CN103634272A - A file scan method, a client device and a server - Google Patents
A file scan method, a client device and a server Download PDFInfo
- Publication number
- CN103634272A CN103634272A CN201210298871.7A CN201210298871A CN103634272A CN 103634272 A CN103634272 A CN 103634272A CN 201210298871 A CN201210298871 A CN 201210298871A CN 103634272 A CN103634272 A CN 103634272A
- Authority
- CN
- China
- Prior art keywords
- client device
- characteristic value
- scanning
- query result
- server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention discloses a file scan method, a client device and a server, and belongs to the field of computer defense. The method comprises the following steps: the client device receives instructions of carrying out assigned scanning; the client device sends a query request to the client device, and the query request carries scan characteristic values of the client device, so that the server returns query results according to the scan characteristic values of the client device, wherein the scan characteristic values comprise characteristic values of scan items and characteristic values of restoration logic; and the client device carries out the assigned scanning according to the query results returned by the server. According to the invention, before the assigned scanning by the client device begins, the query through the server needs to be carried out every time to know whether the present scan item and the restoration logic change, and according to the returned query results, the assigned scanning is carried out; and compared with file scan methods, client devices and servers in the prior art, through interaction with the server, the real-time degree of the assigned scanning and the efficiency of virus defense are improved.
Description
Technical field
The present invention relates to computer defence field, particularly a kind of file scanning method, client device and server.
Background technology
Development along with computer technology, for defend against computer virus infects, current client device is generally applied local scanned items and is repaired logic virus and wooden horse are carried out to killing, scanning with and corresponding reparation logic be to write client device in the issue of virus killing version, the risk that therefore can occur for some when scanning is effectively processed.
Due to the scanned items for viral with repair logic in client device this locality, and be to be solidificated on client device, will cause some limitation like this, after the existing scanned items of client device and reparation strategy are identified, new virus or risk can be walked around the killing of client device very easily, and because the redaction issue of curstomer-oriented end equipment need to have certain time limit, all there is infected risk in client device during this period, the efficiency of virus defense is low, and real-time is poor.
Summary of the invention
In order to solve the problem of prior art, the embodiment of the present invention provides a kind of file scanning method, client device and server.Described technical scheme is as follows:
On the one hand, a kind of file scanning method, described method comprises:
Client device receives the instruction of carrying out invisible scanning;
Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic;
The Query Result that described client device returns according to described server, carries out described invisible scanning.
The Query Result that described client device returns according to described server, carries out described invisible scanning, comprising:
The Query Result returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic;
The Query Result returning when described server is the second Query Result, and described the second Query Result does not carry any scanning characteristic value, and described client device is according to original scanned items and repair logic, carries out described invisible scanning.
The Query Result returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carry out described invisible scanning according to the scanned items of described renewal and reparation logic, comprising:
The Query Result returning when described server is the first Query Result, the scanning characteristic value of the described renewal that described client device carries according to the first Query Result pulls the scanned items of described server update and repairs logic, when the scanned items of client device with repair logic not in use time, described client device is used the scanned items of described renewal and reparation logic replace the scanned items of described this locality and repair logic, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic.
Described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic, also comprises afterwards:
When the scanned items of described client device with repair logic just in use time, after system is restarted, use the scanned items of described renewal and repair logic and replace the scanned items of described this locality and repair logic.
On the other hand, a kind of file scanning method, comprising:
Server receives the inquiry request that client device sends, and described inquiry request is carried the scanning characteristic value of client device;
Described server, according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.
According to the scanning characteristic value of described client device, to described client device, send Query Result, the Query Result that described client device is returned according to described server, carries out described invisible scanning, comprising:
According to the scanning characteristic value of the scanning characteristic value of described client device and server, judge on described server, whether there is the scanning of renewal characteristic value;
When determining the scanning characteristic value that has renewal on described server, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal;
When determining the scanning characteristic value that there is no renewal on described server, to described client device, send the second Query Result, described the second Query Result does not carry any scanning characteristic value.
When determining the scanning characteristic value that has renewal on described server, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal, comprising:
When determining the scanning characteristic value that has renewal on described server, and described server do not reach default while pulling ratio, to described client device, sends the first Query Result, and described the first Query Result carries the scanning characteristic value of described renewal.
Described server, according to the scanning characteristic value of described client device, sends Query Result to described client device, comprises afterwards:
When receiving when request of pulling of described client device, described server is by the scanned items of renewal and repair logic and send to described client device.
Another aspect, a kind of client device, described client device comprises:
Receiver module, for receiving the instruction of carrying out invisible scanning;
Sending module, for sending inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic;
Scan module, for the Query Result returning according to described server, carries out described invisible scanning.
Described client device also comprises: pull module, the Query Result that is used for returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, according to the scanning characteristic value of described renewal, pulls the scanned items of described server update and repairs logic;
Correspondingly, described scan module is specifically for carrying out described invisible scanning according to the scanned items of described renewal and reparation logic;
Described scan module is also the second Query Result for the Query Result returning when described server, and described the second Query Result does not carry any scanning characteristic value, according to original scanned items and reparation logic, carries out described invisible scanning.
