CN102760218A - Virus characteristic library sharing method and device based on dynamic link library - Google Patents
Virus characteristic library sharing method and device based on dynamic link library Download PDFInfo
- Publication number
- CN102760218A CN102760218A CN2011104219103A CN201110421910A CN102760218A CN 102760218 A CN102760218 A CN 102760218A CN 2011104219103 A CN2011104219103 A CN 2011104219103A CN 201110421910 A CN201110421910 A CN 201110421910A CN 102760218 A CN102760218 A CN 102760218A
- Authority
- CN
- China
- Prior art keywords
- virus characteristic
- characteristic storehouse
- virus
- dynamic link
- link library
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Stored Programmes (AREA)
Abstract
The invention provides a virus characteristic library sharing method and device based on a dynamic link library. The virus characteristic library sharing method comprises the steps of: compiling a virus characteristic library into a virus characteristic library dynamic linkage library; requesting an anti-virus engine to load the virus characteristic library; loading the virus characteristic library dynamic linkage library corresponding to the virus characteristic library; and obtaining a virus characteristic library address in a memory fed back by an operating system. According to the invention, by using the characteristic that the operating system only remains one dynamic linkage library in the memory, the sharing of the virus characteristic library is realized, the memory is saved; and by using the characteristic of write on copy of the dynamic linkage library, the virus characteristic library is stored in the dynamic linkage library, and when anti-virus software needs loading the virus characteristic library, the virus characteristic library can be obtained by only loading the dynamic linkage library.
Description
Technical field
The present invention relates to the computer network security technology field, relate in particular to a kind of method and device of sharing based on the virus characteristic storehouse of dynamic link library.
Background technology
The anti-viral software of main flow mostly adopts the antivirus techniques based on feature detection now, so the virus characteristic storehouse is absolutely necessary for anti-viral software.All number is in necessarily for viral species and quantity, and all the time all in continuous increase, this causes the virus characteristic storehouse is unusual huge.Under the situation that many scanning engines instance is worked simultaneously, loading many parts of virus characteristic storehouses is unpractical in internal memory.Therefore the virus characteristic storehouse is shared, and it is very necessary that each instance is all shared with a virus characteristic storehouse.
Mostly adopt the memory shared technology and solve virus characteristic storehouse sharing problem at present; The realization more complicated of memory shared technology and time-consuming; And owing to share with a virus characteristic storehouse; In case a copy of it anti-virus engine instance has been revised virus characteristic storehouse content, will cause the virus characteristic storehouse of all anti-virus engines to be modified simultaneously.
Summary of the invention
The invention provides a kind of virus characteristic share method and device based on dynamic link library, the characteristic of utilization dynamic link library has solved committed memory space, shared virus characteristic storehouse and has reached the problem of revising inconvenience greatly.
A kind of viral share method based on dynamic link library comprises:
The virus characteristic storehouse is compiled as virus characteristic storehouse dynamic link library; Described virus characteristic storehouse can be with resource or other any stores in the dynamic link library of virus characteristic storehouse;
The anti-virus engine requests loads the virus characteristic storehouse;
Load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse;
Address, virus characteristic storehouse in the internal memory of acquisition operating system feedback.
In the described method, behind the dynamic link library of described loading virus characteristic storehouse, also comprise:
Operating system judges whether the virus characteristic storehouse dynamic link library of request of loading is to load for the first time; If; Then with deciphering of virus characteristic storehouse dynamic link library and decompress(ion); The virus characteristic storehouse that decompress(ion) is obtained is loaded in the internal memory, and the address in virus characteristic storehouse in the internal memory is fed back to the anti-virus engine; Otherwise directly the address with virus characteristic storehouse in the internal memory feeds back to the anti-virus engine.
In the described method, described the virus characteristic storehouse is compiled as in the dynamic link library of virus characteristic storehouse, described virus characteristic storehouse is at least one.
In the described method, in the virus characteristic storehouse dynamic link library of described loading virus characteristic storehouse correspondence, described dynamic link library is at least 1.
A kind of virus base sharing means based on dynamic link library comprises:
Memory module is used to store the virus characteristic storehouse dynamic link library with the compiling of virus characteristic storehouse;
Request module is used for the anti-virus engine requests and loads the virus characteristic storehouse;
Load-on module is used to load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse;
Acquisition module is used for obtaining the address, virus characteristic storehouse of the internal memory of operating system feedback.
In the described device, also comprise:
Judge module; Be used for operating system and judge whether the virus characteristic storehouse dynamic link library of request of loading is to load for the first time; If; Then with deciphering of virus characteristic storehouse dynamic link library and decompress(ion), the virus characteristic storehouse that decompress(ion) is obtained is loaded in the internal memory, and the address in virus characteristic storehouse in the internal memory is fed back to the anti-virus engine; Otherwise directly the address with virus characteristic storehouse in the internal memory feeds back to the anti-virus engine.
The characteristic that method provided by the invention has used dynamic link library to save internal memory, resource sharing and Copy on write; The virus characteristic storehouse is compiled as dynamic link library, can only takies a internal memory, realize virus characteristic can share; Simultaneously because dynamic link library has the characteristic of Copy on write; Behind an anti-virus engine adapts virus characteristic storehouse, independently create a memory copying page or leaf for this process, make modification not influence of the use of other anti-virus engines to the virus characteristic storehouse.
The present invention provides a kind of virus characteristic share method and device based on dynamic link library, and said method comprises: the virus characteristic storehouse is compiled as virus characteristic storehouse dynamic link library; The anti-virus engine requests loads the virus characteristic storehouse; Load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse; Address, virus characteristic storehouse in the internal memory of acquisition operating system feedback.The present invention uses operating system in internal memory, only to keep a dynamic link library characteristic; Realized sharing of virus characteristic storehouse; Save internal memory, and the characteristic of dynamic link library Copy on write (Write On Copy), the virus characteristic storehouse is stored in the dynamic link library; When anti-viral software need load the virus characteristic storehouse, only need to load dynamic link library and just can obtain the virus characteristic storehouse.
Description of drawings
In order to be illustrated more clearly in the present invention or technical scheme of the prior art; To do to introduce simply to the accompanying drawing of required use in embodiment or the description of the Prior Art below; Obviously, the accompanying drawing in describing below only is some embodiment that put down in writing among the present invention, for those of ordinary skills; Under the prerequisite of not paying creative work, can also obtain other accompanying drawing according to these accompanying drawings.
Fig. 1 is a kind of virus characteristic share method process flow diagram based on dynamic link library;
Fig. 2 is a kind of virus characteristic storehouse sharing means structural representation based on dynamic link library.
Embodiment
In order to make those skilled in the art person understand the technical scheme in the embodiment of the invention better, and make above-mentioned purpose of the present invention, feature and advantage can be more obviously understandable, below in conjunction with accompanying drawing technical scheme among the present invention done further detailed explanation.
The invention provides a kind of virus characteristic share method and device based on dynamic link library, the characteristic of utilization dynamic link library has solved committed memory space, shared virus characteristic storehouse and has reached the problem of revising inconvenience greatly.
A kind of viral share method based on dynamic link library, as shown in Figure 1, comprising:
S101: the virus characteristic storehouse is compiled as virus characteristic storehouse dynamic link library; Described virus characteristic storehouse can be with resource or other any stores in the dynamic link library of virus characteristic storehouse;
S102: the anti-virus engine requests loads the virus characteristic storehouse; Described anti-virus engine can load the virus characteristic storehouse simultaneously for a plurality of;
S103: load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse;
S104: operating system judges whether the virus characteristic storehouse dynamic link library of request of loading is to load for the first time, if then carry out S105, otherwise directly carry out S106;
S105: with deciphering of virus characteristic storehouse dynamic link library and decompress(ion), the virus characteristic storehouse that decompress(ion) is obtained is loaded in the internal memory;
S106: the address in virus characteristic storehouse in the internal memory is fed back to the anti-virus engine;
S107: the address, virus characteristic storehouse in the internal memory of acquisition operating system feedback.
In the described method, described the virus characteristic storehouse is compiled as in the dynamic link library of virus characteristic storehouse, described virus characteristic storehouse is at least one.
In the described method, in the virus characteristic storehouse dynamic link library of described loading virus characteristic storehouse correspondence, described dynamic link library is at least 1.
A kind of virus base sharing means based on dynamic link library, as shown in Figure 2, comprising:
Load-on module 203 is used to load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse;
In the described device, also comprise:
The characteristic that method provided by the invention has used dynamic link library to save internal memory, resource sharing and Copy on write; The virus characteristic storehouse is compiled as dynamic link library, can only takies a internal memory, realize virus characteristic can share; Simultaneously because dynamic link library has the characteristic of Copy on write; Behind an anti-virus engine adapts virus characteristic storehouse, independently create a memory copying page or leaf for this process, make modification not influence of the use of other anti-virus engines to the virus characteristic storehouse.
The present invention provides a kind of virus characteristic share method and device based on dynamic link library, and said method comprises: the virus characteristic storehouse is compiled as virus characteristic storehouse dynamic link library; The anti-virus engine requests loads the virus characteristic storehouse; Load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse; Address, virus characteristic storehouse in the internal memory of acquisition operating system feedback.The present invention uses operating system in internal memory, only to keep a dynamic link library characteristic; Realized sharing of virus characteristic storehouse; Save internal memory, and the characteristic of dynamic link library Copy on write (Write On Copy), the virus characteristic storehouse is stored in the dynamic link library; When anti-viral software need load the virus characteristic storehouse, only need to load dynamic link library and just can obtain the virus characteristic storehouse.
Though described the present invention through embodiment, those of ordinary skills know, the present invention has many distortion and variation and do not break away from spirit of the present invention, hope that appended claim comprises these distortion and variation and do not break away from spirit of the present invention.
Claims (6)
1. the virus characteristic share method based on dynamic link library is characterized in that, comprising:
The virus characteristic storehouse is compiled as virus characteristic storehouse dynamic link library;
The anti-virus engine requests loads the virus characteristic storehouse;
Load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse;
Address, virus characteristic storehouse in the internal memory of acquisition operating system feedback.
2. the method for claim 1 is characterized in that, behind the dynamic link library of described loading virus characteristic storehouse, also comprises:
Operating system judges whether the virus characteristic storehouse dynamic link library of request of loading is to load for the first time; If; Then with deciphering of virus characteristic storehouse dynamic link library and decompress(ion); The virus characteristic storehouse that decompress(ion) is obtained is loaded in the internal memory, and the address in virus characteristic storehouse in the internal memory is fed back to the anti-virus engine; Otherwise directly the address with virus characteristic storehouse in the internal memory feeds back to the anti-virus engine.
3. the method for claim 1 is characterized in that, described the virus characteristic storehouse is compiled as in the dynamic link library of virus characteristic storehouse, and described virus characteristic storehouse is at least one.
4. the method for claim 1 is characterized in that, in the virus characteristic storehouse dynamic link library of described loading virus characteristic storehouse correspondence, described virus characteristic storehouse dynamic link library is at least 1.
5. the virus characteristic storehouse sharing means based on dynamic link library is characterized in that, comprising:
Memory module is used to store the virus characteristic storehouse dynamic link library with the compiling of virus characteristic storehouse;
Request module is used for the anti-virus engine requests and loads the virus characteristic storehouse;
Load-on module is used to load the corresponding virus characteristic storehouse dynamic link library in virus characteristic storehouse;
Acquisition module is used for obtaining the address, virus characteristic storehouse of the internal memory of operating system feedback.
6. device as claimed in claim 5 is characterized in that, also comprises:
Judge module; Be used for operating system and judge whether the virus characteristic storehouse dynamic link library of request of loading is to load for the first time; If; Then with deciphering of virus characteristic storehouse dynamic link library and decompress(ion), the virus characteristic storehouse that decompress(ion) is obtained is loaded in the internal memory, and the address in virus characteristic storehouse in the internal memory is fed back to the anti-virus engine; Otherwise directly the address with virus characteristic storehouse in the internal memory feeds back to the anti-virus engine.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011104219103A CN102760218A (en) | 2011-12-16 | 2011-12-16 | Virus characteristic library sharing method and device based on dynamic link library |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011104219103A CN102760218A (en) | 2011-12-16 | 2011-12-16 | Virus characteristic library sharing method and device based on dynamic link library |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN102760218A true CN102760218A (en) | 2012-10-31 |
Family
ID=47054673
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2011104219103A Pending CN102760218A (en) | 2011-12-16 | 2011-12-16 | Virus characteristic library sharing method and device based on dynamic link library |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102760218A (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101013368A (en) * | 2007-02-02 | 2007-08-08 | 浙江大学 | Performance optimal design method for graph library of embedded system development platform |
| CN101382984A (en) * | 2007-09-05 | 2009-03-11 | 江启煜 | Method for scanning and detecting generalized unknown virus |
| US20100095281A1 (en) * | 2008-10-14 | 2010-04-15 | Riverside Research Institute | Internal Function Debugger |
| CN102243699A (en) * | 2011-06-09 | 2011-11-16 | 深圳市安之天信息技术有限公司 | Malicious code detection method and system |
-
2011
- 2011-12-16 CN CN2011104219103A patent/CN102760218A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101013368A (en) * | 2007-02-02 | 2007-08-08 | 浙江大学 | Performance optimal design method for graph library of embedded system development platform |
| CN101382984A (en) * | 2007-09-05 | 2009-03-11 | 江启煜 | Method for scanning and detecting generalized unknown virus |
| US20100095281A1 (en) * | 2008-10-14 | 2010-04-15 | Riverside Research Institute | Internal Function Debugger |
| CN102243699A (en) * | 2011-06-09 | 2011-11-16 | 深圳市安之天信息技术有限公司 | Malicious code detection method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Yan et al. | Blogel: A block-centric framework for distributed computation on real-world graphs | |
| CN103065074B (en) | A kind of method of carrying out URL control of authority based on fine granularity | |
| RU2010145165A (en) | MANAGING ACCESS TO DOCUMENTS USING FILE LOCK | |
| CN105933376A (en) | Data manipulation method, server and storage system | |
| US9836516B2 (en) | Parallel scanners for log based replication | |
| CN103049533A (en) | Method for quickly loading data into database | |
| RU2008105764A (en) | ARCHIVING DATA IN A VIRTUAL APPLIED ENVIRONMENT | |
| CN104820717A (en) | Massive small file storage and management method and system | |
| CN103517141A (en) | Sectional type data upgrading method based on IP set top box | |
| CN104881466A (en) | Method and device for processing data fragments and deleting garbage files | |
| CN102915344B (en) | SQL (structured query language) statement processing method and device | |
| CN102665231A (en) | Method of automatically generating parameter configuration file for LTE (Long Term Evolution) system | |
| US20200320041A1 (en) | Multitenancy using an overlay file system | |
| CN105573967A (en) | Multi-format file online browsing method and system | |
| CN111045686B (en) | Method for improving decompilation speed of application, intelligent terminal and storage medium | |
| CN104144202A (en) | Hadoop distributed file system access method, system and device | |
| US10558566B2 (en) | Garbage collection of non-pinned objects within heap | |
| CN101882216A (en) | Method, device and electronic equipment for structuring data fingerprint | |
| CN106502757A (en) | A kind of plug-in management method and device | |
| CN104732161A (en) | Information processing method and electronic equipment | |
| CN102760218A (en) | Virus characteristic library sharing method and device based on dynamic link library | |
| CN105550339A (en) | Document online previewing method, apparatus and system | |
| US9626371B2 (en) | Attribute selectable file operation | |
| CN102880689B (en) | Method for exhibiting contents of office files in web application quickly and conveniently | |
| CN104268231A (en) | File access method, device and intelligent file system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C12 | Rejection of a patent application after its publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20121031 |