularly,
And coordinate institute's accompanying drawings, it is described in detail below.
Brief description of the drawings
Fig. 1 is the virus scan method flow diagram of first embodiment.
Fig. 2 is the schematic diagram of the confidence packets loaded in the virus scan method of first embodiment.
Fig. 3 is the virus scan method flow diagram of second embodiment.
Fig. 4 is the structured flowchart of the virus scan device of 3rd embodiment.
Fig. 5 is the structured flowchart of the virus scan device of fourth embodiment.
Embodiment
Further to illustrate that the present invention is to realize technological means and effect that predetermined goal of the invention taken, below in conjunction with
Accompanying drawing and preferred embodiment, to embodiment, structure, feature and its effect according to the present invention, describe in detail as after.
First embodiment provides a kind of virus scan method, and refering to Fig. 1, it comprises the following steps：
Step S110, the confidence packets that multiple virus scanning engines are directed to different scanning result are loaded.
Confidence packets can be stored in the machine, can also be stored in cloud server.It is stored in cloud server
In advantage be that the publisher of virus scanning software can update confidence packets according to newest data statistics.
Refering to Fig. 2, it is the confidence packets that three kinds of virus scanning engines are directed to different scanning result.Wherein, scanning knot
Fruit is trojan horse equivalent risk file for black this file of expression, and scanning result scans to represent that this file is nontoxic in vain
As a result it can not judge that this file is black or white for ash expression, scanning result is unknown expression also without the detection of this file
As a result.
Step S120, a file to be scanned is obtained from the queue of file to be scanned.
File extent to be scanned is typically selected by user, such as can be just for specific file, particular category or institute
Some catalogues.After user selectes scanning range, you can accordingly generate the queue of file to be scanned.For each treating in queue
Scanning file, at least need to preserve its file path.In addition, its scanning result can be also preserved in the lump, it will be understood that scanning result
With multiple.Each virus scanning engine can correspond to a scanning result.
Step S130, a virus scanning engine not being scanned to the file to be scanned is chosen.
The selected of virus scanning engine has no specific order, can arbitrarily choose.However, in order to lift virus scan
Efficiency, can be with the higher virus scanning engine of prioritizing selection scanning result confidence level.For example, to virus scanning engine different scanning
As a result confidence level average mark is ranked up.By taking the confidence packets shown in Fig. 2 as an example, engine A confidence level is equally divided into
9.3, engine B confidence level are equally divided into 6.3, and engine C confidence level is equally divided into 2.Therefore, engine A can be selected at first,
Engine B takes second place, and finally just selects engine C.
Step S140, the first judgment step is carried out：If the text that file to be scanned is not scanned or this is to be scanned
Scanning engine of the part with scanning result but selection may draw the scanning knot with higher confidence level than the scanning result
Fruit then follows the steps below S150.
Step S150, the file to be scanned is scanned using the virus scanning engine of selection.
Such as if engine B has got file, check file by engine A and engine C-scan mistake, engine A scanning
As a result it is ash (credible score value be 7), engine C-scan result also be ash (credible score value is 0), the maximum score value of current scanline result
For engine A grey result 7, in engine B credible score value the confidence level of black result and white result all higher than scanning result most
Big score value, the result of a more high score may be drawn by illustrating engine B scanning, then engine B starts to scan this document.
Step S160 can be also carried out after step s 150, carry out the second judgment step：If in the plurality of virus scanning engine
The virus scanning engine not being scanned to the file to be scanned can not possibly show that the scanning result of file more to be scanned than this has
The scanning result of higher confidence level then carries out step S170：Return to scanning result and the text to be scanned is removed from the queue
Part.
For example engine A sweep finishes a file, as a result to be white, engine A white credible result score value is 12, checks and does not sweep
Result all not higher than 12 points the engine B and engine C retouched, then it is assumed that engine B and C are not necessarily to sweep this document
Retouch.The result that such as engine A sweep finishes a file again is ash, checks the engine B not scanned and engine C credible result
Score value, engine B black result and the credible score value 8 and 11 of white result are all higher than engine A grey credible result score value 7, then will
This document is not removed from queue, file continues waiting for the scanning of other engines.
As described above, in step if being preferentially scanned from the virus scanning engine with higher confidence level average mark
It is likely to draw the result that need not be scanned using other virus scanning engines again in S160, so can then lifts multi engine and sweep
Efficiency when retouching.
