CN104700030B - A kind of viral data search method, device and server - Google Patents

A kind of viral data search method, device and server Download PDF

Info

Publication number
CN104700030B
CN104700030B CN201310648844.2A CN201310648844A CN104700030B CN 104700030 B CN104700030 B CN 104700030B CN 201310648844 A CN201310648844 A CN 201310648844A CN 104700030 B CN104700030 B CN 104700030B
Authority
CN
China
Prior art keywords
data
characteristic information
viral
data sample
sample
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201310648844.2A
Other languages
Chinese (zh)
Other versions
CN104700030A (en
Inventor
管胜
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to CN201310648844.2A priority Critical patent/CN104700030B/en
Publication of CN104700030A publication Critical patent/CN104700030A/en
Application granted granted Critical
Publication of CN104700030B publication Critical patent/CN104700030B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The embodiment of the present invention provides a kind of viral data search method, device and server, and wherein method includes:Extract the characteristic information of the data sample in Sample Storehouse;Establish the corresponding relation of each characteristic information and corresponding data sample extracted;Using distributed search engine by each characteristic information, it is compared with preset viral data characteristic information;When the characteristic information that is extracted matches with the viral data characteristic information, the data sample corresponding to the characteristic information that matches with the viral data characteristic information is determined by the corresponding relation, identified data sample is defined as viral data.The embodiment of the present invention realizes the lookup of quick viral data.

Description

A kind of viral data search method, device and server
Technical field
The present invention relates to viral data technique field, more specifically to a kind of viral data search method, device and Server.
Background technology
In viral data analysis and killing field, the lookup of viral data is a very important link, correctly disease Analysis and kill of the lookup of malicious data for viral data have great importance;The lookup of viral data refers to from magnanimity Viral data are found in data sample.
The lookup of viral data is carried out usually using the mode of database at present, virus is carried out by the way of database The mode of the lookup of data is mainly:Tables of data is created, the different types of information of data sample is created in tables of data accordingly Field;While in order to accelerate to search, it is also necessary to database index is created for each field, if the content of field is larger(Than Such as character string information), then creating the data insertion speed after index will be relatively slow, so that the lookup speed of viral data also subtracts Slowly.
The present inventor is studying and found in practice process, and prior art at least has following technical problem: The existing mode that viral data search is carried out using database, for the data sample with larger content spaces field, its viral number According to lookup speed it is slower, the search efficiency of viral data is relatively low;Therefore it is badly in need of providing a kind of new viral data search method, To improve the lookup speed of viral data.
The content of the invention
In view of this, the embodiment of the present invention provides a kind of viral data search method, device and server, existing to solve Present in viral data search mode for the data sample with larger content spaces field, the lookup speed of its viral data compared with The problem of slow.
To achieve the above object, the embodiment of the present invention provides following technical scheme:
A kind of viral data search method, including:
Extract the characteristic information of the data sample in Sample Storehouse;
Establish the corresponding relation of each characteristic information and corresponding data sample extracted;
Using distributed search engine by each characteristic information, it is compared with preset viral data characteristic information;
When the characteristic information extracted matches with the viral data characteristic information, determined by the corresponding relation The data sample corresponding to characteristic information to match with the viral data characteristic information, identified data sample is determined For viral data.
A kind of viral data search device, including:
Characteristic information extracting module, for extracting the characteristic information of the data sample in Sample Storehouse;
Corresponding relation building module, for establishing the corresponding relation of each characteristic information extracted and corresponding data sample;
Comparing module, for by each characteristic information, being believed using distributed search engine with preset viral data characteristics Breath is compared;
Viral data determining module, for matching in the characteristic information extracted and the viral data characteristic information When, the data sample corresponding to the characteristic information that matches with the viral data characteristic information is determined by the corresponding relation This, is defined as viral data by identified data sample.
A kind of server, including viral data search device described above.
Based on above-mentioned technical proposal, viral data search method provided in an embodiment of the present invention, by establishing what is extracted The corresponding relation of each characteristic information and corresponding data sample, in the characteristic information extracted and the viral data characteristic information phase During matching, you can pass through established corresponding relation, determine the characteristic information to match with the viral data characteristic information Corresponding all data samples, so as to realize the lookup of quick viral data;Even for larger content spaces field Characteristic information, the embodiment of the present invention also can determine the number corresponding to this feature information by the comparison of a characteristic information Whether it is viral data according to sample, so as to improve the lookup speed of viral data.
Brief description of the drawings
In order to illustrate more clearly about the embodiment of the present invention or technical scheme of the prior art, below will be to embodiment or existing There is the required accompanying drawing used in technology description to be briefly described, it should be apparent that, drawings in the following description are the present invention Some embodiments, for those of ordinary skill in the art, on the premise of not paying creative work, can also basis These accompanying drawings obtain other accompanying drawings.
Fig. 1 is a kind of flow chart of viral data search method provided in an embodiment of the present invention;
Fig. 2 is another flow chart of viral data search method provided in an embodiment of the present invention;
Fig. 3 is the structured flowchart of viral data search device provided in an embodiment of the present invention;
Fig. 4 is the structured flowchart of corresponding relation building module provided in an embodiment of the present invention;
Fig. 5 is the structured flowchart of viral data determining module provided in an embodiment of the present invention;
Fig. 6 is the structured flowchart of characteristic information extracting module provided in an embodiment of the present invention;
Fig. 7 is another structured flowchart of viral data search device provided in an embodiment of the present invention;
Fig. 8 is the hardware structure diagram of server provided in an embodiment of the present invention.
Embodiment
To make the purpose, technical scheme and advantage of the embodiment of the present invention clearer, below in conjunction with the embodiment of the present invention In accompanying drawing, the technical scheme in the embodiment of the present invention is clearly and completely described, it is clear that described embodiment is Part of the embodiment of the present invention, rather than whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art The every other embodiment obtained under the premise of creative work is not made, belongs to the scope of protection of the invention.
Fig. 1 is a kind of flow chart of viral data search method provided in an embodiment of the present invention, and reference picture 1, this method can With including:
Step S100, the characteristic information of the data sample in Sample Storehouse is extracted;
The data sample stored in Sample Storehouse is pending data sample, which includes normal data sample and The data sample of malice(Viral data), the purpose of the present invention is to find out viral number from numerous data samples of Sample Storehouse According to;
Characteristic information can be the feature that may be used as between data sample mutually distinguishing;Optionally, the spy of data sample Reference breath can include:Essential information, resource information and program code information;Wherein, essential information can be such as data sample pair The software name answered, version number, size of data, certificate, signature etc.;Resource information program can use corresponding to data sample The resource file arrived;Program code information can correspond to the constant character string of program, attribute, code tree etc. such as data sample;
Optionally, the embodiment of the present invention can be disassembled to the executable program file of each data sample, so as to obtain Essential information and resource information corresponding to each data sample, the program code information of each data sample can also be carried out anti- Compiling, so as to obtain the program code information corresponding to each data sample.
Step S200, the corresponding relation of each characteristic information and corresponding data sample extracted is established;
The embodiment of the present invention can establish the corresponding relation of each characteristic information and corresponding data sample extracted, due to each Characteristic information that data sample is extracted may it is identical may also be different, therefore the data sample with identical characteristic information it Between, it can be associated by identical characteristic information;
Optionally, the embodiment of the present invention can establish each characteristic information and corresponding data by way of establishing inverted index The corresponding relation of sample, inverted index are also referred to as reverse indexing, available for being stored in each feature for being extracted under full-text search The mapping of storage location of the information in corresponding data sample(A mapping table is established, to represent each characteristic information institute Corresponding data sample);By inverted index, the data sample of this characteristic information can be included according to characteristic information quick obtaining This.
Step S300, each characteristic information is entered with preset viral data characteristic information using distributed search engine Row compares;
Preset viral data characteristic information is the key feature of viral data, has the data of viral data characteristic information It may be considered viral data;
Optionally, Lucene can be used(For full-text search and the library of increasing income searched)Distributed search engine will be each Individual characteristic information, it is compared with viral data characteristic information.
Step S400, when the characteristic information extracted matches with the viral data characteristic information, by described right The data sample corresponding to the characteristic information for determining to match with the viral data characteristic information should be related to, by identified number It is defined as viral data according to sample.
Optionally, the embodiment of the present invention can determine the spy to match with the viral data characteristic information by inverted index The corresponding data sample of reference breath;Specifically, the embodiment of the present invention is during inverted index is established, can be by all samples All characteristic informations be added in mapping table, the characteristic information in mapping table and preset viral data characteristic information can be passed through It is compared, so that it is determined that going out the characteristic information to match in mapping table with viral data characteristic information, so as to pass through mapping table All data samples corresponding to the quick characteristic information for determining to match with viral data characteristic information, these are determined Data sample be viral data.
Viral data search method provided in an embodiment of the present invention, by establishing each characteristic information extracted and corresponding number According to the corresponding relation of sample, when the characteristic information extracted matches with the viral data characteristic information, you can pass through institute The corresponding relation of foundation, determine all data samples corresponding to the characteristic information that matches with the viral data characteristic information This, so as to realize the lookup of quick viral data;Even for the characteristic information with larger content spaces field, the present invention is implemented Example also can determine whether with the data sample corresponding to this feature information be viral number by the comparison of a characteristic information According to so as to improve the lookup speed of viral data.
Fig. 2 is another flow chart of viral data search method provided in an embodiment of the present invention, with reference to shown in Fig. 1 and Fig. 2, Method shown in Fig. 2 on the basis of method shown in Fig. 1, in addition to:
Step S500, when the characteristic information extracted mismatches with the viral data characteristic information, by described right The data sample determined with corresponding to the viral unmatched characteristic information of data characteristic information should be related to, by identified number It is defined as non-viral data according to sample.
Optionally, the embodiment of the present invention can determine the feature being unworthy of with the viral data characteristic information by inverted index Data sample corresponding to information;Specifically, the embodiment of the present invention is during inverted index is established, can be by all samples All characteristic informations are added in mapping table, can be entered by the characteristic information in mapping table and preset viral data characteristic information Row compare, so that it is determined that go out in mapping table with the unmatched characteristic information of viral data characteristic information, so as to by mapping table it is fast All data samples determined corresponding to the unmatched characteristic information of viral data characteristic information of speed, what these were determined Data sample is non-viral data.
To verify the superiority of viral data search method provided in an embodiment of the present invention, now entered existing using database The mode of the viral data search of row, using search engine by the way of viral data search enter with provided in an embodiment of the present invention Row compares, and following table, which embodies specific performance test result, can carry out reference.
Comparative run Prior art The present invention
Sample number(Ten thousand) 700 700
Use number of devices(Platform) 16 8
Time/time More than 20 minutes Less than 1 second
Real-time Do not support Support
Features Management It is inconvenient It is convenient
Viral data search device provided in an embodiment of the present invention is introduced below, viral data described below are looked into Look for device corresponding with above-described viral data search method, both can be cross-referenced.
Fig. 3 is the structured flowchart of viral data search device provided in an embodiment of the present invention, and reference picture 3, the device can be with Including:
Characteristic information extracting module 100, for extracting the characteristic information of the data sample in Sample Storehouse;
Corresponding relation building module 200, for establishing each characteristic information pass corresponding with corresponding data sample extracted System;
Comparing module 300, for using distributed search engine by each characteristic information, with preset viral data characteristics Information is compared;
Viral data determining module 400, in the characteristic information extracted and the viral data characteristic information phase Timing, the data sample corresponding to characteristic information to be matched by corresponding relation determination with the viral data characteristic information This, is defined as viral data by identified data sample.
Optionally, Fig. 4 shows a kind of alternative construction of corresponding relation building module 200, and reference picture 4, corresponding relation is built Formwork erection block 200 can include:
Inverted index establishes unit 210, and for establishing inverted index, the inverted index is used to store each spy extracted The mapping of storage location of the reference breath in corresponding data sample.
Corresponding, Fig. 5 shows a kind of alternative construction of viral data determining module 400, reference picture 5, and viral data are true Cover half block 400 can include:
First determining unit 410, for the spy for determining to match with the viral data characteristic information by inverted index The corresponding data sample of reference breath;
Second determining unit 420, for by data sample determined by the first determining unit 410, being defined as viral data.
Optionally, characteristic information can include in embodiments of the present invention:The essential information of data sample, resource information and Program code information;Corresponding, Fig. 6 shows a kind of alternative construction of characteristic information extracting module 100, reference picture 6, feature letter Breath extraction module 100 can include:
Unit 110 is disassembled, for being disassembled to the executable program file of each data sample, obtains each data sample Essential information and resource information corresponding to this;
Decompiling unit 120, for carrying out decompiling to the program code information of each data sample, obtain each data Program code information corresponding to sample.
Fig. 7 shows another structure of viral data search device provided in an embodiment of the present invention, with reference to Fig. 3 and Fig. 7 institutes Show, Fig. 7 shown devices also include on the basis of Fig. 3 shown devices:
Non-viral data determining module 500, for the characteristic information that is extracted with the viral data characteristic information not During matching, determined and the data corresponding to the viral unmatched characteristic information of data characteristic information by the corresponding relation Sample, identified data sample is defined as non-viral data.
The embodiment of the present invention realizes the lookup of quick viral data, even for the feature with larger content spaces field Information, the embodiment of the present invention can also be determined and the data sample corresponding to this feature information by the comparison of a characteristic information Whether this is viral data, so as to improve the lookup speed of viral data.
The embodiment of the present invention also provides a kind of server, including viral data search device described above, viral data The description that device can refer to figure 3 above~Fig. 7 parts is searched, here is omitted.
The hardware configuration of server provided in an embodiment of the present invention is introduced below, viral number is related in being described below , can reference corresponding with above-described viral data search method according to the part of lookup method.
Fig. 8 is the hardware structure diagram of server provided in an embodiment of the present invention, and reference picture 8, server can include:Communication Interface 1, memory 2, processor 3 and communication bus 4.
Each component parts of server is specifically introduced with reference to Fig. 8.
Communication interface 1 can be the interface of communication module, such as the interface of network interface card, for being carried out in server and external equipment During information transmit-receive, the reception and transmission of signal are realized.
Memory 2 can be used for storage software program and module, and processor 3 is stored in the software of memory 2 by operation Program and module, various function application and data processing so as to execute server.Memory 2 can mainly include storage journey Sequence area and storage data field, wherein, storing program area can storage program area, the application program needed at least one function(Than Such as sound-playing function, image player function)Deng;Storage data field can store uses created data according to server (Such as voice data, phone directory etc.)Deng.In addition, memory 2 can include high-speed random access memory, can also include non- Volatile memory, for example, at least a disk memory, flush memory device or other volatile solid-state parts.
Processor 3 is the control centre of server, using the various pieces of various interfaces and the whole server of connection, By running or performing the software program and/or module that are stored in memory 2, and call the number being stored in memory 2 According to the various functions and processing data of execute server, so as to carry out integral monitoring to server.Optionally, processor 3 can wrap Include one or more processing units;Preferably, processor 3 can integrate application processor and modem processor, wherein, application Processor mainly handles operating system and application program etc., and modem processor mainly handles radio communication.It is appreciated that It is that above-mentioned modem processor can not also be integrated into processor 3.
Communication interface 1, memory 2, processor 3 complete mutual communication by communication bus 4.
In embodiments of the present invention, processor 3 can also have following function:
Extract the characteristic information of the data sample in Sample Storehouse;
Establish the corresponding relation of each characteristic information and corresponding data sample extracted;
Using distributed search engine by each characteristic information, it is compared with preset viral data characteristic information;
When the characteristic information extracted matches with the viral data characteristic information, determined by the corresponding relation The data sample corresponding to characteristic information to match with the viral data characteristic information, identified data sample is determined For viral data.
Each embodiment is described by the way of progressive in this specification, what each embodiment stressed be and other The difference of embodiment, between each embodiment identical similar portion mutually referring to.For device disclosed in embodiment For, because it is corresponded to the method disclosed in Example, so description is fairly simple, related part is said referring to method part It is bright.
Professional further appreciates that, with reference to the unit of each example of the embodiments described herein description And algorithm steps, can be realized with electronic hardware, computer software or the combination of the two, in order to clearly demonstrate hardware and The interchangeability of software, the composition and step of each example are generally described according to function in the above description.These Function is performed with hardware or software mode actually, application-specific and design constraint depending on technical scheme.Specialty Technical staff can realize described function using distinct methods to each specific application, but this realization should not Think beyond the scope of this invention.
Directly it can be held with reference to the step of method or algorithm that the embodiments described herein describes with hardware, processor Capable software module, or the two combination are implemented.Software module can be placed in random access memory(RAM), internal memory, read-only deposit Reservoir(ROM), electrically programmable ROM, electrically erasable ROM, register, hard disk, moveable magnetic disc, CD-ROM or technology In any other form of storage medium well known in field.
The foregoing description of the disclosed embodiments, professional and technical personnel in the field are enable to realize or using the present invention. A variety of modifications to these embodiments will be apparent for those skilled in the art, as defined herein General Principle can be realized in other embodiments without departing from the spirit or scope of the present invention.Therefore, it is of the invention The embodiments shown herein is not intended to be limited to, and is to fit to and principles disclosed herein and features of novelty phase one The most wide scope caused.

Claims (8)

  1. A kind of 1. viral data search method, it is characterised in that including:
    Extract the characteristic information of the data sample in Sample Storehouse;The characteristic information of the data sample includes:The base of data sample This information, resource information and program code information;
    Inverted index is established, the inverted index is used to store each characteristic information the depositing in corresponding data sample extracted The mapping that storage space is put;
    Using distributed search engine by each characteristic information, it is compared with preset viral data characteristic information;
    When the characteristic information extracted matches with the viral data characteristic information, determined and the disease by inverted index The data sample corresponding to characteristic information that malicious data characteristic information matches, identified data sample is defined as viral number According to.
  2. 2. according to the method for claim 1, it is characterised in that the characteristic information of the data sample in the extraction Sample Storehouse Including:
    The executable program file of each data sample is disassembled, obtain essential information corresponding to each data sample and Resource information;And decompiling is carried out to the program code information of each data sample, obtain the journey corresponding to each data sample Sequence code information.
  3. 3. according to the method for claim 1, it is characterised in that also include:
    When the characteristic information extracted mismatches with the viral data characteristic information, determined and the disease by inverted index Data sample corresponding to the malicious unmatched characteristic information of data characteristic information, identified data sample is defined as non-viral Data.
  4. 4. according to the method described in claim any one of 1-3, it is characterised in that the distributed search engine is Lucene points Cloth search engine.
  5. A kind of 5. viral data search device, it is characterised in that including:
    Characteristic information extracting module, for extracting the characteristic information of the data sample in Sample Storehouse;The feature of the data sample Information includes:The essential information of data sample, resource information and program code information;
    Corresponding relation building module, for establishing the corresponding relation of each characteristic information extracted and corresponding data sample;
    Comparing module, for by each characteristic information, being entered using distributed search engine with preset viral data characteristic information Row compares;
    Viral data determining module, for when the characteristic information extracted matches with the viral data characteristic information, leading to The data sample corresponding to the characteristic information that the corresponding relation determines and the viral data characteristic information matches is crossed, by institute The data sample of determination is defined as viral data;
    Wherein, the corresponding relation building module includes:
    Inverted index establishes unit, and for establishing inverted index, the inverted index is used to store each characteristic information extracted The mapping of storage location in corresponding data sample;
    The viral data determining module includes:
    First determining unit, for the characteristic information institute for determining to match with the viral data characteristic information by inverted index Corresponding data sample;
    Second determining unit, for by data sample determined by first determining unit, being defined as viral data.
  6. 6. device according to claim 5, it is characterised in that the characteristic information extracting module includes:
    Unit is disassembled, for being disassembled to the executable program file of each data sample, it is right to obtain each data sample institute The essential information and resource information answered;
    Decompiling unit, for carrying out decompiling to the program code information of each data sample, obtain each data sample institute Corresponding program code information.
  7. 7. according to the device described in claim any one of 5-6, it is characterised in that also include:
    Non-viral data determining module, for when the characteristic information that is extracted mismatches with the viral data characteristic information, By inverted index determine with the viral unmatched characteristic information of data characteristic information corresponding to data sample, by really Fixed data sample is defined as non-viral data.
  8. 8. a kind of server, it is characterised in that including the viral data search device described in claim any one of 5-7.
CN201310648844.2A 2013-12-04 2013-12-04 A kind of viral data search method, device and server Active CN104700030B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201310648844.2A CN104700030B (en) 2013-12-04 2013-12-04 A kind of viral data search method, device and server

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201310648844.2A CN104700030B (en) 2013-12-04 2013-12-04 A kind of viral data search method, device and server

Publications (2)

Publication Number Publication Date
CN104700030A CN104700030A (en) 2015-06-10
CN104700030B true CN104700030B (en) 2017-12-01

Family

ID=53347132

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201310648844.2A Active CN104700030B (en) 2013-12-04 2013-12-04 A kind of viral data search method, device and server

Country Status (1)

Country Link
CN (1) CN104700030B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106485146B (en) * 2015-09-02 2019-08-13 腾讯科技(深圳)有限公司 A kind of information processing method and server
CN109145589B (en) * 2018-07-27 2023-04-07 平安科技(深圳)有限公司 Application program acquisition method and device
CN112579878A (en) * 2019-09-30 2021-03-30 奇安信安全技术(珠海)有限公司 Virus identification method and device, storage medium and computer equipment
CN110990648A (en) * 2019-11-29 2020-04-10 珠海豹趣科技有限公司 Virus query method, server and computer readable storage medium
CN113935030B (en) * 2020-07-14 2024-04-09 深信服科技股份有限公司 Virus characteristic extraction method, system, storage medium and terminal

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101308533A (en) * 2008-06-30 2008-11-19 华为技术有限公司 Method, apparatus and system for virus checking and killing
CN103049695A (en) * 2012-12-11 2013-04-17 北京奇虎科技有限公司 Computer virus monitoring method and device
CN103268443A (en) * 2012-12-27 2013-08-28 武汉安天信息技术有限责任公司 Symbol-based Android malicious code detection method and system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101308533A (en) * 2008-06-30 2008-11-19 华为技术有限公司 Method, apparatus and system for virus checking and killing
CN103049695A (en) * 2012-12-11 2013-04-17 北京奇虎科技有限公司 Computer virus monitoring method and device
CN103268443A (en) * 2012-12-27 2013-08-28 武汉安天信息技术有限责任公司 Symbol-based Android malicious code detection method and system

Also Published As

Publication number Publication date
CN104700030A (en) 2015-06-10

Similar Documents

Publication Publication Date Title
CN104700030B (en) A kind of viral data search method, device and server
US9448999B2 (en) Method and device to detect similar documents
CN111031017B (en) Abnormal business account identification method, device, server and storage medium
CN106933947B (en) A kind of searching method and device, electronic equipment
TW201814565A (en) Method and device for auditing SQL
CN106921504B (en) Method and equipment for determining associated paths of different users
CN106126383B (en) A kind of log processing method and device
US8930389B2 (en) Mutual search and alert between structured and unstructured data stores
CN105426375B (en) A kind of calculation method and device of relational network
CN105808609A (en) Discrimination method and equipment of point-of-information data redundancy
TWI670623B (en) Method and device for acquiring device fingerprint
CN104133825A (en) Method and device for matching client user
CN104392171B (en) A kind of automatic internal memory evidence analysis method based on data association
CN105721629A (en) User identifier matching method and device
CN110414236A (en) A kind of detection method and device of malicious process
CA3032682A1 (en) Method for managing information using tree structure based on blockchain, server and terminal using the same
JP2020533666A (en) Context-aware diff algorithm for genomic files
CN108491715A (en) Generation method, device and the server in Terminal fingerprints library
CN109670665A (en) Method, assessment equipment and the storage medium of identification terminal batch registration account behavior
WO2023093638A1 (en) Abnormal data identification method and apparatus, and device and storage medium
CN109614521B (en) Efficient privacy protection sub-graph query processing method
US9875248B2 (en) System and method for identifying a file path using tree data structure
CN106294401A (en) Automatically the method and device in SQL list storehouse is set up
US10445213B2 (en) Non-transitory computer-readable storage medium, evaluation method, and evaluation device
CN109284590A (en) Access method, equipment, storage medium and the device of behavior safety protection

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
EXSB Decision made by sipo to initiate substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant