CN102982121A - File scanning method and file scanning device and file detecting system - Google Patents
File scanning method and file scanning device and file detecting system Download PDFInfo
- Publication number
- CN102982121A CN102982121A CN2012104512866A CN201210451286A CN102982121A CN 102982121 A CN102982121 A CN 102982121A CN 2012104512866 A CN2012104512866 A CN 2012104512866A CN 201210451286 A CN201210451286 A CN 201210451286A CN 102982121 A CN102982121 A CN 102982121A
- Authority
- CN
- China
- Prior art keywords
- file
- scanned
- attribute information
- information
- scan
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention discloses a file scanning method, a file scanning device and a file detecting system, so that a problem that scanning again needs a long time is solved. The file scanning method comprises the following steps: acquiring current attribute information of a to-be-scanned file; visiting a local cache database, and judging if scanned feature information of the to-be-scanned file exists in the local cache database; if the scanned feature information of the to-be-scanned file exists in the local cache database, then analyzing the scanned feature information to obtain scanned attribute information, and judging if the scanned attribute information is identical to the current attribute information; if the scanned attribute information is identical to the current attribute information, then reading the scanned feature information to serve as current feature information of the to-be-scanned file; and if the scanned attribute information is not identical to the current attribute information, calculating the current feature information of the to-be-scanned file through the current attribute information, and storing the current feature information of the to-be-scanned file on the local cache database to serve as scanned feature information for the next scanning. According to the file scanning method, the file scanning device and the file detecting system, time for acquiring the same file features of the next scanning can be reduced, and the speed of file scanning is improved.
Description
Technical field
The embodiment of the invention relates to the scanning technique field, is specifically related to a kind of file scanning method, file scanning device and file detection system.
Background technology
Along with popularizing of computing machine, thereby service end and user side all need the file in the computing machine is scanned Malwares such as in time finding virus.But when scanning, need a large amount of CPU computing and disk operating, scanning process is very long and affect the speed of system.In the file of these scannings, it all is identical that many files are arranged, such as the installation kit file of the file of Windows, help file, compressed file and a lot of softwares etc.
When in the prior art above-mentioned file with same characteristic features being scanned at present, all files in the meeting first time scan full hard disk computing machine, and all the elements of meeting scanning document, therefore for the file that comprises that content is many, its scanning the time time of expending quite long, the resource that takies is also quite a lot of, thereby causes the time of for the first time scanning very long.And the again scanning after for the first time scanning also needs again to obtain these features, to such an extent as to sweep velocity is still very slow.
Summary of the invention
In view of the above problems, the present invention has been proposed in order to a kind of overcome the problems referred to above or a kind of file scanning method that addresses the above problem at least in part, file scanning device and file detection system and corresponding file detection system are provided.
According to an aspect of the present invention, provide a kind of file scanning method, having comprised:
Obtain the current attribute information of file to be scanned;
Access local cache database is judged the scan feature information that whether has file to be scanned in the local cache database;
If exist, resolve then that scan feature information obtains scan attribute information, and judge whether scan attribute information is consistent with current attribute information;
If consistent, then read scan feature information as the current characteristic information of file to be scanned; If inconsistent, then calculate the current characteristic information of file to be scanned by current attribute information, and deposit the local cache database in as the scan feature information of scanning next time.
In the embodiment of the invention, also comprise: if there is not the scan feature information of file to be scanned in the local cache database, then calculate the current characteristic information of file to be scanned by current attribute information, and deposit the local cache database in as the scan feature information of scanning next time.
In the embodiment of the invention, also comprise: monitor file to be scanned, when file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the local cache database is arranged invalid flag.
In the embodiment of the invention, read before the current characteristic information of scan feature information as file to be scanned, also comprise: whether the scan feature information of judging file to be scanned comprises invalid flag, if do not comprise invalid flag, then read scan feature information as the current characteristic information of file to be scanned; If comprise invalid flag, then calculate the current characteristic information of file to be scanned by current attribute information, and deposit the local cache database in as the scan feature information of scanning next time.
In the embodiment of the invention, the current attribute information that obtains file to be scanned comprises:
Read the path of file to be scanned;
Obtain the current attribute information of file to be scanned according to the path of file to be scanned.
In the embodiment of the invention, access local cache database comprises:
Path according to file to be scanned generates key assignments, and according to key assignments access local cache database; Wherein, the local cache database is take key assignments as access index.
In the embodiment of the invention, the current attribute information of file to be scanned comprises: the last modification time of the size of file, file and the creation-time of file;
The scan feature information of file to be scanned comprises: attribute information and eigenwert, eigenwert calculates by attribute information.
According to a further aspect in the invention, provide a kind of file scanning device, having comprised:
The attribute acquisition module is suitable for obtaining the current attribute information of file to be scanned;
Judge module is suitable for accessing the local cache database, judges the scan feature information that whether has file to be scanned in the local cache database; If exist, resolve then that scan feature information obtains scan attribute information, and judge whether scan attribute information is consistent with current attribute information;
Read module is suitable for when scan attribute information is consistent with current attribute information, reads scan feature information as the current characteristic information of file to be scanned;
Computing module is suitable for calculating the current characteristic information of file to be scanned by current attribute information when scan attribute information and current attribute information are inconsistent, and deposits the local cache database in as the scan feature information of scanning next time.
In the embodiment of the invention, computing module also is suitable for: when not having the scan feature information of file to be scanned in the local cache database, calculate the current characteristic information of file to be scanned by current attribute information, and deposit the local cache database in as the scan feature information of scanning next time.
In the embodiment of the invention, also comprise: monitoring module, be suitable for monitoring file to be scanned, when file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the local cache database is arranged invalid flag.
In the embodiment of the invention, judge module also is suitable for reading before the current characteristic information of scan feature information as file to be scanned, judges whether the scan feature information of file to be scanned comprises invalid flag;
When the scan feature information that read module also is suitable for file to be scanned does not comprise invalid flag, read scan feature information as the current characteristic information of file to be scanned;
When the scan feature information that computing module also is suitable for file to be scanned comprises invalid flag, calculate the current characteristic information of file to be scanned by current attribute information, and deposit the local cache database in as the scan feature information of scanning next time.
In the embodiment of the invention, the attribute acquisition module comprises:
The path reading submodule, the path that is suitable for reading file to be scanned;
The acquisition of information submodule is suitable for obtaining according to the path of file to be scanned the current attribute information of file to be scanned.
In the embodiment of the invention, the current attribute information of file to be scanned comprises: the last modification time of the size of file, file and the creation-time of file;
The scan feature information of file to be scanned comprises: attribute information and eigenwert, eigenwert calculates by attribute information.
According to a further aspect in the invention, provide a kind of file detection system, having comprised:
Main interface module is suitable for package module is initiated the file scan operation, and specifies file to be scanned;
Package module is suitable for calling scan module;
Scan module is suitable for scanning the characteristic information that file to be scanned and calling data storehouse operational module obtain described file to be scanned;
The database manipulation module is suitable for reading the characteristic information of described file to be scanned.
In the embodiment of the invention, also comprise:
Driver module is suitable for monitoring described file to be scanned, makes amendment when operation when described file to be scanned, and the file modification message that will comprise the retouching operation that described file to be scanned carries out is sent to described messenger service module;
The messenger service module is suitable for receiving the file modification message that described driver module sends, and described file modification message is sent to described database manipulation module;
Described database manipulation module also is suitable for receiving the file modification message that described messenger service module sends, and according to described file modification message database file corresponding to this document is arranged invalid flag.
Compared with prior art, the present invention includes following advantage:
At first, the embodiment of the invention is by access local cache database, judge the scan feature information that whether has described file to be scanned in the described local cache database, in the local cache database, there is the scan feature information of file to be scanned and when consistent with current attribute information, directly the scan feature information in the reading cache data storehouse is as the current characteristic information of described file to be scanned, and do not need again to calculate current characteristic information by current attribute information, thereby can reduce the time of obtaining the identical file feature when again scanning, greatly improve the speed of file scanning, saved system resource.
Secondly, even do not have the scan feature information of file to be scanned in the embodiment of the invention local cache database or in the local cache database, have the scan feature information of file to be scanned and when inconsistent with current attribute information, in this scanning, calculate the current characteristic information of described file to be scanned by current attribute information, and deposit described local cache database in as the scan feature information of scanning next time, when like this this document being scanned again, just can directly from cache database, find the characteristic information of this document, the progress that can accelerate again to scan.
At last, the embodiment of the invention is monitored described file to be scanned, when described file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the described local cache database is arranged invalid flag.That is to say, in case retouching operation has occured in file, for example, write operation or attribute are revised, just the scan feature information of the file to be scanned stored in the local cache database arranged an invalid flag, represent this scan feature information lost efficacy, next time is when scanning, need to recomputate by described current attribute information the current characteristic information of described file to be scanned, and deposit described local cache database in as the scan feature information of scanning next time.Avoided file content to change and file big or small identical, and the last modification time of file and the creation-time of file also change in the identical situation, if only judge that scan attribute information is consistent with current attribute information, the scan feature information in the just direct reading cache data storehouse is as the faulty operation of the current characteristic information of described file to be scanned.
Above-mentioned explanation only is the general introduction of technical solution of the present invention, for can clearer understanding technological means of the present invention, and can be implemented according to the content of instructions, and for above and other objects of the present invention, feature and advantage can be become apparent, below especially exemplified by the specific embodiment of the present invention.
Description of drawings
By reading hereinafter detailed description of the preferred embodiment, various other advantage and benefits will become cheer and bright for those of ordinary skills.Accompanying drawing only is used for the purpose of preferred implementation is shown, and does not think limitation of the present invention.And in whole accompanying drawing, represent identical parts with identical reference symbol.In the accompanying drawings:
Fig. 1 shows according to an embodiment of the invention a kind of process flow diagram of file scanning method;
Fig. 2 shows the according to an embodiment of the invention process flow diagram of another kind of file scanning method;
Fig. 3 shows according to an embodiment of the invention a kind of structured flowchart of file scanning device;
Fig. 4 shows the according to an embodiment of the invention structured flowchart of another kind of file scanning device;
Fig. 5 shows a kind of according to an embodiment of the invention structured flowchart of file detection system.
Embodiment
Exemplary embodiment of the present disclosure is described below with reference to accompanying drawings in more detail.Although shown exemplary embodiment of the present disclosure in the accompanying drawing, yet should be appreciated that and to realize the disclosure and the embodiment that should do not set forth limits here with various forms.On the contrary, it is in order to understand the disclosure more thoroughly that these embodiment are provided, and can with the scope of the present disclosure complete convey to those skilled in the art.
The embodiment of the invention can be applied in the scanning engine of wooden horse cloud killing, and this engine can use in conjunction with the relevant product of safety, comprise antivirus software, the utilizing in the server killing related software of Active Defending System Against and other.The embodiment of the invention can be applied to computer system/server, and it can be with numerous other universal or special computingasystem environment or configuration operation.The example that is suitable for well-known computing system, environment and/or the configuration used with computer system/server includes but not limited to: personal computer system, server computer system, thin client, thick client computer, hand-held or laptop devices, system, set-top box, programmable consumer electronics, NetPC Network PC, minicomputer system, large computer system based on microprocessor and comprise the distributed cloud computing technology environment of above-mentioned any system, etc.
Computer system/server can be described under the general linguistic context of the computer system executable instruction (such as program module) of being carried out by computer system.Usually, program module can comprise routine, program, target program, assembly, logic, data structure etc., and they are carried out specific task or realize specific abstract data type.Computer system/server can be implemented in distributed cloud computing environment, and in the distributed cloud computing environment, task is by carrying out by the teleprocessing equipment of communication network link.In distributed cloud computing environment, program module can be positioned on the Local or Remote computing system storage medium that comprises memory device.
Embodiment one:
With reference to Fig. 1, show the process flow diagram of a kind of file scanning method of the embodiment of the invention, present embodiment specifically can may further comprise the steps:
S101 obtains the current attribute information of file to be scanned.
The current attribute information that obtains file to be scanned described in the present embodiment comprises:
Read the path of file to be scanned;
Obtain the current attribute information of file to be scanned according to the path of described file to be scanned.
Particularly, at first can by traversal file directory to be scanned, from described file directory to be scanned, extract the path of file to be scanned; Secondly can find file to be scanned by the path of file to be scanned; Read at last the current attribute information of file to be scanned.The current attribute information of file to be scanned comprises in the present embodiment: the last modification time of the size of file, file and the creation-time of file.
For example, the path of file to be scanned be C: program files msn gamingzone windows rvsezm.exe, according to this path, just can from the C dish, find file rvsezm.exe to be scanned, then read the current attribute information of file to be scanned, the last modification time of the size that specifically comprises file: 41.5KB, file: on August 10th, 2009, the creation-time of 10:11:21 and/or file: on August 17th, 2004,20:00:00.
S102, access local cache database.
Preserve the characteristic information of scanning document in the local cache database, concrete, described characteristic information comprises attribute information and eigenwert, attribute information comprises the size of above-mentioned file, the last modification time of file and the creation-time of file, eigenwert calculates by attribute information, the size by file for example, the last modification time of file and the creation-time of file calculate in full md5-challenge (MD5, message-digest algorithm 5), the eigenwerts such as full text Secure Hash Algorithm (SHA1, Secure HashAlgorithm).
Can generate key assignments according to the path of described file to be scanned in the present embodiment, and according to described key assignments access local cache database; Wherein, described local cache database is take key assignments as access index.
Need to prove that in the file scanning process, obtaining eigenwert is a very important step.Need afterwards to judge according to described eigenwert the level of security of file.
S103 judges the scan feature information that whether has described file to be scanned in the described local cache database.
According to the description among the step S102, preserve the characteristic information of scanning document in the local cache database, the implication of scanning document is carried out overscanning before being in the present embodiment, for file to be scanned, it also might carry out overscanning before this scanning, this document is file to be scanned for this scanning, and this document is scanning document for next time scanning.
In step S103, need to judge the scan feature information that whether has this file to be scanned in the local cache database, if there is the scan feature information of this file to be scanned in the local cache database, illustrate that this document carried out overscanning before this scanning, this time scanning is again scanning, and execution in step S104 resolves described scan feature information and obtains scan attribute information; If there is not the scan feature information of this file to be scanned in the local cache database, illustrate that this file to be scanned did not carry out overscanning before this scanning, this time scanning is for the first time scanning, execution in step S107 calculates the current characteristic information of described file to be scanned by described current attribute information, and deposits described local cache database in as the scan feature information of scanning next time.The characteristic information that the file that scans so for the first time calculates stores cache database into regard to conduct scan feature information and has suffered, and when this document scans again, just can find the scan feature information of this document from cache database.
S104 when having the scan feature information of described file to be scanned in the local cache database, resolves described scan feature information and obtains scan attribute information.
Characteristic information comprises attribute information and eigenwert, resolving in step S104, scan feature information just can obtain scan attribute information, the namely last modification time of the size of file, file and the creation-time of file, these scan attribute information be stored in the cache database.
S105 judges whether described scan attribute information is consistent with described current attribute information, if consistent, execution in step S106, if inconsistent, execution in step S107 then.
The scan attribute information that obtains among the current attribute information of the file to be scanned that obtains among the step S101 and the step S104 is compared, judge above-mentioned current attribute information and whether scan attribute information is consistent, particularly, judge whether size last modification time whether consistent, file the creation-time whether consistent, file of the file that above-mentioned current attribute information and scan attribute information comprise is consistent.Only have the creation-time three of the last modification time of size, file of above-mentioned file and file all consistent, judge that just scan attribute information is consistent with current attribute information, as long as above-mentioned three has one inconsistent, judge that all scan attribute information and current attribute information are inconsistent.
S106 reads described scan feature information as the current characteristic information of described file to be scanned.
For instance: scan A .exe file also obtains in full MD5.
When scanning for the first time, need the complete content that reads A.exe, then calculate the MD5 of A.exe file content, and deposit database in.
When scanning for the second time, if the file size of A.exe, the last modification time of file, document creation time do not change, and write operation do not occur in file, so directly obtained the MD5 value of A.exe from database.
When described scan attribute information is consistent with described current attribute information, directly the scan feature information in the reading cache data storehouse is as the current characteristic information of described file to be scanned, and do not need to re-start by current attribute information again the calculating of eigenwert, saved the time of obtaining eigenwert, thereby saved the required time of file scanning, and then accelerated the speed of file scanning.
S107 calculates the current characteristic information of described file to be scanned by described current attribute information, and deposits described local cache database in as the scan feature information of scanning next time.
When described scan attribute information and described current attribute information are inconsistent, illustrate that this document probably revises, therefore directly the scan feature information in the reading cache data storehouse as the current characteristic information of described file to be scanned, and need to calculate by described current attribute information the current characteristic information of described file to be scanned, and deposit described local cache database in as the scan feature information of scanning next time.
Certainly, if judge the scan feature information that does not have described file to be scanned in the local cache database among the step S103, also need to calculate by described current attribute information the current characteristic information of described file to be scanned, and deposit described local cache database in as the scan feature information of scanning next time.
At first, present embodiment is by access local cache database, judge the scan feature information that whether has described file to be scanned in the described local cache database, in the local cache database, there is the scan feature information of file to be scanned and when consistent with current attribute information, directly the scan feature information in the reading cache data storehouse is as the current characteristic information of described file to be scanned, and do not need again to calculate current characteristic information by current attribute information, thereby can reduce the time of obtaining the identical file feature when again scanning, greatly improved the speed of file scanning, do not need again the full content from the disk file reading, thereby saved the system resources consumption that the repetitive read-write disk file is brought.Secondly, even do not have the scan feature information of file to be scanned in the present embodiment local cache database or in the local cache database, have the scan feature information of file to be scanned and when inconsistent with current attribute information, in this scanning, calculate the current characteristic information of described file to be scanned by current attribute information, and deposit described local cache database in as the scan feature information of scanning next time, when like this this document being scanned again, just can directly from cache database, find the characteristic information of this document, the progress that can accelerate again to scan.
Need to prove, for aforesaid embodiment of the method, for simple description, so it all is expressed as a series of combination of actions, but those skilled in the art should know, the application is not subjected to the restriction of described sequence of movement, because according to the application, some step can adopt other orders or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in the instructions all belongs to preferred embodiment, and related action might not be that the application is necessary.
Embodiment two:
With reference to Fig. 2, show the process flow diagram of a kind of file scanning method of the embodiment of the invention, present embodiment specifically can may further comprise the steps:
S201 obtains the current attribute information of file to be scanned.
In the present embodiment, can by traversal file directory to be scanned, from described file directory to be scanned, extract the path of file to be scanned.Then can find file to be scanned by the path of file to be scanned, then read the current attribute information of file to be scanned.The current attribute information of file to be scanned comprises in the present embodiment: the last modification time of the size of file, file and the creation-time of file.
For example, the path of file to be scanned be C: program files msn gamingzone windows rvsezm.exe, according to this path, just can from the C dish, find file rvsezm.exe to be scanned, then read the current attribute information of file to be scanned, the last modification time of the size that specifically comprises file: 41.5KB, file: on August 10th, 2009, the creation-time of 10:11:21 and/or file: on August 17th, 2004,20:00:00.
S202, access local cache database.
Preserve the characteristic information of scanning document in the local cache data, concrete, described characteristic information comprises attribute information and eigenwert, attribute information comprises the size of above-mentioned file, the last modification time of file and the creation-time of file, eigenwert calculates by attribute information, for example calculate in full MD5, the eigenwerts such as SHA1 by the size of file, the last modification time of file and the creation-time of file.
Can generate key assignments according to the path of described file to be scanned in the present embodiment, and according to described key assignments access local cache database; Wherein, described local cache database is take key assignments as access index.
S203 judges the scan feature information that whether has described file to be scanned in the described local cache database, if exist, and execution in step S204 then, if do not exist, execution in step S208 then.
According to the description among the step S202, preserve the characteristic information of scanning document in the local cache database, the implication of scanning document is carried out overscanning before being in the present embodiment, for file to be scanned, it also might carry out overscanning before this scanning, this document is file to be scanned for this scanning, and this document is scanning document for next time scanning.
In step S203, need to judge the scan feature information that whether has this file to be scanned in the local cache database, if there is the scan feature information of this file to be scanned in the local cache database, illustrate that this document carried out overscanning before this scanning, execution in step S204 resolves described scan feature information and obtains scan attribute information; If there is not the scan feature information of this file to be scanned in the local cache database, illustrate that this file to be scanned did not carry out overscanning before this scanning, execution in step S207 calculates the current characteristic information of described file to be scanned by described current attribute information, and deposits described local cache database in as the scan feature information of scanning next time.The characteristic information that the file that scans so for the first time calculates stores cache database into regard to conduct scan feature information and has suffered, and when this document scans again, just can find the scan feature information of this document from cache database.
S204 resolves described scan feature information and obtains scan attribute information.
Scan feature information comprises attribute information and eigenwert, resolving in step S204, scan feature information just can obtain scan attribute information, the namely last modification time of the size of file, file and the creation-time of file, these scan attribute information be stored in the cache database.
