CN103902904A - Antivirus engine feature code evaluating method and system based on statistics - Google Patents
Antivirus engine feature code evaluating method and system based on statistics Download PDFInfo
- Publication number
- CN103902904A CN103902904A CN201310673841.4A CN201310673841A CN103902904A CN 103902904 A CN103902904 A CN 103902904A CN 201310673841 A CN201310673841 A CN 201310673841A CN 103902904 A CN103902904 A CN 103902904A
- Authority
- CN
- China
- Prior art keywords
- condition code
- desired value
- viral sample
- basic
- herbarium
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000002155 anti-virotic effect Effects 0.000 title claims abstract description 40
- 238000000034 method Methods 0.000 title claims abstract description 21
- 241000700605 Viruses Species 0.000 claims abstract description 69
- 238000000605 extraction Methods 0.000 claims abstract description 6
- 230000003612 virological effect Effects 0.000 claims description 98
- 238000001514 detection method Methods 0.000 claims description 31
- 238000011156 evaluation Methods 0.000 claims description 19
- 230000001143 conditioned effect Effects 0.000 claims description 6
- 239000000284 extract Substances 0.000 claims description 5
- 238000002360 preparation method Methods 0.000 claims description 3
- 238000005516 engineering process Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000004883 computer application Methods 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 208000015181 infectious disease Diseases 0.000 description 1
- 230000035800 maturation Effects 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/561—Virus type analysis
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Virology (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- General Health & Medical Sciences (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Apparatus Associated With Microorganisms And Enzymes (AREA)
- Measuring Or Testing Involving Enzymes Or Micro-Organisms (AREA)
Abstract
The invention discloses an antivirus engine feature code evaluating method and system based on statistics. The method comprises the steps that firstly, needed virus specimens are selected from a virus base to form a basis virus specimen set; feature codes are extracted from the basis virus specimen set, wherein the feature codes belong to the same type or various types; for each type of feature codes, n detecting points are set, wherein the value of each detecting point is ci, the weight corresponding to ci is wi, and ci is the number of detected virus specimens; then, a statistical-thought-based index value computational formula provided in the method is used for working out various index values, and the needed feature codes are selected with the obtained index values as references and according to the specific application scene requirements of antivirus engines. According to the antivirus engine feature code evaluating method and system based on statistics, the solution to virus specimen selection and needed feature code extraction of the antivirus engines is provided.
Description
Technical field
The present invention relates to network security technology field, relate in particular to a kind of Anti-Virus Engine condition code evaluation method and system based on statistics.
Background technology
Along with the development of computer technology and Internet, people are all the more extensive to computer application, and thus, computer virus is also increasing to people's harm.Antivirus techniques is also developed gradually in this trend, and Anti-Virus Engine is exactly a major embodiment of antivirus techniques.Virus base is the viral sample set having been found that, one of major function of tradition Anti-Virus Engine, removes to contrast all programs or the file in machine with the sample in virus base exactly, sees whether meet these samples, virus if meet, otherwise not necessarily viral.
Tradition Anti-Virus Engine is mainly to use static scanning technology based on condition code, and whether checking exists the feature that matches hereof, if coupling, certain virus of just can having judged File Infection.But the Anti-Virus Engine of a maturation, it is very difficult only using a certain condition code (the most in full part HASH), because this is difficult to meet general Anti-Virus Engine and should possesses high coverage rate and guarantee again the demand of high detection speed.Therefore, numerous Anti-Virus Engine manufacturer often all can extract to the sample in virus base separately the condition code of multiclass, with the application scenarios choice for use different.This will face following problem:
How the application scenarios of different characteristic code is evaluated:
Different characteristic code is due to the difference of its extracting position and extraction algorithm, can there is different features and applicable scene, such as the condition code False Rate having is extremely low, but single condition code only can detect little viral sample, the single condition code having can detect a lot of viral samples, but rate of false alarm is equally very high.How different characteristic code is carried out to systematization evaluation, allow Anti-Virus Engine developer select according to the feature of institute's publish engine, the problem solving emphatically with regard to becoming this patent.
How to set up complete condition code appraisement system:
Along with number of samples amount in virus base increases gradually, anti-virus manufacturer is in order to maintain the retrieval high-level efficiency of each publish engine, a capital selection portion is divided the basic herbarium of sample as engine, the conclusion that above-described condition code evaluation method draws can not be the same in different basic herbariums, this just need to set up an individual system, improves basic herbarium and be generated to the whole process of evaluation.