Scanning result is returned if it need not be scanned again and file to be scanned is removed from queue.It is appreciated that
The scanning result returned herein is result, i.e. sweeping with highest confidence level obtained from comprehensive all scanned engines
Retouch result.For example, engine A scanning result is white (credible score value is 12), engine B is black (credible score value is 8), and C engines are not
Scanning (credible score value is 0), then the final scanning result of this document is white.
In addition, if the judged result in step S140 is no, chooses one again and the file to be scanned is not swept
The virus scanning engine retouched simultaneously re-starts step S140.
If step S160 judged result is to be：Again the virus not being scanned to the file to be scanned is chosen
Scanning engine simultaneously re-starts step S140.
In the virus scan method of the present embodiment, for each scanned file, what is taken has highest confidence level
Scanning result, accuracy rate during virus scan can be lifted.In addition, by before formally scanning and scanning after according to credible
Degrees of data judges whether to need to be scanned so as to reduce invalid scanning times, improves effect during multi engine virus scan
Rate.
Second embodiment provides a kind of virus scan method, and refering to Fig. 3, it includes：
Step S210, the confidence packets that multiple virus scanning engines are directed to different scanning result are loaded.
Confidence packets can be stored in the machine, can also be stored in cloud server.It is stored in cloud server
In advantage be that the publisher of virus scanning software can update confidence packets according to newest data statistics.
Refering to Fig. 2, it is the confidence packets that three kinds of virus scanning engines are directed to different scanning result.Wherein, scanning knot
Fruit is trojan horse equivalent risk file for black this file of expression, and scanning result scans to represent that this file is nontoxic in vain
As a result it can not judge that this file is black or white for ash expression, scanning result is unknown expression also without the detection of this file
As a result.
Step S220, the queue of file to be scanned is obtained.
File extent to be scanned is typically selected by user, such as can be just for specific file, particular category or institute
Some catalogues.After user selectes scanning range, you can accordingly generate the queue of file to be scanned.For each treating in queue
Scanning file, at least need to preserve its file path.In addition, its scanning result can be also preserved in the lump, it will be understood that scanning result
With multiple.Each virus scanning engine can correspond to a scanning result.
Step S230, the plurality of virus scanning engine is respectively adopted to sweep each file to be scanned in the queue
Retouch.
For each file to be scanned in queue, the plurality of virus scanning engine is respectively adopted and is scanned.Multiple diseases
Malicious scanning engine successively can be scanned to reduce to the occupancy of system successively, can also parallel scan with improving sweep efficiency.
Step S240, for confidence level in the scanning result of the plurality of virus scanning engine of each file selection to be scanned most
The high scanning result as the file to be scanned.
Because multiple virus scanning engines may have different scanning results., it is necessary to select in these scanning results
Confidence level highest scanning result is taken as final scanning result.For example, (credible score value is engine A scanning result to be white
12), engine B is black (credible score value is 8), and C engines do not scan (credible score value is 0), then the final scanning result of this document is
In vain.
In the virus scan method of the present embodiment, for each scanned file, what is taken has highest confidence level
Scanning result, accuracy rate during virus scan can be lifted.
3rd embodiment provides a kind of virus scan device, and refering to Fig. 4, it includes：Confidence level loading unit 310, file
Acquiring unit 320, engine choose unit 330, the first judging unit 340, the second judging unit 350 and end of scan unit
360。
Confidence level loading unit 310 is used to load the credible number of degrees that multiple virus scanning engines are directed to different scanning result
According to.Confidence packets can be stored in the machine, can also be stored in cloud server.It is stored in excellent in cloud server
Gesture is that the publisher of virus scanning software can update confidence packets according to newest data statistics.
Refering to Fig. 2, it is the confidence packets that three kinds of virus scanning engines are directed to different scanning result.Wherein, scanning knot
Fruit is trojan horse equivalent risk file for black this file of expression, and scanning result scans to represent that this file is nontoxic in vain
As a result it can not judge that this file is black or white for ash expression, scanning result is unknown expression also without the detection of this file
As a result.
File obtaining unit 320 is used to obtain a file to be scanned from the queue of file to be scanned.Text to be scanned
Part scope is typically selected by user, such as can be just for specific file, particular category or all catalogues.Selected in user
After determining scanning range, you can accordingly generate the queue of file to be scanned.For each file to be scanned in queue, at least need
Preserve its file path.In addition, its scanning result can be also preserved in the lump, it will be understood that scanning result has multiple.Each virus
Scanning engine can correspond to a scanning result.
Engine chooses unit 330 and is used to choose a virus scanning engine for not being scanned the file to be scanned.Disease
The selected of malicious scanning engine has no specific order, can arbitrarily choose., can be with however, in order to lift the efficiency of virus scan
The higher virus scanning engine of prioritizing selection scanning result confidence level.For example, to virus scanning engine different scanning result can
Reliability average mark is ranked up.By taking the confidence packets shown in Fig. 2 as an example, engine A confidence level is equally divided into 9.3, engine B's
Confidence level is equally divided into 6.3, and engine C confidence level is equally divided into 2.Therefore, at first engine A, engine B can be selected to take second place,
Finally just select engine C.
First judging unit 340 is used to carry out the first judgment step：Judge whether the file to be scanned is not scanned
Or whether the scanning engine that the file to be scanned has had scanning result but chosen may draw have than the scanning result
There is the scanning result of higher confidence level；The engine is called to choose the disease that unit 330 is chosen if being to be if the first judgment step result
Malicious scanning engine scans the file to be scanned.
Such as if engine B has got file, check file by engine A and engine C-scan mistake, engine A scanning
As a result it is ash (credible score value be 7), engine C-scan result also be ash (credible score value is 0), the maximum score value of current scanline result
For engine A grey result 7, in engine B credible score value the confidence level of black result and white result all higher than scanning result most
Big score value, the result of a more high score may be drawn by illustrating engine B scanning, then engine B starts to scan this document.
Otherwise if the result of the first judgment step is：Engine can be re-called and choose unit 330 to choose one again not
The virus scanning engine that is scanned to the file to be scanned simultaneously re-starts first judgment step.
Second judging unit 350 is used to carry out after the virus scanning engine of the selection is scanned the file to be scanned
Second judgment step：The virus scanning engine for judging not to be scanned the file to be scanned in the plurality of virus scanning engine is
The no scanning result that may draw file more to be scanned than this has the scanning result of higher confidence level；If the second judgment step result
Otherwise to call end of scan unit 360.If the result of second judgment step is to be：Call engine choose unit 330 with
Again choose a virus scanning engine not being scanned to the file to be scanned and re-start first judgment step.
For example engine A sweep finishes a file, as a result to be white, engine A white credible result score value is 12, checks and does not sweep
Result all not higher than 12 points the engine B and engine C retouched, then it is assumed that engine B and C are not necessarily to sweep this document
Retouch.The result that such as engine A sweep finishes a file again is ash, checks the engine B not scanned and engine C credible result
Score value, engine B black result and the credible score value 8 and 11 of white result are all higher than engine A grey credible result score value 7, then will
This document is not removed from queue, file continues waiting for the scanning of other engines.
End of scan unit 360 is used to return to scanning result and the file to be scanned is removed from the queue.Scanning knot
Shu Danyuan 360 for example can return to the scanning result with highest confidence level.
In the virus scan device of the present embodiment, for each scanned file, what is taken has highest confidence level
Scanning result, accuracy rate during virus scan can be lifted.In addition, by before formally scanning and scanning after according to credible
Degrees of data judges whether to need to be scanned so as to reduce invalid scanning times, improves effect during multi engine virus scan
Rate.
Fourth embodiment provides a kind of virus scan device, and refering to Fig. 5, it includes：Confidence level loading unit 410, queue
Acquiring unit 420, virus scan unit 430 and scanning result returning unit 440.
Confidence level loading unit 410 is used to load the confidence level that multiple virus scanning engines are directed to different scanning result.Can
Reliability data can be stored in the machine, can also be stored in cloud server.The advantage being stored in cloud server exists
Confidence packets can be updated according to newest data statistics in the publisher of virus scanning software.
Refering to Fig. 2, it is the confidence packets that three kinds of virus scanning engines are directed to different scanning result.Wherein, scanning knot
Fruit is trojan horse equivalent risk file for black this file of expression, and scanning result scans to represent that this file is nontoxic in vain
As a result it can not judge that this file is black or white for ash expression, scanning result is unknown expression also without the detection of this file
As a result.
Queue acquiring unit 420 is used for the queue for obtaining file to be scanned.File extent to be scanned is typically selected by user,
Such as can be just for specific file, particular category or all catalogues.After user selectes scanning range, you can corresponding
Generate the queue of file to be scanned.For each file to be scanned in queue, at least need to preserve its file path.In addition,
Its scanning result can be also preserved in the lump, it will be understood that scanning result has multiple.Each virus scanning engine can correspond to one
Scanning result.
Virus scan unit 430 is used to the plurality of virus scanning engine be respectively adopted to each text to be scanned in the queue
Part is scanned.For each file to be scanned in queue, the plurality of virus scanning engine is respectively adopted and is scanned.It is multiple
Virus scanning engine successively can be scanned to reduce to the occupancy of system successively, can also parallel scan to lift scanning effect
Rate.
Scanning result returning unit 440 is used for the scanning that the plurality of virus scanning engine is chosen for each file to be scanned
As a result scanning result of the middle confidence level highest as the file to be scanned.Because multiple virus scanning engines may have not
Same scanning result., it is necessary to choose confidence level highest scanning result as final scanning result in these scanning results.
For example, engine A scanning result is white (credible score value is 12), engine B is black (credible score value is 8), and C engines do not scan (can
Believe score value for 0), then the final scanning result of this document is white.
In the virus scan device of the present embodiment, for each scanned file, what is taken has highest confidence level
Scanning result, accuracy rate during virus scan can be lifted.
In addition, the embodiment of the present invention also provides a kind of computer-readable recording medium, it is stored with computer and can perform
Instruction, above-mentioned computer-readable recording medium is, for example, nonvolatile memory such as CD, hard disk or flash memory.It is above-mentioned
Computer executable instructions be used to allowing computer or similar arithmetic unit to complete it is each in above-mentioned virus scan method
Kind operation.
The above described is only a preferred embodiment of the present invention, any formal limitation not is made to the present invention, though
So the present invention is disclosed as above with preferred embodiment, but is not limited to the present invention, any those skilled in the art, not
Depart from the range of technical solution of the present invention, when the technology contents using the disclosure above make a little change or are modified to equivalent change
The equivalent embodiment of change, as long as being without departing from technical solution of the present invention content, the technical spirit according to the present invention is implemented to more than
Example any brief introduction modification, equivalent variations and the modification made, in the range of still falling within technical solution of the present invention.
Claims (14)
1. a kind of virus scan method, including：
The confidence packets that multiple virus scanning engines are directed to different scanning result are loaded, the confidence packets are included to risk
File, nontoxic file, the credible score value that file and the scanning result of unknown file can not be judged；
A file to be scanned is obtained from the queue of file to be scanned；
Choose a virus scanning engine not being scanned to the file to be scanned；
Carry out the first judgment step：If the file that file to be scanned is not scanned or this is to be scanned has scanning
As a result but choose scanning engine may draw than the scanning result have higher confidence level scanning result then：
The file to be scanned is scanned using the virus scanning engine of selection.
2. virus scan method as claimed in claim 1, it is characterised in that be somebody's turn to do using the virus scanning engine scanning chosen
Also include after file to be scanned：
Carry out the second judgment step：If the virus scan not being scanned in the plurality of virus scanning engine to the file to be scanned
Engine can not possibly show that the scanning result of file more to be scanned than this has the scanning result of higher confidence level then：Return to scanning result
And the file to be scanned is removed from the queue.
3. virus scan method as claimed in claim 1, it is characterised in that also include：If the result of first judgment step
For otherwise：Again choose a virus scanning engine not being scanned to the file to be scanned and re-start first judgement
Step.
4. virus scan method as claimed in claim 2, it is characterised in that also include：If the result of second judgment step
To be then：Again choose a virus scanning engine not being scanned to the file to be scanned and re-start first judgement
Step.
5. virus scan method as claimed in claim 1, it is characterised in that the plurality of virus scanning engine is directed to different scanning
As a result confidence level is loaded at cloud server.
6. virus scan method as claimed in claim 1, it is characterised in that returning to scanning result includes：Return has highest
The scanning result of confidence level.
7. a kind of virus scan method, including：
The confidence packets that multiple virus scanning engines are directed to different scanning result are loaded, the confidence packets are included to risk
File, nontoxic file, the credible score value that file and the scanning result of unknown file can not be judged；
Obtain the queue of file to be scanned；
The plurality of virus scanning engine is respectively adopted to be scanned each file to be scanned in the queue；
Confidence level highest in the scanning result of the plurality of virus scanning engine is chosen for each file to be scanned to treat as this
The scanning result of scanning file.
8. a kind of virus scan device, including：
Confidence level loading unit, the confidence packets of different scanning result are directed to for loading multiple virus scanning engines, it is described
Confidence packets are included to risk file, nontoxic file, the credible score value that can not judge file and the scanning result of unknown file；
File obtaining unit, for obtaining a file to be scanned from the queue of file to be scanned；
Engine chooses unit, for choosing a virus scanning engine not being scanned to the file to be scanned；
First judging unit, for carrying out the first judgment step：Judge whether the file to be scanned is not scanned or is somebody's turn to do
Whether the scanning engine of file to be scanned with scanning result but selection may be drawn than the scanning result with higher
The scanning result of confidence level；The engine is called to choose the virus scanning engine of unit selection if being to be if the first judgment step result
Scan the file to be scanned.
9. virus scan device as claimed in claim 8, it is characterised in that also include：
Second judging unit, sentence for carrying out second after the virus scanning engine of the selection is scanned to the file to be scanned
Disconnected step：Whether the virus scanning engine for judging not to be scanned the file to be scanned in the plurality of virus scanning engine may
Drawing the scanning result of file more to be scanned than this has the scanning result of higher confidence level；Otherwise if the second judgment step result is
Call end of scan unit；
The end of scan unit, for returning to scanning result and the file to be scanned being removed from the queue.
10. virus scan device as claimed in claim 8, it is characterised in that also include：If the result of first judgment step
For otherwise：The engine chooses unit and is additionally operable to choose a virus scanning engine for not being scanned the file to be scanned again
And re-start first judgment step.
11. virus scan device as claimed in claim 9, it is characterised in that also include：If the result of second judgment step
To be then：The engine chooses unit and is additionally operable to choose a virus scanning engine for not being scanned the file to be scanned again
And re-start first judgment step.
12. virus scan device as claimed in claim 8, it is characterised in that the confidence level loading unit is used to take from high in the clouds
The confidence level for being directed to different scanning result is loaded at business device.
13. virus scan device as claimed in claim 8, it is characterised in that the end of scan unit, which is used to return, to be had most
The scanning result of high confidence level.
14. a kind of virus scan device, including：
Confidence level loading unit, the confidence packets that multiple virus scanning engines are directed to different scanning result are loaded, it is described credible
Degrees of data is included to risk file, nontoxic file, the credible score value that can not judge file and the scanning result of unknown file；
Queue acquiring unit, for obtaining the queue of file to be scanned；
Virus scan unit, each file to be scanned in the queue is carried out for the plurality of virus scanning engine to be respectively adopted
Scanning；
Scanning result returning unit, for being chosen for each file to be scanned in the scanning result of the plurality of virus scanning engine
Scanning result of the confidence level highest as the file to be scanned.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210345537.2A CN103679021B (en) | 2012-09-17 | 2012-09-17 | Virus scan method and virus scan device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210345537.2A CN103679021B (en) | 2012-09-17 | 2012-09-17 | Virus scan method and virus scan device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103679021A CN103679021A (en) | 2014-03-26 |
| CN103679021B true CN103679021B (en) | 2017-12-26 |
Family
ID=50316531
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210345537.2A Active CN103679021B (en) | 2012-09-17 | 2012-09-17 | Virus scan method and virus scan device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103679021B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108804925B (en) * | 2015-05-27 | 2022-02-01 | 北京百度网讯科技有限公司 | Method and system for detecting malicious code |
| CN106326741A (en) * | 2015-06-17 | 2017-01-11 | 阿里巴巴集团控股有限公司 | Method and device for malicious program detection based on multi-engine system |
| CN112214765A (en) * | 2020-09-29 | 2021-01-12 | 珠海豹好玩科技有限公司 | Virus checking and killing method and device, electronic equipment and storage medium |
| CN113836533A (en) * | 2021-09-27 | 2021-12-24 | 深信服科技股份有限公司 | File monitoring method and device, electronic equipment and readable storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6944775B2 (en) * | 2001-07-26 | 2005-09-13 | Networks Associates Technology, Inc. | Scanner API for executing multiple scanning engines |
| CN101685486A (en) * | 2008-09-23 | 2010-03-31 | 联想(北京)有限公司 | Virus killing method and virus killing system with multiple antivirus engines |
| CN102279917A (en) * | 2011-09-19 | 2011-12-14 | 奇智软件（北京）有限公司 | Multi-antivirus engine parallel antivirus method and system |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9392002B2 (en) * | 2002-01-31 | 2016-07-12 | Nokia Technologies Oy | System and method of providing virus protection at a gateway |
-
2012
- 2012-09-17 CN CN201210345537.2A patent/CN103679021B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6944775B2 (en) * | 2001-07-26 | 2005-09-13 | Networks Associates Technology, Inc. | Scanner API for executing multiple scanning engines |
| CN101685486A (en) * | 2008-09-23 | 2010-03-31 | 联想(北京)有限公司 | Virus killing method and virus killing system with multiple antivirus engines |
| CN102279917A (en) * | 2011-09-19 | 2011-12-14 | 奇智软件（北京）有限公司 | Multi-antivirus engine parallel antivirus method and system |
Non-Patent Citations (2)
| Title |
|---|
| 多方会诊 请多病毒引擎为你的电脑把把脉;高密 等;《网友世界》;20100301;第29页第2框第1段,及图1-6 * |
| 看我对付重启重生病毒;薛宝赏 等;《《电脑爱好者（普及版）》;20090501;第39页第1段 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103679021A (en) | 2014-03-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP5976020B2 (en) | System and method for performing anti-malware metadata lookup | |
| US10165001B2 (en) | Method and device for processing computer viruses | |
| CN103679021B (en) | Virus scan method and virus scan device | |
| EP2741227B1 (en) | Method, system, client and server for scanning file | |
| US9547765B2 (en) | Validating a type of a peripheral device | |
| US8869277B2 (en) | Realtime multiple engine selection and combining | |
| CN103559443B (en) | The virus scan method and apparatus of device for multi-core | |
| US9111094B2 (en) | Malware detection | |
| JP7470645B2 (en) | Method, device and system for combining object detection models | |
| US20100008569A1 (en) | System and method for identifying text-based spam in rasterized images | |
| CN102222192A (en) | Optimizing anti-malicious software treatment by automatically correcting detection rules | |
| US20090216868A1 (en) | Anti-spam tool for browser | |
| US8502830B2 (en) | Image processing apparatus, image processing method, and storage medium | |
| US20100299631A1 (en) | Prompt for User Input on All Workflow Activities Before Workflow Execution | |
| JP6292401B2 (en) | Multifunction machine and display control method | |
| US11516249B1 (en) | On-demand scanning of e-mail attachments | |
| CN105389351A (en) | Account number upgrading method and apparatus for specified platform | |
| US7730533B1 (en) | Cache hint correction for security scanning | |
| US10757272B2 (en) | Virus check method and information processing device, image forming device, and image forming system that perform the virus check method | |
| US11126722B1 (en) | Replacement of e-mail attachment with URL | |
| US11503165B2 (en) | Method of setting parameters used to adjust quality of scanned image, information processing apparatus employing such a method, and non-transitory computer-readable recording medium therefor | |
| US20220075888A1 (en) | Information processing apparatus, service providing system, and method | |
| US20220201143A1 (en) | Information processing device and non-transitory computer readable medium | |
| JP5942649B2 (en) | Image forming apparatus and program | |
| US9069960B1 (en) | System, method, and computer program product for avoiding an on-access scan of data accessible by a collaborative portal application after an on-demand scan |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20190731 Address after: 518057 Nanshan District science and technology zone, Guangdong, Zhejiang Province, science and technology in the Tencent Building on the 1st floor of the 35 layer Co-patentee after: Tencent cloud computing (Beijing) limited liability company Patentee after: Tencent Technology (Shenzhen) Co., Ltd. Address before: Shenzhen Futian District City, Guangdong province 518044 Zhenxing Road, SEG Science Park 2 East Room 403 Patentee before: Tencent Technology (Shenzhen) Co., Ltd. |