S205 judges whether described scan attribute information is consistent with described current attribute information, if consistent, execution in step S206, if inconsistent, execution in step S208 then.
The scan attribute information that obtains among the current attribute information of the file to be scanned that obtains among the step S201 and the step S204 is compared, judge above-mentioned current attribute information and whether scan attribute information is consistent, particularly, judge whether size last modification time whether consistent, file the creation-time whether consistent, file of the file that above-mentioned current attribute information and scan attribute information comprise is consistent.Only have the creation-time three of the last modification time of size, file of above-mentioned file and file all consistent, judge that just scan attribute information is consistent with current attribute information, as long as above-mentioned three has one inconsistent, judge that all scan attribute information and current attribute information are inconsistent.
S206 judges whether the scan feature information of described file to be scanned comprises invalid flag, if do not comprise invalid flag, and execution in step S207 then, if comprise invalid flag, execution in step S208 then.
Need to prove, even judge among the step S205 that the make peace creation-time of file of the last modification time one of in the same size, the file of the file that scan attribute information and described current attribute information comprise is all consistent, can not determine that file did not carry out modification.Because the creation-time of the last modification time of file and file can be revised, file is big or small identical if file content changes, and the last modification time of file and the creation-time of file also change into identical, will obtain the scan attribute information result consistent with described current attribute information among the step S205, and clearly variation has occured in file content, therefore present embodiment is monitored described file to be scanned, when described file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the described local cache database is arranged invalid flag.That is to say, in case retouching operation has occured in file, for example, write operation or attribute are revised, just the scan feature information of the file to be scanned stored in the local cache database arranged an invalid flag, represent this scan feature information lost efficacy, next time is when scanning, need execution in step S208, recomputate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
S207 reads described scan feature information as the current characteristic information of described file to be scanned.
When described scan attribute information consistent with described current attribute information, and when the scan feature information of file to be scanned does not comprise invalid flag, directly the scan feature information in the reading cache data storehouse is as the current characteristic information of described file to be scanned, and do not need to re-start by current attribute information again the calculating of eigenwert, saved the time of obtaining eigenwert, wherein the content description information such as file characteristic value only accounts for the very little part of whole file, when user side scanning document content description information part, the spent time is far smaller than the time of the whole file of scanning, thereby saved the required time of file scanning, and then accelerated the speed of file scanning.
S208 calculates the current characteristic information of described file to be scanned by described current attribute information, and deposits described local cache database in as the scan feature information of scanning next time.
When described scan attribute information and described current attribute information inconsistent, when perhaps the scan feature information of file to be scanned comprises invalid flag, illustrate that this document has carried out retouching operation, therefore directly the scan feature information in the reading cache data storehouse as the current characteristic information of described file to be scanned, and need to calculate by described current attribute information the current characteristic information of described file to be scanned, and deposit described local cache database in as the scan feature information of scanning next time.
Certainly, if judge the scan feature information that does not have described file to be scanned in the local cache database among the step S203, also need to calculate by described current attribute information the current characteristic information of described file to be scanned, and deposit described local cache database in as the scan feature information of scanning next time.
Need to prove, even judge among the step S205 that the make peace creation-time of file of the last modification time one of in the same size, the file of the file that scan attribute information and described current attribute information comprise is all consistent, can not determine that file did not carry out modification.Because the creation-time of the last modification time of file and file can be revised, file is big or small identical if file content changes, and the last modification time of file and the creation-time of file also change into identical, will obtain the scan attribute information result consistent with described current attribute information among the step S205, and clearly variation has occured in file content.
Therefore on the basis of embodiment one, the described file to be scanned of present embodiment two monitoring when described file to be scanned is made amendment operation, arranges invalid flag to the scan feature information of file to be scanned in the described local cache database.That is to say, in case retouching operation has occured in file, for example, write operation or attribute are revised, just the scan feature information of the file to be scanned stored in the local cache database arranged an invalid flag, represent this scan feature information lost efficacy, next time is when scanning, need execution in step S208 to recomputate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.Avoided file content to change and file big or small identical, and the last modification time of file and the creation-time of file also change in the identical situation, if only judge that scan attribute information is consistent with current attribute information, the scan feature information in the just direct reading cache data storehouse is as the faulty operation of the current characteristic information of described file to be scanned.
Need to prove, for aforesaid embodiment of the method, for simple description, so it all is expressed as a series of combination of actions, but those skilled in the art should know, the application is not subjected to the restriction of described sequence of movement, because according to the application, some step can adopt other orders or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in the instructions all belongs to preferred embodiment, and related action might not be that the application is necessary.
Embodiment three:
With reference to Fig. 3, show the structured flowchart of a kind of file scanning device of the embodiment of the invention, present embodiment specifically can comprise with lower module:
Attribute acquisition module 301 is suitable for obtaining the current attribute information of file to be scanned.
Above-mentioned attribute acquisition module 301 comprises in the present embodiment:
The path reading submodule, the path that is suitable for reading file to be scanned;
The acquisition of information submodule is suitable for obtaining according to the path of described file to be scanned the current attribute information of file to be scanned.
Particularly, the path reading submodule can be by traversal file directory to be scanned, from described file directory to be scanned, extract the path of file to be scanned, then the acquisition of information submodule can find file to be scanned by the path of file to be scanned, then reads the current attribute information of file to be scanned.The current attribute information of file to be scanned comprises in the present embodiment: the last modification time of the size of file, file and the creation-time of file.
For example, the path of the file to be scanned that the path reading submodule is obtained be C: program files msngaming zone windows rvsezm.exe, the acquisition of information submodule is according to this path, just can from the C dish, find file rvsezm.exe to be scanned, then read the current attribute information of file to be scanned, the last modification time of the size that specifically comprises file: 41.5KB, file: on August 10th, 2009, the creation-time of 10:11:21 and/or file: on August 17th, 2004,20:00:00.
Judge module 302 is suitable for accessing the local cache database, judges the scan feature information that whether has described file to be scanned in the described local cache database; If exist, then resolve described scan feature information and obtain scan attribute information, and judge whether described scan attribute information is consistent with described current attribute information.
Preserve the characteristic information of scanning document in the local cache data, concrete, described characteristic information comprises attribute information and eigenwert, attribute information comprises the size of above-mentioned file, the last modification time of file and the creation-time of file, eigenwert calculates by attribute information, for example calculate in full MD5, the eigenwerts such as SHA1 by the size of file, the last modification time of file and the creation-time of file.
The implication of scanning document is carried out overscanning before being in the present embodiment, for file to be scanned, it also might carry out overscanning before this scanning, this document is file to be scanned for this scanning, and this document is scanning document for next time scanning.
Judge module 302 needs to judge the scan feature information that whether has this file to be scanned in the local cache database, if there is the scan feature information of this file to be scanned in the local cache database, illustrate that this document carried out overscanning before this scanning, therefore resolving described scan feature information obtains scan attribute information, and judges whether described scan attribute information is consistent with described current attribute information; If consistent, then enter read module 303, if inconsistent, then enter computing module 304.
The scan feature information of file to be scanned comprises in the present embodiment: attribute information and eigenwert, described eigenwert calculates by described attribute information.Judge module 302 resolves that scan feature information just can obtain scan attribute information, namely can obtain the size of file, the last modification time of file and the creation-time of file, these scan attribute information be stored in the cache database.
Judge module 302 is compared the current attribute information of the file to be scanned that attribute acquisition module 301 obtains with the scan attribute information that access local cache database obtains, judge above-mentioned current attribute information and whether scan attribute information is consistent, particularly, judge whether size last modification time whether consistent, file the creation-time whether consistent, file of the file that above-mentioned current attribute information and scan attribute information comprise is consistent.Only have the creation-time three of the last modification time of size, file of above-mentioned file and file all consistent, judge that just scan attribute information is consistent with current attribute information, as long as above-mentioned three has one inconsistent, judge that all scan attribute information and current attribute information are inconsistent.
Read module 303 is suitable for when described scan attribute information is consistent with described current attribute information, reads described scan feature information as the current characteristic information of described file to be scanned.
Read module 303 is when described scan attribute information is consistent with described current attribute information, directly the scan feature information in the reading cache data storehouse is as the current characteristic information of described file to be scanned, and do not need to re-start by current attribute information again the calculating of eigenwert, saved the time of obtaining eigenwert, thereby saved the required time of file scanning, and then accelerated the speed of file scanning.
Computing module 304, be suitable for when described scan attribute information and described current attribute information are inconsistent, calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
When described scan attribute information and described current attribute information are inconsistent, illustrate that this document probably revises, therefore directly the scan feature information in the reading cache data storehouse as the current characteristic information of described file to be scanned, and need to calculate the current characteristic information of described file to be scanned by computing module 304, and deposit described local cache database in as the scan feature information of scanning next time.The characteristic information that the file that scans so for the first time calculates stores cache database into regard to conduct scan feature information and has suffered, when scanning again after this document carries out, just can from cache database, find the scan feature information of this document.
In a preferred embodiment of present embodiment, above-mentioned computing module 304 also is suitable for when not having the scan feature information of described file to be scanned in the described local cache database, calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
Certainly, if judge module 302 is judged the scan feature information that does not have described file to be scanned in the local cache database, also need to calculate the current characteristic information of described file to be scanned by computing module 304, and deposit described local cache database in as the scan feature information of scanning next time.
For device embodiment because itself and embodiment of the method basic simlarity, so describe fairly simple, relevant part gets final product referring to the part explanation of Fig. 1 embodiment of the method.
Embodiment four:
With reference to Fig. 4, show the structured flowchart of the another kind of file scanning device of the embodiment of the invention, present embodiment specifically can comprise with lower module:
Attribute acquisition module 401 is suitable for obtaining the current attribute information of file to be scanned.
Above-mentioned attribute acquisition module 401 comprises in the present embodiment:
The path reading submodule, the path that is suitable for reading file to be scanned;
The acquisition of information submodule is suitable for obtaining according to the path of described file to be scanned the current attribute information of file to be scanned.
Particularly, the path reading submodule can be by traversal file directory to be scanned, from described file directory to be scanned, extract the path of file to be scanned, then the acquisition of information submodule can find file to be scanned by the path of file to be scanned, then reads the current attribute information of file to be scanned.The current attribute information of file to be scanned comprises in the present embodiment: the last modification time of the size of file, file and the creation-time of file.
For example, the path of the file to be scanned that the path reading submodule is obtained be C: program files msngaming zone windows rvsezm.exe, the acquisition of information submodule is according to this path, just can from the C dish, find file rvsezm.exe to be scanned, then read the current attribute information of file to be scanned, the last modification time of the size that specifically comprises file: 41.5KB, file: on August 10th, 2009, the creation-time of 10:11:21 and/or file: on August 17th, 2004,20:00:00.
Judge module 402 is suitable for accessing the local cache database, judges the scan feature information that whether has described file to be scanned in the described local cache database; If exist, then resolve described scan feature information and obtain scan attribute information, and judge whether described scan attribute information is consistent with described current attribute information.
Preserve the characteristic information of scanning document in the local cache data, concrete, described characteristic information comprises attribute information and eigenwert, attribute information comprises the size of above-mentioned file, the last modification time of file and the creation-time of file, eigenwert calculates by attribute information, for example calculate in full MD5, the eigenwerts such as SHA1 by the size of file, the last modification time of file and the creation-time of file.
Above-mentioned judge module 402 is accessed the local cache database by following submodule: key assignments generates submodule, is suitable for generating key assignments according to the path of described file to be scanned;
Key assignments access submodule is suitable for according to described key assignments access local cache database;
Wherein, described local cache database is take key assignments as access index.
The implication of scanning document is carried out overscanning before being in the present embodiment, for file to be scanned, it also might carry out overscanning before this scanning, this document is file to be scanned for this scanning, and this document is scanning document for next time scanning.
Judge module 402 needs to judge the scan feature information that whether has this file to be scanned in the local cache database, if there is the scan feature information of this file to be scanned in the local cache database, illustrate that this document carried out overscanning before this scanning, therefore resolving described scan feature information obtains scan attribute information, and judges whether described scan attribute information is consistent with described current attribute information; If consistent, then enter read module 403, if inconsistent, then enter computing module 404.If certainly there is not the scan feature information of this file to be scanned in the local cache database, illustrate that this file to be scanned did not carry out overscanning before this scanning, also enter computing module 404 and calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.The characteristic information that the file that scans so for the first time calculates stores cache database into regard to conduct scan feature information and has suffered, and when this document scans again, just can find the scan feature information of this document from cache database.
The scan feature information of file to be scanned comprises in the present embodiment: attribute information and eigenwert, described eigenwert calculates by described attribute information.Judge module 402 resolves that scan feature information just can obtain scan attribute information, the namely last modification time of the size of file, file and the creation-time of file, these scan attribute information be stored in the cache database.
Judge module 402 is compared the current attribute information of the file to be scanned that attribute acquisition module 401 obtains with the scan attribute information that access local cache database obtains, judge above-mentioned current attribute information and whether scan attribute information is consistent, particularly, judge whether size last modification time whether consistent, file the creation-time whether consistent, file of the file that above-mentioned current attribute information and scan attribute information comprise is consistent.Only have the creation-time three of the last modification time of size, file of above-mentioned file and file all consistent, judge that just scan attribute information is consistent with current attribute information, as long as above-mentioned three has one inconsistent, judge that all scan attribute information and current attribute information are inconsistent.
Need to prove, the make peace creation-time of file is all consistent even judge module 402 is judged the last modification time one of in the same size, the file of the file that scan attribute information and described current attribute information comprise, and can not determine that file did not carry out modification.Because the creation-time of the last modification time of file and file can be revised, file is big or small identical if file content changes, and the last modification time of file and the creation-time of file also change into identical, will obtain the scan attribute information result consistent with described current attribute information in the judge module 402, and clearly variation has occured in file content.
Therefore the described device of present embodiment also comprises:
Monitoring module 405 is suitable for monitoring described file to be scanned, when described file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the described local cache database is arranged invalid flag.
Monitoring module is monitored described file to be scanned, when described file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the described local cache database is arranged invalid flag.That is to say, in case retouching operation has occured in file, for example, write operation or attribute are revised, just the scan feature information of the file to be scanned stored in the local cache database arranged an invalid flag, represent this scan feature information lost efficacy, next time is when scanning, need to enter computing module 404, recomputate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
Accordingly, described judge module 402 also is suitable for reading before the current characteristic information of scan feature information as described file to be scanned, judges whether the scan feature information of described file to be scanned comprises invalid flag.
Read module 403 when the scan feature information that also is suitable for described file to be scanned does not comprise invalid flag, reads described scan feature information as the current characteristic information of described file to be scanned.
When described judge module 402 judges that scan attribute information is consistent with described current attribute information, and when the scan feature information of file to be scanned does not comprise invalid flag, directly the scan feature information in the reading cache data storehouse is as the current characteristic information of described file to be scanned, and do not need to re-start by current attribute information again the calculating of eigenwert, saved the time of obtaining eigenwert, thereby saved the required time of file scanning, and then accelerated the speed of file scanning.
Computing module 404, when the scan feature information that also is suitable for described file to be scanned comprises invalid flag, calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
When described scan attribute information and described current attribute information inconsistent, when perhaps the scan feature information of file to be scanned comprises invalid flag, illustrate that this document has carried out retouching operation, therefore directly the scan feature information in the reading cache data storehouse as the current characteristic information of described file to be scanned, and need to calculate by described current attribute information the current characteristic information of described file to be scanned, and deposit described local cache database in as the scan feature information of scanning next time.The characteristic information that the file that scans so for the first time calculates stores cache database into regard to conduct scan feature information and has suffered, when scanning again after this document carries out, just can from cache database, find the scan feature information of this document.
Certainly, if judge module 402 is judged the scan feature information that does not have described file to be scanned in the local cache database, also need to calculate the current characteristic information of described file to be scanned by computing module 404, and deposit described local cache database in as the scan feature information of scanning next time.
For device embodiment because itself and embodiment of the method basic simlarity, so describe fairly simple, relevant part gets final product referring to the part explanation of Fig. 2 embodiment of the method.
Embodiment five:
With reference to Fig. 5, show the structured flowchart of a kind of file detection system of the embodiment of the invention, present embodiment specifically can comprise with lower module:
Main interface module 501 is suitable for package module is initiated the file scan operation, and specifies file to be scanned;
The file to be scanned of main interface module 501 appointments can be a file in the present embodiment, also can be a plurality of files.
Package module 502 is suitable for calling scan module;
Scan module 503 is suitable for scanning the characteristic information that file to be scanned and calling data storehouse operational module obtain described file to be scanned;
Scan module 503 can calling data storehouse operational module 504 in the present embodiment, and database manipulation module 504 is obtained the characteristic information of described file to be scanned.
Database manipulation module 504 is suitable for reading the characteristic information of described file to be scanned.
In a preferred embodiment of present embodiment, described file detection system also comprises:
Driver module 505 is suitable for monitoring described file to be scanned, makes amendment when operation when described file to be scanned, and the file modification message that will comprise the retouching operation that described file to be scanned carries out is sent to described messenger service module;
Messenger service module 506 is suitable for receiving the file modification message that described driver module sends, and described file modification message is sent to described database manipulation module;
During specific implementation, messenger service module 506 can be called driving calling module (Fig. 5 is not shown) and come calling driver module 505 to obtain file modification message.
Described database manipulation module 504 also is suitable for receiving the file modification message that described messenger service module sends, and according to described file modification message database file corresponding to this document is arranged invalid flag.
When described database manipulation module 504 after corresponding database file arranges invalid flag to this document according to described file modification message, scan module 503 can't successfully obtain the characteristic information of described file to be scanned, because this moment, the characteristic information of file to be scanned lost efficacy, need to recomputate characteristic information, can be referring to the associated description of device embodiment shown in Figure 4.
For system embodiment, because itself and device embodiment basic simlarity, so description is fairly simple, relevant part gets final product referring to the part explanation of Fig. 4 device embodiment.
Each embodiment in this instructions all adopts the mode of going forward one by one to describe, and what each embodiment stressed is and the difference of other embodiment that identical similar part is mutually referring to getting final product between each embodiment.
What those skilled in the art were easy to expect is: it all is feasible that the combination in any of above-mentioned each embodiment is used, so the combination in any between above-mentioned each embodiment all is the application's embodiment, but this instructions has not just described in detail one by one at this as space is limited.
Intrinsic not relevant with any certain computer, virtual system or miscellaneous equipment with demonstration at this algorithm that provides.Various general-purpose systems also can be with using based on the teaching at this.According to top description, it is apparent constructing the desired structure of this type systematic.In addition, the present invention is not also for any certain programmed language.Should be understood that and to utilize various programming languages to realize content of the present invention described here, and the top description that language-specific is done is in order to disclose preferred forms of the present invention.
In the instructions that provides herein, a large amount of details have been described.Yet, can understand, embodiments of the invention can be put into practice in the situation of these details not having.In some instances, be not shown specifically known method, structure and technology, so that not fuzzy understanding of this description.
Similarly, be to be understood that, in order to simplify the disclosure and to help to understand one or more in each inventive aspect, in the description to exemplary embodiment of the present invention, each feature of the present invention is grouped together in single embodiment, figure or the description to it sometimes in the above.Yet the method for the disclosure should be construed to the following intention of reflection: namely the present invention for required protection requires the more feature of feature clearly put down in writing than institute in each claim.Or rather, as following claims reflected, inventive aspect was to be less than all features of the disclosed single embodiment in front.Therefore, follow claims of embodiment and incorporate clearly thus this embodiment into, wherein each claim itself is as independent embodiment of the present invention.
Those skilled in the art are appreciated that and can adaptively change and they are arranged in one or more equipment different from this embodiment the module in the equipment among the embodiment.Can be combined into a module or unit or assembly to the module among the embodiment or unit or assembly, and can be divided into a plurality of submodules or subelement or sub-component to them in addition.In such feature and/or process or unit at least some are mutually repelling, and can adopt any combination to disclosed all features in this instructions (comprising claim, summary and the accompanying drawing followed) and so all processes or the unit of disclosed any method or equipment make up.Unless in addition clearly statement, disclosed each feature can be by providing identical, being equal to or the alternative features of similar purpose replaces in this instructions (comprising claim, summary and the accompanying drawing followed).
In addition, those skilled in the art can understand, although embodiment more described herein comprise some feature rather than further feature included among other embodiment, the combination of the feature of different embodiment means and is within the scope of the present invention and forms different embodiment.For example, in the following claims, the one of any of embodiment required for protection can be used with array mode arbitrarily.
All parts embodiment of the present invention can realize with hardware, perhaps realizes with the software module of moving at one or more processor, and perhaps the combination with them realizes.It will be understood by those of skill in the art that and to use in practice microprocessor or digital signal processor (DSP) to realize according to some or all some or repertoire of parts in the file scanning device of the embodiment of the invention.The present invention can also be embodied as be used to part or all equipment or the device program (for example, computer program and computer program) of carrying out method as described herein.Such realization program of the present invention can be stored on the computer-readable medium, perhaps can have the form of one or more signal.Such signal can be downloaded from internet website and obtain, and perhaps provides at carrier signal, perhaps provides with any other form.
It should be noted above-described embodiment the present invention will be described rather than limit the invention, and those skilled in the art can design alternative embodiment in the situation of the scope that does not break away from claims.In the claims, any reference symbol between bracket should be configured to limitations on claims.Word " comprises " not to be got rid of existence and is not listed in element or step in the claim.Being positioned at word " " before the element or " one " does not get rid of and has a plurality of such elements.The present invention can realize by means of the hardware that includes some different elements and by means of the computing machine of suitably programming.In having enumerated the unit claim of some devices, several in these devices can be to come imbody by same hardware branch.The use of word first, second and C grade does not represent any order.Can be title with these word explanations.
Claims (15)
1. file scanning method comprises:
Obtain the current attribute information of file to be scanned;
Access local cache database is judged the scan feature information that whether has described file to be scanned in the described local cache database;
If exist, then resolve described scan feature information and obtain scan attribute information, and judge whether described scan attribute information is consistent with described current attribute information;
If consistent, then read described scan feature information as the current characteristic information of described file to be scanned; If inconsistent, then calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
2. method according to claim 1 also comprises:
If there is not the scan feature information of described file to be scanned in the described local cache database, then calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
3. method according to claim 1 also comprises:
Monitor described file to be scanned, when described file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the described local cache database is arranged invalid flag.
4. method according to claim 3, described reading before the current characteristic information of scan feature information as described file to be scanned also comprises:
Whether the scan feature information of judging described file to be scanned comprises invalid flag, if do not comprise invalid flag, then reads described scan feature information as the current characteristic information of described file to be scanned; If comprise invalid flag, then calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
5. method according to claim 1, the described current attribute information that obtains file to be scanned comprises: the path of reading file to be scanned;
Obtain the current attribute information of file to be scanned according to the path of described file to be scanned.
6. method according to claim 5, described access local cache database comprises:
Path according to described file to be scanned generates key assignments, and according to described key assignments access local cache database; Wherein, described local cache database is take key assignments as access index.
7. method according to claim 1,
The current attribute information of described file to be scanned comprises: the last modification time of the size of file, file and the creation-time of file;
The scan feature information of described file to be scanned comprises: attribute information and eigenwert, described eigenwert calculates by described attribute information.
8. file scanning device comprises:
The attribute acquisition module is suitable for obtaining the current attribute information of file to be scanned;
Judge module is suitable for accessing the local cache database, judges the scan feature information that whether has described file to be scanned in the described local cache database; If exist, then resolve described scan feature information and obtain scan attribute information, and judge whether described scan attribute information is consistent with described current attribute information;
Read module is suitable for when described scan attribute information is consistent with described current attribute information, reads described scan feature information as the current characteristic information of described file to be scanned;
Computing module, be suitable for when described scan attribute information and described current attribute information are inconsistent, calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
9. device according to claim 8, described computing module also is suitable for: when not having the scan feature information of described file to be scanned in the described local cache database, calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
10. device according to claim 8 also comprises:
Monitoring module is suitable for monitoring described file to be scanned, when described file to be scanned is made amendment when operation, the scan feature information of file to be scanned in the described local cache database is arranged invalid flag.
11. device according to claim 10, described judge module also are suitable for reading before the current characteristic information of scan feature information as described file to be scanned, judge whether the scan feature information of described file to be scanned comprises invalid flag;
When the scan feature information that described read module also is suitable for described file to be scanned does not comprise invalid flag, read described scan feature information as the current characteristic information of described file to be scanned;
When the scan feature information that described computing module also is suitable for described file to be scanned comprises invalid flag, calculate the current characteristic information of described file to be scanned by described current attribute information, and deposit described local cache database in as the scan feature information of scanning next time.
12. device according to claim 8, described attribute acquisition module comprises:
The path reading submodule, the path that is suitable for reading file to be scanned;
The acquisition of information submodule is suitable for obtaining according to the path of described file to be scanned the current attribute information of file to be scanned.
13. device according to claim 8,
The current attribute information of described file to be scanned comprises: the last modification time of the size of file, file and the creation-time of file;
The scan feature information of described file to be scanned comprises: attribute information and eigenwert, described eigenwert calculates by described attribute information.
14. a file detection system comprises:
Main interface module is suitable for package module is initiated the file scan operation, and specifies file to be scanned;
Package module is suitable for calling scan module;
Scan module is suitable for scanning the characteristic information that file to be scanned and calling data storehouse operational module obtain described file to be scanned;
The database manipulation module is suitable for reading the characteristic information of described file to be scanned.
15. system according to claim 14 also comprises:
Driver module is suitable for monitoring described file to be scanned, makes amendment when operation when described file to be scanned, and the file modification message that will comprise the retouching operation that described file to be scanned carries out is sent to described messenger service module;
The messenger service module is suitable for receiving the file modification message that described driver module sends, and described file modification message is sent to described database manipulation module;
Described database manipulation module also is suitable for receiving the file modification message that described messenger service module sends, and according to described file modification message database file corresponding to this document is arranged invalid flag.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210451286.6A CN102982121B (en) | 2012-11-12 | 2012-11-12 | A kind of file scanning method, file scanning device and file detection system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210451286.6A CN102982121B (en) | 2012-11-12 | 2012-11-12 | A kind of file scanning method, file scanning device and file detection system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102982121A true CN102982121A (en) | 2013-03-20 |
| CN102982121B CN102982121B (en) | 2015-11-11 |
Family
ID=47856139
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210451286.6A Active CN102982121B (en) | 2012-11-12 | 2012-11-12 | A kind of file scanning method, file scanning device and file detection system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102982121B (en) |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103607433A (en) * | 2013-11-01 | 2014-02-26 | 北京奇虎科技有限公司 | Method of deploying files in batches on terminal and apparatus thereof |
| CN104133881A (en) * | 2014-07-25 | 2014-11-05 | 广东睿江科技有限公司 | Method and device for adjusting file cache time |
| CN104427401A (en) * | 2013-08-30 | 2015-03-18 | 联想(北京)有限公司 | Method for acquiring data and electronic equipment |
| CN104933021A (en) * | 2014-03-21 | 2015-09-23 | 北大方正集团有限公司 | Prepress checking and version transmitting method and apparatus |
| WO2016029441A1 (en) * | 2014-08-25 | 2016-03-03 | 百度在线网络技术（北京）有限公司 | File scanning method and apparatus |
| CN105447035A (en) * | 2014-08-29 | 2016-03-30 | 华为技术有限公司 | Data scanning method and apparatus |
| CN106909845A (en) * | 2015-12-23 | 2017-06-30 | 北京奇虎科技有限公司 | A kind of method and apparatus of program object scanning |
| CN107451152A (en) * | 2016-05-31 | 2017-12-08 | 阿里巴巴集团控股有限公司 | Computing device, data buffer storage and the method and device of lookup |
| CN108717516A (en) * | 2018-05-18 | 2018-10-30 | 云易天成（北京）安全科技开发有限公司 | File label method, terminal and medium |
| CN109145602A (en) * | 2018-07-06 | 2019-01-04 | 成都亚信网络安全产业技术研究院有限公司 | A kind of means of defence and device for extorting software attacks |
| CN109325347A (en) * | 2018-08-27 | 2019-02-12 | 杭州安恒信息技术股份有限公司 | A kind of checking and killing method, system, device and the readable storage medium storing program for executing of jumping characteristic virus |
| CN109522315A (en) * | 2018-10-26 | 2019-03-26 | 苏宁易购集团股份有限公司 | A kind of data base processing method and system |
| CN110413589A (en) * | 2019-07-30 | 2019-11-05 | 中国联合网络通信集团有限公司 | Approaches to IM and platform based on interspace file system |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101639880A (en) * | 2008-07-31 | 2010-02-03 | 华为技术有限公司 | File test method and device |
| CN102750463A (en) * | 2011-12-16 | 2012-10-24 | 北京安天电子设备有限公司 | System and method for improving file rescanning speed |
-
2012
- 2012-11-12 CN CN201210451286.6A patent/CN102982121B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101639880A (en) * | 2008-07-31 | 2010-02-03 | 华为技术有限公司 | File test method and device |
| CN102750463A (en) * | 2011-12-16 | 2012-10-24 | 北京安天电子设备有限公司 | System and method for improving file rescanning speed |
Cited By (23)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104427401A (en) * | 2013-08-30 | 2015-03-18 | 联想(北京)有限公司 | Method for acquiring data and electronic equipment |
| CN104427401B (en) * | 2013-08-30 | 2018-07-06 | 联想(北京)有限公司 | Obtain the method and electronic equipment of data |
| CN103607433B (en) * | 2013-11-01 | 2018-05-04 | 北京奇安信科技有限公司 | A kind of method and device in terminal deployment file in batches |
| CN103607433A (en) * | 2013-11-01 | 2014-02-26 | 北京奇虎科技有限公司 | Method of deploying files in batches on terminal and apparatus thereof |
| CN104933021A (en) * | 2014-03-21 | 2015-09-23 | 北大方正集团有限公司 | Prepress checking and version transmitting method and apparatus |
| CN104133881A (en) * | 2014-07-25 | 2014-11-05 | 广东睿江科技有限公司 | Method and device for adjusting file cache time |
| CN104133881B (en) * | 2014-07-25 | 2018-04-27 | 广东睿江云计算股份有限公司 | A kind of method and apparatus for adjusting the file cache time |
| WO2016029441A1 (en) * | 2014-08-25 | 2016-03-03 | 百度在线网络技术（北京）有限公司 | File scanning method and apparatus |
| US10049113B2 (en) | 2014-08-25 | 2018-08-14 | Baidu Online Network Technology (Beijing) Co., Ltd. | File scanning method and apparatus |
| CN105447035A (en) * | 2014-08-29 | 2016-03-30 | 华为技术有限公司 | Data scanning method and apparatus |
| CN105447035B (en) * | 2014-08-29 | 2018-12-25 | 华为技术有限公司 | data scanning method and device |
| CN106909845A (en) * | 2015-12-23 | 2017-06-30 | 北京奇虎科技有限公司 | A kind of method and apparatus of program object scanning |
| CN107451152A (en) * | 2016-05-31 | 2017-12-08 | 阿里巴巴集团控股有限公司 | Computing device, data buffer storage and the method and device of lookup |
| CN107451152B (en) * | 2016-05-31 | 2021-06-11 | 阿里巴巴集团控股有限公司 | Computing device, data caching and searching method and device |
| CN108717516B (en) * | 2018-05-18 | 2020-06-12 | 云易天成（北京）安全科技开发有限公司 | File labeling method, terminal and medium |
| CN108717516A (en) * | 2018-05-18 | 2018-10-30 | 云易天成（北京）安全科技开发有限公司 | File label method, terminal and medium |
| CN109145602B (en) * | 2018-07-06 | 2020-06-02 | 成都亚信网络安全产业技术研究院有限公司 | Lesso software attack protection method and device |
| CN109145602A (en) * | 2018-07-06 | 2019-01-04 | 成都亚信网络安全产业技术研究院有限公司 | A kind of means of defence and device for extorting software attacks |
| CN109325347A (en) * | 2018-08-27 | 2019-02-12 | 杭州安恒信息技术股份有限公司 | A kind of checking and killing method, system, device and the readable storage medium storing program for executing of jumping characteristic virus |
| CN109325347B (en) * | 2018-08-27 | 2020-11-03 | 杭州安恒信息技术股份有限公司 | Method, system and device for searching and killing jump virus and readable storage medium |
| CN109522315A (en) * | 2018-10-26 | 2019-03-26 | 苏宁易购集团股份有限公司 | A kind of data base processing method and system |
| CN109522315B (en) * | 2018-10-26 | 2021-10-22 | 苏宁易购集团股份有限公司 | Database processing method and system |
| CN110413589A (en) * | 2019-07-30 | 2019-11-05 | 中国联合网络通信集团有限公司 | Approaches to IM and platform based on interspace file system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102982121B (en) | 2015-11-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102982121A (en) | File scanning method and file scanning device and file detecting system | |
| US9948670B2 (en) | Cloud security-based file processing by generating feedback message based on signature information and file features | |
| US9953162B2 (en) | Rapid malware inspection of mobile applications | |
| US20180082061A1 (en) | Scanning device, cloud management device, method and system for checking and killing malicious programs | |
| CN103390130B (en) | Based on the method for the rogue program killing of cloud security, device and server | |
| CN102982284B (en) | For the scanning device of rogue program killing, cloud management equipment and method and system | |
| CN103646082A (en) | Method and device for checking files | |
| CN103020520A (en) | Enterprise-based document security detection method and system | |
| CN103034808B (en) | Scan method, equipment and system and cloud management and equipment | |
| CN103077353A (en) | Method and device for actively defending rogue program | |
| CN103279707B (en) | A kind of for the method for Initiative Defense rogue program, equipment | |
| CN103632100A (en) | Method and device for detecting website bugs | |
| CN103207970A (en) | Virus file scanning method and device | |
| CN103001947A (en) | Program processing method and program processing system | |
| CN104901975A (en) | Web log safety analyzing method, device and gateway | |
| EP3844927A1 (en) | Increasing security of network resources utilizing virtual honeypots | |
| CN102867147A (en) | File scanning method and device | |
| CN103617390A (en) | Malicious webpage judgment method, device and system | |
| CN103679027A (en) | Searching and killing method and device for kernel level malware | |
| CN102982281A (en) | Program condition detecting method and system | |
| CN103136477B (en) | The scan method of paper sample and system | |
| CN102999722A (en) | File detecting system | |
| CN105095077A (en) | Automated testing method and device for user interfaces | |
| CN103049697A (en) | File detection method and system for enterprises | |
| CN103473350A (en) | File processing method and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220713 Address after: Room 801, 8th floor, No. 104, floors 1-19, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Qizhi software (Beijing) Co.,Ltd. |