Summary of the invention
For above-mentioned technical matters, the invention provides a kind of Anti-Virus Engine condition code evaluation method and system based on statistics, the method, by the method for quantitative statistics, draws all kinds of desired values of features relevant code, finally selects required condition code by developer according to application scenarios etc.
The present invention adopts with the following method and realizes: a kind of Anti-Virus Engine condition code evaluation method based on statistics, comprising:
From virus base, choose required viral sample and form basic herbarium;
Extract condition code for described basic herbarium, described condition code is a class or multiclass;
For every category feature code, set n check point, each check point value c
i, with c
icorresponding weights are w
i, described n and c
ivalue depending on basic sample set and condition code situation, described w
ivalue be used for adjusting the value proportion of each check point;
Utilize following formula parameter value index:
Described c
ifor the viral sample quantity detecting, described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
what such condition code of serving as reasons detected meet pre-conditioned viral sample quantity is greater than c
itime feature quantity;
With reference to described desired value index, according to the concrete application scenarios requirement of Anti-Virus Engine, choose required condition code.
Wherein, the object that multiple check points are set is to hold more accurately the characteristic of every category feature code, understands its performance under different check points;
Wherein, described w
ivalue be that developer determines according to actual conditions, be more concerned about the performance of described condition code under which check point, for example, if developer is concerned about that such condition code is detecting more than 20 performance under viral sample, by c more
i=20 corresponding weight w
ivalue tune up.
Further, described desired value index is condition code virus sample recall rate, and the size of described desired value index is directly proportional to the viral sample Detection capability of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium; Described
the viral sample quantity that such condition code of serving as reasons detects is greater than c
itime feature quantity; Described desired value is larger, represents that such condition code more tends to detect more viral sample, otherwise, more tend to detect viral sample still less.
Further, described desired value index is the single virus family recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single virus family of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single virus family is greater than c
itime feature quantity; Described desired value is larger, represents that such condition code more tends to detect the viral sample of single virus family, otherwise, more tend to detect the viral sample of multiple virus families.
Further, described desired value index is the single Virus Type recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single Virus Type of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single Virus Type is greater than c
itime feature quantity; Described desired value is larger, represents that such condition code more tends to detect the viral sample of single Virus Type, otherwise, more tend to detect the viral sample of multiple Virus Types.
Further, described desired value index is the single operation platform recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single operation platform of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single operation platform is greater than c
itime feature quantity; Described desired value is larger, represents that such condition code more tends to detect the viral sample of single operation platform, otherwise, more tend to detect the viral sample of multiple operation platforms.
Further, described desired value index is the single file layout recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single file layout of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of single file layout that what such condition code of serving as reasons detected belong to is greater than c
itime feature quantity; Described desired value is larger, represents that such condition code more tends to detect the viral sample of single file layout, otherwise, more tend to detect the viral sample of multiple file layouts.
Known as mentioned above, for common Anti-Virus Engine, generally to select the condition code of high viral sample recall rate and high single virus family recall rate, because such condition code not only can have been used a small amount of condition code detect more virus but also can avoid more wrong report.But for the Anti-Virus Engine of some specific use, need concrete consideration, for example, some anti-virus manufacturer can provide file layout Filter Engine, now should select the condition code of high viral sample recall rate and high single file layout recall rate, more meaningful.
Except above-mentioned several desired values, utilize the thought of this method can provide more desired values that can quantitative statistics, can select for developer, thereby select more effectively virus signature.
The present invention adopts following system to realize: a kind of Anti-Virus Engine condition code evaluation system based on statistics, comprising:
Basis herbarium preparation module, forms basic herbarium for choose required viral sample from virus base;
Condition code extraction module, for extracting condition code for described basic herbarium, described condition code is a class or multiclass;
Statistical computation module, for for every category feature code, sets n check point, each check point value c
i, with c
icorresponding weights are w
i, described n and c
ivalue depending on basic sample set and condition code situation, described w
ivalue be used for adjusting the value proportion of each check point;
Utilize following formula parameter value index:
Described c
ifor the viral sample quantity detecting, described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
what such condition code of serving as reasons detected meet pre-conditioned viral sample quantity is greater than c
itime feature quantity;
Condition code is chosen module, for reference to described desired value index, according to the concrete application scenarios requirement of Anti-Virus Engine, chooses required condition code.
Further, described desired value index is condition code virus sample recall rate, and the size of described desired value index is directly proportional to the viral sample Detection capability of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium; Described
the viral sample quantity that such condition code of serving as reasons detects is greater than c
itime feature quantity.
Further, described desired value index is the single virus family recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single virus family of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single virus family is greater than c
itime feature quantity.
Further, described desired value index is the single Virus Type recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single Virus Type of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single Virus Type is greater than c
itime feature quantity.
Further, described desired value index is the single operation platform recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single operation platform of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single operation platform is greater than c
itime feature quantity.
Further, described desired value index is the single file layout recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single file layout of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of single file layout that what such condition code of serving as reasons detected belong to is greater than c
itime feature quantity.
In sum, the invention provides a kind of Anti-Virus Engine condition code evaluation method and system based on statistics, first, when anti-virus manufacturer each publish engine, all need to from virus base, screen viral sample structure foundation herbarium, the present invention is directed to the basic herbarium at every turn reselecting and carry out condition code extraction, with the situation that adapts to add new condition code and reject some condition code, all carry out statistical computation based on the desired value computing method that provide in invention for every category feature code subsequently, the indices value that utilization obtains, and with reference to concrete application scenarios demand, choose reasonable condition code.
Accompanying drawing explanation
In order to be illustrated more clearly in technical scheme of the present invention, to the accompanying drawing of required use in embodiment be briefly described below, apparently, the accompanying drawing the following describes is only some embodiment that record in the present invention, for those of ordinary skills, do not paying under the prerequisite of creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Fig. 1 is a kind of Anti-Virus Engine condition code evaluation method process flow diagram based on statistics provided by the invention;
Fig. 2 is a kind of Anti-Virus Engine condition code evaluation system structural drawing based on statistics provided by the invention.
Embodiment
The present invention has provided a kind of Anti-Virus Engine condition code evaluation method and system based on statistics, in order to make those skilled in the art person understand better the technical scheme in the embodiment of the present invention, and above-mentioned purpose of the present invention, feature and advantage can be become apparent more, below in conjunction with accompanying drawing, technical scheme in the present invention is described in further detail:
First the present invention provides a kind of Anti-Virus Engine condition code evaluation method based on statistics, as shown in Figure 1, comprising:
S101 chooses required viral sample and forms basic herbarium from virus base;
S102 extracts condition code for described basic herbarium, and described condition code is a class or multiclass;
S103, for every category feature code, sets n check point, each check point value c
i, with c
icorresponding weights are w
i; For example: in the time of n=5, if c
i∈ [1,2,5,10,20], and w
i∈ [1,1,1,1,5]; Represent to have set 5 check points, and relatively pay close attention to the detected representation that check point is 20 o'clock such condition codes (because the weights of 20 o'clock are larger);
Described n and c
ivalue depending on basic sample set and condition code situation, described w
ivalue be used for adjusting the value proportion of each check point;
S104 utilizes following formula parameter value index:
Described c
ifor the viral sample quantity detecting, described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
what such condition code of serving as reasons detected meet pre-conditioned viral sample quantity is greater than c
itime feature quantity;
For example: have a basic herbarium, wherein have 1000 viral samples, certain category feature code has 100 features, N
numberOfAllSignature=100, work as c
i=20 o'clock,
value be exactly the number that the quantity of the viral sample that detects is greater than the feature of 20 o'clock;
S105, with reference to described desired value index, according to the concrete application scenarios requirement of Anti-Virus Engine, chooses required condition code.
Preferably, described desired value index is condition code virus sample recall rate, and the size of described desired value index is directly proportional to the viral sample Detection capability of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium; Described
the viral sample quantity that such condition code of serving as reasons detects is greater than c
itime feature quantity.
Preferably, described desired value index is the single virus family recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single virus family of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single virus family is greater than c
itime feature quantity.
Preferably, described desired value index is the single Virus Type recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single Virus Type of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single Virus Type is greater than c
itime feature quantity.
Preferably, described desired value index is the single operation platform recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single operation platform of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single operation platform is greater than c
itime feature quantity.
Preferably, described desired value index is the single file layout recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single file layout of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of single file layout that what such condition code of serving as reasons detected belong to is greater than c
itime feature quantity.
The present invention also provides a kind of Anti-Virus Engine condition code evaluation system based on statistics, as shown in Figure 2, comprising:
Basis herbarium preparation module 201, forms basic herbarium for choose required viral sample from virus base;
Condition code extraction module 202, for extracting condition code for described basic herbarium, described condition code is a class or multiclass;
Utilize following formula parameter value index:
Described c
ifor the viral sample quantity detecting, described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
what such condition code of serving as reasons detected meet pre-conditioned viral sample quantity is greater than c
itime feature quantity;
Condition code is chosen module 204, for reference to described desired value index, according to the concrete application scenarios requirement of Anti-Virus Engine, chooses required condition code.
Preferably, described desired value index is condition code virus sample recall rate, and the size of described desired value index is directly proportional to the viral sample Detection capability of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium; Described
the viral sample quantity that such condition code of serving as reasons detects is greater than c
itime feature quantity.
Preferably, described desired value index is the single virus family recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single virus family of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single virus family is greater than c
itime feature quantity.
Preferably, described desired value index is the single Virus Type recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single Virus Type of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single Virus Type is greater than c
itime feature quantity.
Preferably, described desired value index is the single operation platform recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single operation platform of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single operation platform is greater than c
itime feature quantity.
Preferably, described desired value index is the single file layout recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single file layout of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of single file layout that what such condition code of serving as reasons detected belong to is greater than c
itime feature quantity.
As mentioned above, the present invention provided a kind of based on statistics Anti-Virus Engine condition code evaluation method and the specific embodiment of system, the difference of itself and classic method is, the mode of choosing of traditional condition code is not also suitable for all situations, and the evaluation method of traditional condition code is not necessarily suited for each different basic herbarium.The given method and system of the present invention have been set up a set of condition code evaluation system based on basic herbarium, for the basic herbarium of each foundation, again extract condition code, and choose multiple check points and the weights based on corresponding check point need to be set, the desired value computing method based on given are calculated indices value.Calculating by these desired values can be evaluated the applicable scene of all kinds of condition codes, is applicable to the issue flow process of each new edition Anti-Virus Engine.
Above embodiment is unrestricted technical scheme of the present invention in order to explanation.Do not depart from any modification or partial replacement of spirit and scope of the invention, all should be encompassed in the middle of claim scope of the present invention.
Claims (12)
1. the Anti-Virus Engine condition code evaluation method based on statistics, is characterized in that, comprising:
From virus base, choose required viral sample and form basic herbarium;
Extract condition code for described basic herbarium, described condition code is a class or multiclass;
For every category feature code, set n check point, each check point value c
i, with c
icorresponding weights are w
i, described n and c
ivalue depending on basic sample set and condition code situation, described w
ivalue be used for adjusting the value proportion of each check point;
Utilize following formula parameter value index:
Described c
ifor the viral sample quantity detecting, described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
what such condition code of serving as reasons detected meet pre-conditioned viral sample quantity is greater than c
itime feature quantity; With reference to described desired value index, according to the concrete application scenarios requirement of Anti-Virus Engine, choose required condition code.
2. the method for claim 1, is characterized in that, described desired value index is condition code virus sample recall rate, and the size of described desired value index is directly proportional to the viral sample Detection capability of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium; Described
the viral sample quantity that such condition code of serving as reasons detects is greater than c
itime feature quantity.
3. the method for claim 1, is characterized in that, described desired value index is the single virus family recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single virus family of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single virus family is greater than c
itime feature quantity.
4. the method for claim 1, is characterized in that, described desired value index is the single Virus Type recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single Virus Type of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single Virus Type is greater than c
itime feature quantity.
5. the method for claim 1, is characterized in that, described desired value index is the single operation platform recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single operation platform of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single operation platform is greater than c
itime feature quantity.
6. the method for claim 1, is characterized in that, described desired value index is the single file layout recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single file layout of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of single file layout that what such condition code of serving as reasons detected belong to is greater than c
itime feature quantity.
7. the Anti-Virus Engine condition code evaluation system based on statistics, is characterized in that, comprising:
Basis herbarium preparation module, forms basic herbarium for choose required viral sample from virus base;
Condition code extraction module, for extracting condition code for described basic herbarium, described condition code is a class or multiclass;
Statistical computation module, for for every category feature code, sets n check point, each check point value c
i, with c
icorresponding weights are w
i, described n and c
ivalue depending on basic sample set and condition code situation, described w
ivalue be used for adjusting the value proportion of each check point;
Utilize following formula parameter value index:
Described c
ifor the viral sample quantity detecting, described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
what such condition code of serving as reasons detected meet pre-conditioned viral sample quantity is greater than c
itime feature quantity; Condition code is chosen module, for reference to described desired value index, according to the concrete application scenarios requirement of Anti-Virus Engine, chooses required condition code.
8. system as claimed in claim 7, is characterized in that, described desired value index is condition code virus sample recall rate, and the size of described desired value index is directly proportional to the viral sample Detection capability of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium; Described
the viral sample quantity that such condition code of serving as reasons detects is greater than c
itime feature quantity.
9. system as claimed in claim 7, is characterized in that, described desired value index is the single virus family recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single virus family of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single virus family is greater than c
itime feature quantity.
10. system as claimed in claim 7, is characterized in that, described desired value index is the single Virus Type recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single Virus Type of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single Virus Type is greater than c
itime feature quantity.
11. systems as claimed in claim 7, is characterized in that, described desired value index is the single operation platform recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single operation platform of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of what such condition code of serving as reasons detected belong to single operation platform is greater than c
itime feature quantity.
12. systems as claimed in claim 7, is characterized in that, described desired value index is the single file layout recall rate of condition code, and the size of described desired value index is directly proportional to the viral sample Detection capability of the single file layout of condition code, wherein, and described N
numberOfAllSignaturefor the feature total quantity of such condition code in basic herbarium, described in
the viral sample quantity of single file layout that what such condition code of serving as reasons detected belong to is greater than c
itime feature quantity.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310673841.4A CN103902904B (en) | 2013-12-11 | 2013-12-11 | A kind of Anti-Virus Engine condition code evaluation methodology based on statistics and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310673841.4A CN103902904B (en) | 2013-12-11 | 2013-12-11 | A kind of Anti-Virus Engine condition code evaluation methodology based on statistics and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103902904A true CN103902904A (en) | 2014-07-02 |
| CN103902904B CN103902904B (en) | 2017-01-04 |
Family
ID=50994216
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310673841.4A Active CN103902904B (en) | 2013-12-11 | 2013-12-11 | A kind of Anti-Virus Engine condition code evaluation methodology based on statistics and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103902904B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108334778A (en) * | 2017-12-20 | 2018-07-27 | 北京金山安全管理系统技术有限公司 | Method for detecting virus, device, storage medium and processor |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102243699A (en) * | 2011-06-09 | 2011-11-16 | 深圳市安之天信息技术有限公司 | Malicious code detection method and system |
| CN103164651A (en) * | 2011-12-15 | 2013-06-19 | 西门子公司 | Device and method for extracting virus file feature code and virus detection system |
| CN103324888A (en) * | 2012-03-19 | 2013-09-25 | 哈尔滨安天科技股份有限公司 | Method and system for automatically extracting virus characteristics based on family samples |
| EP2661049A2 (en) * | 2012-04-30 | 2013-11-06 | Verint Systems Ltd. | System and method for malware detection |
-
2013
- 2013-12-11 CN CN201310673841.4A patent/CN103902904B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102243699A (en) * | 2011-06-09 | 2011-11-16 | 深圳市安之天信息技术有限公司 | Malicious code detection method and system |
| CN103164651A (en) * | 2011-12-15 | 2013-06-19 | 西门子公司 | Device and method for extracting virus file feature code and virus detection system |
| CN103324888A (en) * | 2012-03-19 | 2013-09-25 | 哈尔滨安天科技股份有限公司 | Method and system for automatically extracting virus characteristics based on family samples |
| EP2661049A2 (en) * | 2012-04-30 | 2013-11-06 | Verint Systems Ltd. | System and method for malware detection |
Non-Patent Citations (2)
| Title |
|---|
| 肖新光 等: "网络病毒的宏观性统计方法", 《全国网络语信息安全技术研讨会2005》 * |
| 金庆 等: "反病毒引擎及特征码自动提取算法的研究", 《计算机工程与设计》 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108334778A (en) * | 2017-12-20 | 2018-07-27 | 北京金山安全管理系统技术有限公司 | Method for detecting virus, device, storage medium and processor |
| CN108334778B (en) * | 2017-12-20 | 2021-12-31 | 北京金山安全管理系统技术有限公司 | Virus detection method, device, storage medium and processor |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103902904B (en) | 2017-01-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106709345B (en) | Method, system and equipment for deducing malicious code rules based on deep learning method | |
| CN109933984B (en) | Optimal clustering result screening method and device and electronic equipment | |
| CN108090567B (en) | Fault diagnosis method and device for power communication system | |
| CN103177215B (en) | Based on the computer malware new detecting method of software control stream feature | |
| US9141796B2 (en) | System and method for detecting malware in file based on genetic map of file | |
| KR101246623B1 (en) | Apparatus and method for detecting malicious applications | |
| Shang et al. | Android malware detection method based on naive Bayes and permission correlation algorithm | |
| CN107992751B (en) | Real-time threat detection method based on branch behavior model | |
| CN106991325B (en) | Protection method and device for software bugs | |
| CN107368856B (en) | Malicious software clustering method and device, computer device and readable storage medium | |
| CN109614433A (en) | The recognition methods of data blood relationship, device, equipment and storage medium between operation system | |
| CN104185840A (en) | Prioritization of continuous deployment pipeline tests | |
| CN103207970B (en) | Virus document scan method and device | |
| CN106599688A (en) | Application category-based Android malicious software detection method | |
| CN104866764B (en) | A kind of Android phone malware detection method based on object reference figure | |
| CN110633211A (en) | Multi-interface testing method, device, server and medium | |
| CN111414402A (en) | Log threat analysis rule generation method and device | |
| RU2587429C2 (en) | System and method for evaluation of reliability of categorisation rules | |
| CN102799823A (en) | Virus detection method and system | |
| CN103902909A (en) | Android malicious code detection system and method based on Opcode backtracking | |
| CN110069927A (en) | Malice APK detection method, system, data storage device and detection program | |
| US10296743B2 (en) | Method and device for constructing APK virus signature database and APK virus detection system | |
| CN106301979B (en) | Method and system for detecting abnormal channel | |
| CN111124791A (en) | System testing method and device | |
| CN103971055B (en) | A kind of Android malware detection method based on program slicing technique |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Antivirus engine feature code evaluating method and system based on statistics Effective date of registration: 20170621 Granted publication date: 20170104 Pledgee: Bank of Longjiang, Limited by Share Ltd, Harbin Limin branch Pledgor: Harbin Antiy Technology Co., Ltd. Registration number: 2017110000004 |
|
| PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20190614 Granted publication date: 20170104 Pledgee: Bank of Longjiang, Limited by Share Ltd, Harbin Limin branch Pledgor: Harbin Antiy Technology Co., Ltd. Registration number: 2017110000004 |
|
| CP03 | Change of name, title or address |
Address after: 150028 Building 7, Innovation Plaza, Science and Technology Innovation City, Harbin Hi-tech Industrial Development Zone, Heilongjiang Province (838 Shikun Road) Patentee after: Harbin antiy Technology Group Limited by Share Ltd Address before: 150090 room 506, Hongqi Street, Nangang District, Harbin Development Zone, Heilongjiang, China, 162 Patentee before: Harbin Antiy Technology Co., Ltd. |
|
| CP03 | Change of name, title or address | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Antivirus engine feature code evaluating method and system based on statistics Effective date of registration: 20190828 Granted publication date: 20170104 Pledgee: Bank of Longjiang, Limited by Share Ltd, Harbin Limin branch Pledgor: Harbin antiy Technology Group Limited by Share Ltd Registration number: Y2019230000002 |
|
| PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
| CP01 | Change in the name or title of a patent holder |
Address after: 150028 building 7, innovation and entrepreneurship square, science and technology innovation city, Harbin high tech Industrial Development Zone, Heilongjiang Province (No. 838, Shikun Road) Patentee after: Antan Technology Group Co.,Ltd. Address before: 150028 building 7, innovation and entrepreneurship square, science and technology innovation city, Harbin high tech Industrial Development Zone, Heilongjiang Province (No. 838, Shikun Road) Patentee before: Harbin Antian Science and Technology Group Co.,Ltd. |
|
| CP01 | Change in the name or title of a patent holder | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20211119 Granted publication date: 20170104 Pledgee: Bank of Longjiang Limited by Share Ltd. Harbin Limin branch Pledgor: Harbin Antian Science and Technology Group Co.,Ltd. Registration number: Y2019230000002 |
|
| PC01 | Cancellation of the registration of the contract for pledge of patent right |