The described module that pulls is the first Query Result specifically for the Query Result returning when described server, the scanning characteristic value of the described renewal of carrying according to the first Query Result pulls the scanned items of described server update and repairs logic, when the scanned items of client device with repair logic not in use time, use the scanned items of described renewal and repair logic and replace the scanned items of described this locality and repair logic.
The described module that pulls, also for the scanned items when described client device with repair logic just in use time, is used the scanned items of described renewal and repairs logic and replace the scanned items of described this locality and repair logic after system is restarted.
On the one hand, a kind of server, comprising again:
Receiver module, the inquiry request sending for receiving client device, described inquiry request is carried the scanning characteristic value of client device;
Sending module, for according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.
Described sending module comprises:
Judging unit, for according to the scanning characteristic value of the scanning characteristic value of described client device and server, judges on described server, whether there is the scanning of renewal characteristic value;
Transmitting element, for when determining the scanning characteristic value that has renewal on described server, sends the first Query Result to described client device, and described the first Query Result carries the scanning characteristic value of described renewal;
Described transmitting element, also, for when determining the scanning characteristic value that there is no renewal on described server, sends the second Query Result to described client device, and described the second Query Result does not carry any scanning characteristic value.
Described transmitting element specifically for there being the scanning characteristic value of renewal on definite described server, and described server does not reach to be preset while pulling ratio, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal.
Described sending module is also for when receiving when request of pulling of described client device, by the scanned items of renewal with repair logic and send to described client device.
A kind of file scanning method, client device and server that the embodiment of the present invention provides, receive the instruction of carrying out invisible scanning by client device; Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic; The Query Result that described client device returns according to described server, carries out described invisible scanning.Adopt technical scheme provided by the invention, before client device starts invisible scanning, all need to inquire about to server, to know the current scanned items of server and to repair logic, whether change, and the Query Result returning according to it carries out invisible scanning, compared with prior art, mutual by with server, has improved the real-time of invisible scanning and the efficiency of virus defense.
Accompanying drawing explanation
In order to be illustrated more clearly in the technical scheme in the embodiment of the present invention, below the accompanying drawing of required use during embodiment is described is briefly described, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skills, do not paying under the prerequisite of creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Fig. 1 is the flow chart of a kind of file scanning method of providing of the embodiment of the present invention;
Fig. 2 is the flow chart of a kind of file scanning method of providing of the embodiment of the present invention;
Fig. 3 is the flow chart of a kind of file scanning method of providing of the embodiment of the present invention;
Fig. 4 is the structural representation of a kind of client device of providing of the embodiment of the present invention;
Fig. 5 is the structural representation of a kind of server of providing of the embodiment of the present invention.
Embodiment
For making the object, technical solutions and advantages of the present invention clearer, below in conjunction with accompanying drawing, embodiment of the present invention is described further in detail.
Fig. 1 is the flow chart of a kind of file scanning method of providing of the embodiment of the present invention.The executive agent of this embodiment is client device, and this client device can be fixed terminal or mobile terminal.Referring to Fig. 1, this embodiment comprises:
101, client device receives the instruction of carrying out invisible scanning;
In the present embodiment, invisible scanning refers to rapid scanning, scan full hard disk or scans for the region of certain appointment, wherein, the sweep object of rapid scanning is system file, memory file, the sweep object of scan full hard disk is all disk files, comprise system file, memory file, and the object scanning for the region of appointment is the disk file in the regional extent of this appointment.
102, described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises scanned items and repairs the characteristic value of logic;
Wherein, the scanning characteristic value of client device comprise the current preservation of client device scanned items characteristic value and repair accordingly the characteristic value of logic with scanned items, the corresponding unique characteristic value of each scanned items, each repairs the corresponding unique characteristic value of logic.Scanned items refers to sweep object when client device carries out invisible scanning, as digital Digital signature service, system startup item etc.Repair logic and refer to that for by the restorative procedure of the scanned items of virus infections, different scanned items is corresponding from different reparation logics, does not repeat them here.
Alternatively, the scanning characteristic value of client device can be that the default characteristic value algorithm (as MD5 algorithm) of application generates when client device gets this scanning characteristic value, and be kept on client device, can also be when client device receives the instruction of carrying out invisible scanning, by client device, according to current scanned items and reparation logic, generated, the embodiment of the present invention is to being not specifically limited the opportunity of its generation.
In the present embodiment, when client device receives the instruction of carrying out invisible scanning, to server, send inquiry request, described inquiry request is carried the scanning characteristic value of client device, when server receives the scanning characteristic value of described client device, according to the scanning characteristic value of this client device, to client device, return to Query Result.
103, the Query Result that described client device returns according to described server, carries out described invisible scanning.
According to the different situations of the current scanned items of server and reparation logic, the Query Result that server returns has two kinds of situations: while one, having the scanned items of renewal and scanned items to repair logic accordingly on server, server returns to the first Query Result to client device, this first Query Result carries the scanning characteristic value of renewal, and the scanning characteristic value of this renewal is repaired logic accordingly for representing the scanned items of server update and scanned items.While two, not having the scanned items upgraded and scanned items to repair logic accordingly on server, server returns to the second Query Result to client device, and this second Query Result does not carry any scanning characteristic value.And corresponding to two kinds of situations of above-mentioned Query Result, the different Query Result that client device returns according to server, carries out and the corresponding invisible scanning of Query Result.
A kind of file scanning method that the embodiment of the present invention provides, receives the instruction of carrying out invisible scanning by client device; Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic; The Query Result that described client device returns according to described server, carries out described invisible scanning.Adopt technical scheme provided by the invention, before client device starts invisible scanning, all need to inquire about to server, to know the current scanned items of server and to repair logic, whether change, and the Query Result returning according to it carries out invisible scanning, compared with prior art, mutual by with server, has improved the real-time of invisible scanning and the efficiency of virus defense.
Alternatively, the embodiment based on shown in Fig. 1, step 103 " Query Result that described client device returns according to described server carries out described invisible scanning ", specifically comprises the steps:
(1) Query Result returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic;
In the present embodiment, while having the scanned items of renewal and scanned items to repair logic accordingly on server, server returns to the first Query Result to client device, this first Query Result carries the scanning characteristic value of renewal, the scanning characteristic value of this renewal is repaired logic accordingly for representing the scanned items of server update and scanned items, therefore, when client device receives the first Query Result, know that server has the scanned items of renewal and repairs logic, to server, send the request that pulls, to pull the scanned items of server update from server and to repair logic, and the foundation using the scanned items of upgrading and while repairing logic as invisible scanning, carry out invisible scanning.
(2) Query Result returning when described server is the second Query Result, and described the second Query Result does not carry any scanning characteristic value, and described client device is according to the original scanned items in this locality and repair logic, carries out described invisible scanning.
In the present embodiment, while not having the scanned items upgraded and scanned items to repair logic accordingly on server, server returns to the second Query Result to client device, this second Query Result does not carry any scanning characteristic value, therefore,, when client device receives the second Query Result, know that server does not have the scanned items of upgrading and repairs logic, foundation when original scanned items and reparation logic are as invisible scanning using this locality, carries out invisible scanning.
It should be noted that, the scanned items of the renewal described in the present embodiment and reparation logic can be increment or amended scanned items and repair logic.
A kind of file scanning method that the embodiment of the present invention provides, receives the instruction of carrying out invisible scanning by client device; Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic; The Query Result that described client device returns according to described server, carries out described invisible scanning.Adopt technical scheme provided by the invention, before client device starts invisible scanning, all need to inquire about to server, to know the current scanned items of server and to repair logic, whether change, and the Query Result returning according to it carries out invisible scanning, compared with prior art, mutual by with server, has improved the real-time of invisible scanning and the efficiency of virus defense.Further, the difference of the Query Result returning according to server is carried out invisible scanning on client device, makes client device and to repair logic and to carry out invisible scanning according to up-to-date scanned items.When scanned items and the reparation logic of client are issued, issue after due to the BUG of client device or the certain situation of not considering, cause some scanned items to cause risk to user, such as deleting normal file or causing system cisco unity malfunction, can be by configuring in time the scanned items of renewal and repair logic on server, client device, when the instruction that receives invisible scanning, pulls the scanned items of these renewals and repairs logic and can effectively avoid this risk.Further, when occurring a kind of new virus, and client is not while also having ability completely it to be removed, server can be analyzed the infection sample of this virus, and the scanned items analyzing and reparation logic are put into server, when client device starts invisible scanning, can pull the up-to-date scanned items of server and repair logic, solve the harm that this part new virus causes.
Further alternatively, embodiment based on shown in Fig. 1, " Query Result returning when described server is the first Query Result to above-mentioned steps (1), described client device pulls the scanned items of described server update and repairs logic from described server according to described newly-increased scanning characteristic value, and carry out described invisible scanning according to the scanned items of described renewal and reparation logic ", specifically comprise: the Query Result returning when described server is the first Query Result, the described newly-increased scanning characteristic value that described client device carries according to the first Query Result pulls the scanned items of described server update and repairs logic from described server, when local scanned items with repair logic not in use time, described client device is used the scanned items of described renewal and repairs logic and replace the scanned items of described this locality and repair logic, and carry out described invisible scanning according to the scanned items of described renewal and reparation logic.
In the present embodiment, for fear of the data to client device, impact, when determining the scanned items of client device this locality and repairing logic not in use time, client device is according to the scanned items pulling and repair logic and replace local scanned items and repair logic.
Further alternatively, embodiment based on shown in Fig. 1, " the described newly-increased scanning characteristic value that described client device carries according to the first Query Result pulls the scanned items of described server update and repairs logic from described server " in step (1), also comprise afterwards: when local scanned items with repair logic just in use time, after system is restarted, use the scanned items of described renewal and repair logic and replace the scanned items of described this locality and repair logic.
In the present embodiment, for fear of the data to client device, impact, when determining the scanned items of client device this locality and repairing logic in use time, client device is first according to the scanned items pulling with repair logic and carries out invisible scanning, and just replaces after system is restarted.
Above-mentioned all optional technical schemes can adopt combinable mode arbitrarily in conjunction with the optional embodiment that forms the embodiment of the present invention, at this, illustrate no longer one by one.
Fig. 2 is the flow chart of a kind of file scanning method of providing of the embodiment of the present invention.The executive agent of this embodiment is server, and this server can be a part, individual server or the server cluster of server, and referring to Fig. 2, this embodiment specifically comprises:
201, server receives the inquiry request that client device sends, and described inquiry request is carried the scanning characteristic value of client device;
Complexity due to viral diversity and client device operation, in the scanned items of issue client terminal equipment with while repairing logic, likely can there is the BUG of client device or the certain situation of not considering, cause some scanned items to cause risk to user, such as deleting normal file or causing system cisco unity malfunction, technical staff can be in scanned items and the reparation logic of server end config update, when client device receives the instruction of invisible scanning, to server, send inquiry request, by server, according to inquiry request, judge whether server this locality has the scanned items of renewal and repair logic, so that client device is by pulling the scanned items of renewal and repairing logic, effectively avoid this risk.
202, described server, according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.
Particularly, for this step 202, server, according to the scanning characteristic value receiving and the scanning characteristic value of server, sends corresponding Query Result to client device.
A kind of file scanning method that the embodiment of the present invention provides, receives by server the inquiry request that client device sends, and described inquiry request is carried the scanning characteristic value of client device; Described server, according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.Adopt technical scheme provided by the invention, before client device starts invisible scanning, all need to inquire about to server, to know the current scanned items of server and to repair logic, whether change, and the Query Result returning according to it carries out invisible scanning, compared with prior art, mutual by with server, has improved the real-time of invisible scanning and the efficiency of virus defense.
Alternatively, on basis embodiment illustrated in fig. 2, step 202 " according to the scanning characteristic value of described client device; send Query Result to described client device; the Query Result that described client device is returned according to described server; carry out described invisible scanning ", specifically comprises the steps:
(a), according to the scanning characteristic value of the scanning characteristic value of described client device and server, judge on described server, whether there is the scanning of renewal characteristic value;
Particularly, this deterministic process comprises: judge that whether the scanning characteristic value of client device and the scanning characteristic value of server be all identical, if there is any not identical, on server, have the scanning characteristic value of renewal, if all identical, on server, there is no the scanning characteristic value of upgrading.
It should be noted that, server has increased scanned items and the corresponding logic of repairing newly, or revised scanned items and repaired accordingly logic, or only revised the reparation logic of certain scanned items, all can upgrade the scanning characteristic value of server, and the scanning characteristic value that server can be using the scanning characteristic value of upgrading as server this locality.
(b) when determining the scanning characteristic value that has renewal on described server, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal;
(c) when determining the scanning characteristic value that there is no renewal on described server, to described client device, send the second Query Result, described the second Query Result does not carry any scanning characteristic value.
According to the concrete condition of the scanning characteristic value of the scanning characteristic value of described client device and server, to client feedback Query Result, to will scan the situation of change of characteristic value on server, the real-time client device that sends to.
Further alternatively, on basis embodiment illustrated in fig. 2, step (b) " when determining the scanning characteristic value that has renewal on described server; send the first Query Result to described client device; described the first Query Result carries the scanning characteristic value of described renewal ", specifically comprise: when determining the scanning characteristic value that has renewal on described server, and described server does not reach to be preset while pulling ratio, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal.
Wherein, default pull ratio refer to the threshold value arranging on server, for the scanned items of upgrading and reparation logic, in order to reduce the scanned items of renewal and to repair the risk that logic may cause, need to limit client device, when pull the scanned items of renewal on server, reached the default ratio that pulls with the client device of repairing logic, to the client device of current transmission inquiry request, do not return to the first Query Result, and do not reach default while pulling ratio when described server, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal.
For example, presetting and pulling ratio is 10%, while having the scanning characteristic value of renewal on determining described server, judgement has pulled the scanned items of renewal and whether the client device of reparation logic has reached 10% of registered client equipment, if so, to the client device of current transmission inquiry request, do not return to the first Query Result, if not, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal.
Above-mentioned all optional technical schemes can adopt combinable mode arbitrarily in conjunction with the optional embodiment that forms the embodiment of the present invention, at this, illustrate no longer one by one.
Fig. 3 is the flow chart of a kind of file scanning method of providing of the embodiment of the present invention.This embodiment be take interaction agent and is comprised that client device and server are example, and the embodiment in conjunction with shown in Fig. 1 and Fig. 2, is described the idiographic flow of file scanning method provided by the invention, and referring to Fig. 3, this embodiment comprises:
301, client device receives the instruction of carrying out invisible scanning;
302, described client device sends inquiry request to server, and described inquiry request is carried the scanning characteristic value of client device;
303,, according to the scanning characteristic value of the scanning characteristic value of described client device and server, judge on described server, whether there is the scanning of renewal characteristic value; If so, perform step 304; If not, perform step 306;
304,, when determining the scanning characteristic value that has renewal on described server, judge whether described server reaches default and pull ratio, if so, performs step 306, if not, finishes;
305, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal;
306, when determining the scanning characteristic value that there is no renewal on described server, to described client device, send the second Query Result, described the second Query Result does not carry any scanning characteristic value;
307, the Query Result returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, and described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal;
308, when the scanned items of client device with repair logic not in use time, described client device is used the scanned items of described renewal and repairs logic and replace the scanned items of described this locality and repair logic, and carry out described invisible scanning according to the scanned items of described renewal and reparation logic, finish;
309, the Query Result returning when described server is the second Query Result, and described the second Query Result does not carry any scanning characteristic value, and described client device is according to original scanned items and repair logic, carries out described invisible scanning.
A kind of file scanning method that the embodiment of the present invention provides, receives the instruction of carrying out invisible scanning by client device; Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic; The Query Result that described client device returns according to described server, carries out described invisible scanning.Adopt technical scheme provided by the invention, before client device starts invisible scanning, all need to inquire about to server, to know the current scanned items of server and to repair logic, whether change, and the Query Result returning according to it carries out invisible scanning, compared with prior art, mutual by with server, has improved the real-time of invisible scanning and the efficiency of virus defense.
Fig. 4 is the structural representation of a kind of client device of providing of the embodiment of the present invention.Referring to Fig. 4, described client device comprises:
In the present embodiment, invisible scanning refers to rapid scanning, scan full hard disk or scans for the region of certain appointment, wherein, the sweep object of rapid scanning is system file, memory file, the sweep object of scan full hard disk is all disk files, comprise system file, memory file, and the object scanning for the region of appointment is the disk file in the regional extent of this appointment.
Sending module 20, for sending inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic;
Wherein, the scanning characteristic value of client device comprise the current preservation of client device scanned items characteristic value and repair accordingly the characteristic value of logic with scanned items, the corresponding unique characteristic value of each scanned items, each repairs the corresponding unique characteristic value of logic.Scanned items refers to sweep object when client device carries out invisible scanning, as digital Digital signature service, system startup item etc.Repair logic and refer to that for by the restorative procedure of the scanned items of virus infections, different scanned items is corresponding from different reparation logics, does not repeat them here.
Alternatively, the scanning characteristic value of client device can be that the default characteristic value algorithm (as MD5 algorithm) of application generates when client device gets this scanning characteristic value, and be kept on client device, can also be when client device receives the instruction of carrying out invisible scanning, by client device, according to current scanned items and reparation logic, generated, the embodiment of the present invention is to being not specifically limited the opportunity of its generation.
In the present embodiment, when client device receives the instruction of carrying out invisible scanning, to server, send inquiry request, described inquiry request is carried the scanning characteristic value of client device, when server receives the scanning characteristic value of described client device, according to the scanning characteristic value of this client device, to client device, return to Query Result.
According to the different situations of the current scanned items of server and reparation logic, the Query Result that server returns has two kinds of situations: while one, having the scanned items of renewal and scanned items to repair logic accordingly on server, server returns to the first Query Result to client device, this first Query Result carries the scanning characteristic value of renewal, and the scanning characteristic value of this renewal is repaired logic accordingly for representing the scanned items of server update and scanned items.While two, not having the scanned items upgraded and scanned items to repair logic accordingly on server, server returns to the second Query Result to client device, and this second Query Result does not carry any scanning characteristic value.And corresponding to two kinds of situations of above-mentioned Query Result, the different Query Result that client device returns according to server, carries out and the corresponding invisible scanning of Query Result.
Alternatively, described client device also comprises:
Pull module 40, the Query Result that is used for returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, according to the scanning characteristic value of described renewal, pulls the scanned items of described server update and repairs logic;
Correspondingly, described scan module 30 is specifically for carrying out described invisible scanning according to the scanned items of described renewal and reparation logic;
In the present embodiment, while having the scanned items of renewal and scanned items to repair logic accordingly on server, server returns to the first Query Result to client device, this first Query Result carries the scanning characteristic value of renewal, the scanning characteristic value of this renewal is repaired logic accordingly for representing the scanned items of server update and scanned items, therefore, when client device receives the first Query Result, know that server has the scanned items of renewal and repairs logic, to server, send the request that pulls, to pull the scanned items of server update from server and to repair logic, and the foundation using the scanned items of upgrading and while repairing logic as invisible scanning, carry out invisible scanning.
Described scan module 30 is also the second Query Result for the Query Result returning when described server, and described the second Query Result does not carry any scanning characteristic value, according to original scanned items and reparation logic, carries out described invisible scanning.
In the present embodiment, while not having the scanned items upgraded and scanned items to repair logic accordingly on server, server returns to the second Query Result to client device, this second Query Result does not carry any scanning characteristic value, therefore,, when client device receives the second Query Result, know that server does not have the scanned items of upgrading and repairs logic, foundation when original scanned items and reparation logic are as invisible scanning using this locality, carries out invisible scanning.
It should be noted that, the scanned items of the renewal described in the present embodiment and reparation logic can be increment or amended scanned items and repair logic.
Alternatively, the described module 40 that pulls is the first Query Result specifically for the Query Result returning when described server, the scanning characteristic value of the described renewal of carrying according to the first Query Result pulls the scanned items of described server update and repairs logic, when the scanned items of client device with repair logic not in use time, use the scanned items of described renewal and repair logic and replace the scanned items of described this locality and repair logic.
The described module 40 that pulls, also for the scanned items when described client device with repair logic just in use time, is used the scanned items of described renewal and repairs logic and replace the scanned items of described this locality and repair logic after system is restarted.
The client device that the embodiment of the present invention provides, receives the instruction of carrying out invisible scanning by client device; Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic; The Query Result that described client device returns according to described server, carries out described invisible scanning.Adopt technical scheme provided by the invention, before client device starts invisible scanning, all need to inquire about to server, to know the current scanned items of server and to repair logic, whether change, and the Query Result returning according to it carries out invisible scanning, compared with prior art, mutual by with server, has improved the real-time of invisible scanning and the efficiency of virus defense.
Client device embodiment illustrated in fig. 4, take and comprise that above-mentioned all optional technical schemes describe technical scheme of the present invention as example, in practical application, above-mentioned all optional technical schemes can adopt any combinative mode to form the optional technical scheme of the embodiment of the present invention, at this, give an example no longer one by one.
The client device of the present embodiment, scans by adopting above-mentioned module to realize file, identical with the realization mechanism of above-mentioned correlation technique embodiment, can, with reference to the record of above-mentioned correlation technique embodiment, not repeat them here in detail.
It should be noted that: the client device that above-described embodiment provides is when file scans, only the division with above-mentioned each functional module is illustrated, in practical application, can above-mentioned functions be distributed and by different functional modules, completed as required, the internal structure of the equipment of being about to is divided into different functional modules, to complete all or part of function described above.In addition, the client device that above-described embodiment provides and file scanning method embodiment belong to same design, and its specific implementation process refers to embodiment of the method, repeats no more here.
Fig. 5 is the structural representation of a kind of server of providing of the embodiment of the present invention.Referring to Fig. 5, this server comprises:
Complexity due to viral diversity and client device operation, in the scanned items of issue client terminal equipment with while repairing logic, likely can there is the BUG of client device or the certain situation of not considering, cause some scanned items to cause risk to user, such as deleting normal file or causing system cisco unity malfunction, technical staff can be in scanned items and the reparation logic of server end config update, when client device receives the instruction of invisible scanning, to server, send inquiry request, by server, according to inquiry request, judge whether server this locality has the scanned items of renewal and repair logic, so that client device is by pulling the scanned items of renewal and repairing logic, effectively avoid this risk.
Sending module 52, for according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.
Alternatively, described sending module 52 comprises:
Judging unit, for according to the scanning characteristic value of the scanning characteristic value of described client device and server, judges on described server, whether there is the scanning of renewal characteristic value;
Particularly, this deterministic process comprises: judge that whether the scanning characteristic value of client device and the scanning characteristic value of server be all identical, if there is any not identical, on server, have the scanning characteristic value of renewal, if all identical, on server, there is no the scanning characteristic value of upgrading.
It should be noted that, server has increased scanned items and the corresponding logic of repairing newly, or revised scanned items and repaired accordingly logic, or only revised the reparation logic of certain scanned items, all can upgrade the scanning characteristic value of server, and the scanning characteristic value that server can be using the scanning characteristic value of upgrading as server this locality.
Transmitting element, for when determining the scanning characteristic value that has renewal on described server, sends the first Query Result to described client device, and described the first Query Result carries the scanning characteristic value of described renewal;
According to the concrete condition of the scanning characteristic value of the scanning characteristic value of described client device and server, to client feedback Query Result, to will scan the situation of change of characteristic value on server, the real-time client device that sends to.
Described transmitting element, also, for when determining the scanning characteristic value that there is no renewal on described server, sends the second Query Result to described client device, and described the second Query Result does not carry any scanning characteristic value.
Alternatively, described transmitting element specifically for there being the scanning characteristic value of renewal on definite described server, and described server does not reach to be preset while pulling ratio, to described client device, sends the first Query Result, and described the first Query Result carries the scanning characteristic value of described renewal.
Wherein, default pull ratio refer to the threshold value arranging on server, for the scanned items of upgrading and reparation logic, in order to reduce the scanned items of renewal and to repair the risk that logic may cause, need to limit client device, when pull the scanned items of renewal on server, reached the default ratio that pulls with the client device of repairing logic, to the client device of current transmission inquiry request, do not return to the first Query Result, and do not reach default while pulling ratio when described server, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal.
Alternatively, described sending module 52 is also for when receiving when request of pulling of described client device, by the scanned items of renewal with repair logic and send to described client device.
Server embodiment illustrated in fig. 5, take and comprise that above-mentioned all optional technical schemes describe technical scheme of the present invention as example, in practical application, above-mentioned all optional technical schemes can adopt any combinative mode to form the optional technical scheme of the embodiment of the present invention, at this, give an example no longer one by one.
The server of the present embodiment, scans by adopting above-mentioned module to realize file, identical with the realization mechanism of above-mentioned correlation technique embodiment, can, with reference to the record of above-mentioned correlation technique embodiment, not repeat them here in detail.
It should be noted that: the server that above-described embodiment provides is when file scans, only the division with above-mentioned each functional module is illustrated, in practical application, can above-mentioned functions be distributed and by different functional modules, completed as required, the internal structure of the equipment of being about to is divided into different functional modules, to complete all or part of function described above.In addition, the server that above-described embodiment provides and file scanning method embodiment belong to same design, and its specific implementation process refers to embodiment of the method, repeats no more here.
One of ordinary skill in the art will appreciate that all or part of step that realizes above-described embodiment can complete by hardware, also can come the hardware that instruction is relevant to complete by program, described program can be stored in a kind of computer-readable recording medium, the above-mentioned storage medium of mentioning can be read-only memory, disk or CD etc.
The foregoing is only preferred embodiment of the present invention, in order to limit the present invention, within the spirit and principles in the present invention not all, any modification of doing, be equal to replacement, improvement etc., within all should being included in protection scope of the present invention.
Claims (16)
1. a file scanning method, is characterized in that, described method comprises:
Client device receives the instruction of carrying out invisible scanning;
Described client device sends inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic;
The Query Result that described client device returns according to described server, carries out described invisible scanning.
2. method according to claim 1, is characterized in that, the Query Result that described client device returns according to described server carries out described invisible scanning, comprising:
The Query Result returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic;
The Query Result returning when described server is the second Query Result, and described the second Query Result does not carry any scanning characteristic value, and described client device is according to original scanned items and repair logic, carries out described invisible scanning.
3. method according to claim 2, it is characterized in that, the Query Result returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carry out described invisible scanning according to the scanned items of described renewal and reparation logic, comprising:
The Query Result returning when described server is the first Query Result, the scanning characteristic value of the described renewal that described client device carries according to the first Query Result pulls the scanned items of described server update and repairs logic, when the scanned items of client device with repair logic not in use time, described client device is used the scanned items of described renewal and reparation logic replace the scanned items of described this locality and repair logic, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic.
4. method according to claim 2, it is characterized in that, described client device pulls the scanned items of described server update and repairs logic according to the scanning characteristic value of described renewal, and carries out described invisible scanning according to the scanned items of described renewal and reparation logic, also comprises afterwards:
When the scanned items of described client device with repair logic just in use time, after system is restarted, use the scanned items of described renewal and repair logic and replace the scanned items of described this locality and repair logic.
5. a file scanning method, is characterized in that, comprising:
Server receives the inquiry request that client device sends, and described inquiry request is carried the scanning characteristic value of client device;
Described server, according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.
6. method according to claim 5, is characterized in that, according to the scanning characteristic value of described client device, to described client device, send Query Result, the Query Result that described client device is returned according to described server, carries out described invisible scanning, comprising:
According to the scanning characteristic value of the scanning characteristic value of described client device and server, judge on described server, whether there is the scanning of renewal characteristic value;
When determining the scanning characteristic value that has renewal on described server, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal;
When determining the scanning characteristic value that there is no renewal on described server, to described client device, send the second Query Result, described the second Query Result does not carry any scanning characteristic value.
7. method according to claim 5, is characterized in that, when determining the scanning characteristic value that has renewal on described server, to described client device, sends the first Query Result, and described the first Query Result carries the scanning characteristic value of described renewal, comprising:
When determining the scanning characteristic value that has renewal on described server, and described server do not reach default while pulling ratio, to described client device, sends the first Query Result, and described the first Query Result carries the scanning characteristic value of described renewal.
8. method according to claim 5, is characterized in that, described server, according to the scanning characteristic value of described client device, sends Query Result to described client device, comprises afterwards:
When receiving when request of pulling of described client device, described server is by the scanned items of renewal and repair logic and send to described client device.
9. a client device, is characterized in that, described client device comprises:
Receiver module, for receiving the instruction of carrying out invisible scanning;
Sending module, for sending inquiry request to server, described inquiry request is carried the scanning characteristic value of client device, make described server return to Query Result according to the scanning characteristic value of described client device, described scanning characteristic value comprises the characteristic value of scanned items and repairs the characteristic value of logic;
Scan module, for the Query Result returning according to described server, carries out described invisible scanning.
10. client device according to claim 9, it is characterized in that, described client device also comprises: pull module, the Query Result that is used for returning when described server is the first Query Result, described the first Query Result carries the scanning characteristic value of described server update, according to the scanning characteristic value of described renewal, pulls the scanned items of described server update and repairs logic;
Correspondingly, described scan module is specifically for carrying out described invisible scanning according to the scanned items of described renewal and reparation logic;
Described scan module is also the second Query Result for the Query Result returning when described server, and described the second Query Result does not carry any scanning characteristic value, according to original scanned items and reparation logic, carries out described invisible scanning.
11. client devices according to claim 10, it is characterized in that, the described module that pulls is the first Query Result specifically for the Query Result returning when described server, the scanning characteristic value of the described renewal of carrying according to the first Query Result pulls the scanned items of described server update and repairs logic, when the scanned items of client device with repair logic not in use time, use the scanned items of described renewal and repair logic and replace the scanned items of described this locality and repair logic.
12. client devices according to claim 10, it is characterized in that, the described module that pulls, also for the scanned items when described client device with repair logic just in use time, is used the scanned items of described renewal and repairs logic and replace the scanned items of described this locality and repair logic after system is restarted.
13. 1 kinds of servers, is characterized in that, comprising:
Receiver module, the inquiry request sending for receiving client device, described inquiry request is carried the scanning characteristic value of client device;
Sending module, for according to the scanning characteristic value of described client device, sends Query Result to described client device, and the Query Result that described client device is returned according to described server, carries out described invisible scanning.
14. servers according to claim 13, is characterized in that, described sending module comprises:
Judging unit, for according to the scanning characteristic value of the scanning characteristic value of described client device and server, judges on described server, whether there is the scanning of renewal characteristic value;
Transmitting element, for when determining the scanning characteristic value that has renewal on described server, sends the first Query Result to described client device, and described the first Query Result carries the scanning characteristic value of described renewal;
Described transmitting element, also, for when determining the scanning characteristic value that there is no renewal on described server, sends the second Query Result to described client device, and described the second Query Result does not carry any scanning characteristic value.
15. servers according to claim 13, it is characterized in that, described transmitting element specifically for there being the scanning characteristic value of renewal on definite described server, and described server does not reach to be preset while pulling ratio, to described client device, send the first Query Result, described the first Query Result carries the scanning characteristic value of described renewal.
16. servers according to claim 13, is characterized in that, described sending module is also for when receiving when request of pulling of described client device, by the scanned items of renewal with repair logic and send to described client device.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210298871.7A CN103634272B (en) | 2012-08-21 | 2012-08-21 | File scanning method, client device and server |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210298871.7A CN103634272B (en) | 2012-08-21 | 2012-08-21 | File scanning method, client device and server |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103634272A true CN103634272A (en) | 2014-03-12 |
| CN103634272B CN103634272B (en) | 2018-09-04 |
Family
ID=50214905
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210298871.7A Active CN103634272B (en) | 2012-08-21 | 2012-08-21 | File scanning method, client device and server |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103634272B (en) |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101320413A (en) * | 2007-06-07 | 2008-12-10 | 李武 | Anti-virus device for mobile memory and its anti-virus method |
| CN101414295A (en) * | 2007-10-15 | 2009-04-22 | 北京瑞星国际软件有限公司 | Method for upgrading database |
| CN101763276A (en) * | 2009-10-10 | 2010-06-30 | 北京派瑞根科技开发有限公司 | Method for energizing and starting high-security information system |
| CN101931944A (en) * | 2010-07-23 | 2010-12-29 | 华为终端有限公司 | Method, device and system for updating terminal patches on line |
| CN101945135A (en) * | 2010-09-20 | 2011-01-12 | 中兴通讯股份有限公司 | Method and system for upgrading widget system |
| CN102073815A (en) * | 2010-12-27 | 2011-05-25 | 奇瑞汽车股份有限公司 | Vehicle-mounted antivirus system and antivirus method |
| CN102263773A (en) * | 2010-05-25 | 2011-11-30 | 腾讯科技（深圳）有限公司 | Real-time protection method and apparatus thereof |
-
2012
- 2012-08-21 CN CN201210298871.7A patent/CN103634272B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101320413A (en) * | 2007-06-07 | 2008-12-10 | 李武 | Anti-virus device for mobile memory and its anti-virus method |
| CN101414295A (en) * | 2007-10-15 | 2009-04-22 | 北京瑞星国际软件有限公司 | Method for upgrading database |
| CN101763276A (en) * | 2009-10-10 | 2010-06-30 | 北京派瑞根科技开发有限公司 | Method for energizing and starting high-security information system |
| CN102263773A (en) * | 2010-05-25 | 2011-11-30 | 腾讯科技（深圳）有限公司 | Real-time protection method and apparatus thereof |
| CN101931944A (en) * | 2010-07-23 | 2010-12-29 | 华为终端有限公司 | Method, device and system for updating terminal patches on line |
| CN101945135A (en) * | 2010-09-20 | 2011-01-12 | 中兴通讯股份有限公司 | Method and system for upgrading widget system |
| CN102073815A (en) * | 2010-12-27 | 2011-05-25 | 奇瑞汽车股份有限公司 | Vehicle-mounted antivirus system and antivirus method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103634272B (en) | 2018-09-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102105884B (en) | Streaming malware definition updates | |
| US8495615B2 (en) | Method, system and computer program for distributing software patches | |
| CN102592103B (en) | Secure file processing method, equipment and system | |
| US8321860B2 (en) | Local collector | |
| US8219575B2 (en) | Method and system for specifying, preparing and using parameterized database queries | |
| EP2490370A2 (en) | Method for providing an anti-malware service | |
| US20080307396A1 (en) | Profiler Management | |
| CN104978191A (en) | Application deployment method and server | |
| CN102982284A (en) | Scanning equipment, cloud management equipment and method and system used for malicious program checking and killing | |
| TWI490702B (en) | Method for recovering system file in computer and apparatus thereof | |
| US20080208928A1 (en) | Device Management System and Method for Managing Device Management Object | |
| CN103645914A (en) | Software cleaning method and device | |
| CN102915249A (en) | Method and device for remotely realizing firmware updating | |
| CN103034808A (en) | Scanning method, equipment and system and cloud management method and equipment | |
| CN103955647A (en) | System bug scanning method | |
| CN103973745A (en) | Mobile terminal operating system updating method and device | |
| CN110263001A (en) | File management method, device, system, equipment and computer readable storage medium | |
| CN104144223A (en) | Data obtaining method and device | |
| US9811080B2 (en) | Measuring performance of an appliance | |
| CN104104701A (en) | Online service configuration updating method and system | |
| KR101407630B1 (en) | Distribute file system and method for replacing cache data thereof | |
| CN104850791A (en) | Method and system for processing tasks | |
| CN102413201A (en) | Processing method and equipment for domain name system (DNS) query request | |
| CN103634272A (en) | A file scan method, a client device and a server | |
| CN111901325B (en) | Service extension method and device for honeypot nodes, electronic device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |