CN106708727A - Verification method and system for distributed virus characteristic sample - Google Patents
Verification method and system for distributed virus characteristic sample Download PDFInfo
- Publication number
- CN106708727A CN106708727A CN201610626302.9A CN201610626302A CN106708727A CN 106708727 A CN106708727 A CN 106708727A CN 201610626302 A CN201610626302 A CN 201610626302A CN 106708727 A CN106708727 A CN 106708727A
- Authority
- CN
- China
- Prior art keywords
- test
- subtask
- management server
- task
- main task
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/3668—Software testing
- G06F11/3672—Test management
- G06F11/3688—Test management for test execution, e.g. scheduling of test suites
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Measuring Or Testing Involving Enzymes Or Micro-Organisms (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to the field of computer security, in particular to a verification method and system for a distributed virus characteristic sample. The method comprises the following steps that: a test node obtains a test task from a management server; if the test task returned from the management server is a main task, a subtask is created according to the main task, and the subtask is sent to the management server; if the test task returned from the management server is the subtask, a test pack is downloaded according to the subtask, wherein the test pack comprises a scanning engine, a virus database, sample information and a corresponding expected result; according to the sample information, the characteristic sample is obtained; the scanning engine is used for detecting whether the characteristic sample carries the virus characteristic in the virus database or not, and a detection result is obtained; and whether the detection result is consistent with the expected result or not is judged, and the judgment result is sent to the management server. By use of the method, a plurality of test nodes can harmoniously finish the verification of large-scale characteristic samples, time for transmitting the characteristic samples to the test node from the server is saved, and test execution efficiency is improved.
Description
Technical field
The present invention relates to computer safety field, particularly a kind of distributed virus feature samples verification method and system.
Background technology
Virus base is the set of virus characteristic.Existing checking and killing virus method is by special by the virus in file and virus base
Levy to compare and judge whether file is virus document.The virus in virus document requirement virus base is recognized by virus base
Feature is effective, it is to avoid the phenomenon of " new virus be can not check, and not be that virus is but treated unjustly " occur.To avoid manslaughtering phenomenon, computer
Virus analysis personnel need to collect sample (including containing virus document and without virus before viral formal storage is issued into user
File), then the sample collected is given a forecast examination according to the virus characteristic for extracting, whether checking virus characteristic is effective.
At present, most of method of testings use push modes, and feature samples are transferred in test machine, are performed by test machine
Test, and output test result.In the case where feature samples amount is few, this transmission is time-consuming can be ignored, but for feature samples
In the case of amount is big, push modes can take the most of the time of whole test, and unknown mistake is likely to occur during push,
Increase the risk of data transmission fails.Also, most of automatic test only one of which device nodes perform test, when performing consumption
When task more long when, it is impossible to quickly output test result.
There is a problem of that time-consuming, efficiency is low for existing method of testing, effective solution is not yet proposed at present.
The content of the invention
In order to overcome the defect of prior art, the present invention to provide a kind of verification method of distributed virus feature samples and be
System.By way of test node is actively obtained and perform task from management server, the checking to virus characteristic sample is realized,
Wherein, the test machine where test node inquires about it in subtasking, first whether there is required feature samples, at this
In the case of ground feature samples in the absence of needed for, then feature samples are obtained from sample storage server, so as to save feature sample
This transmission time, improves verification efficiency.
The present invention is as follows using technical scheme：
A kind of distributed virus feature samples verification method, including：
Test node obtains test assignment to management server, and the test assignment is main task or subtask；
If the test assignment that management server is returned is main task, subtask is created according to the main task, and by institute
Subtask is stated to send to management server；
If the test assignment that management server is returned is subtask, test bag, the survey are downloaded according to the subtask
Examination includes scanning engine, virus base, sample information and corresponding expected results；Feature sample is obtained according to the sample information
This；Detect whether the feature samples carry the virus characteristic in the virus base using scanning engine, obtain testing result；Sentence
Whether the testing result of breaking is consistent with expected results, and will determine that result is sent to management server.
Correspondingly, present invention also offers a kind of distributed virus feature samples checking system, including management server and
At least one test machine, the test machine includes multiple test nodes,
The test node includes：
Acquisition module, for obtaining test assignment to management server, the test assignment is main task or subtask；
Performing module, when the test assignment for being returned in management server is main task, creates according to the main task
One or more subtasks, and the subtask is sent to management server, the test assignment returned in management server is
During subtask, test bag is downloaded according to the subtask, the test bag includes scanning engine, virus base, sample information and right
The expected results answered；Feature samples are obtained according to the sample information；Detect whether the feature samples are taken using scanning engine
With the virus characteristic in the virus base, testing result is obtained；Judge whether the testing result is consistent with expected results, and will
Judged result is sent to management server.
The beneficial effects of the invention are as follows：
The present invention couples together many test machines by communication network with management server, builds distributed treatment system
System, for being verified to virus characteristic sample, drastically increase the verification efficiency of feature samples, it is mainly reflected in following
Two aspects, on the one hand, main task is split as multiple subtasks, is obtained and is performed for all test nodes, the task of improve is held
Line efficiency；On the other hand, management server is returned in the subtask of test node not comprising feature samples, in subtasking
When, the test machine first from where test node obtains feature samples corresponding with sample information, does not exist institute in the test machine
In the case of needing feature samples, then feature samples are obtained from sample storage server, this may saved feature samples are straight
The time transmitted from management server to test node is connect, is conducive to further improving the execution efficiency of test assignment, it is quick defeated
Go out test result.
Additionally, task is disassembled into work moves to test node, main task is split into multiple subtasks by test node, both
Improve task and split efficiency, the requirement to management server operational performance is reduced again.
In feature samples verification process, management server is caught by updating execution status of task and performs appointing for failure
Business, and the performing failure of the task has been adjusted again, reacquired for test node and performed, improve the success of tasks carrying
Rate.
Brief description of the drawings
In order to illustrate more clearly of technical scheme, below will be to being wanted needed for embodiment or description of the prior art
The accompanying drawing for using is briefly described, it should be apparent that, drawings in the following description are only some embodiments of the present invention, right
For those of ordinary skill in the art, on the premise of not paying creative work, it can also be obtained according to these accompanying drawings
Its accompanying drawing.
Fig. 1 is a kind of structural representation of implementation environment of distributed virus feature samples verification method in the embodiment of the present invention
Figure；
Fig. 2 is the schematic flow sheet of one embodiment of distributed virus feature samples verification method of the invention；
Fig. 3 is to obtain in distributed virus feature samples verification method of the invention and flow the step of executive director is engaged in
Figure；
Fig. 4 is to obtain in distributed virus feature samples verification method of the invention and flow the step of subtasking
Figure；
The step of Fig. 5 is test node subtasking in distributed virus feature samples verification method of the invention flow
Figure；
Fig. 6 is the structural representation of one embodiment of distributed virus feature samples checking system of the invention；
Fig. 7 is the structural representation of test node in distributed virus feature samples checking system of the invention；
Fig. 8 is the structural representation of management server in distributed virus feature samples checking system of the invention.
Specific embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clear, complete
Site preparation is described, it is clear that described embodiment is only a part of embodiment of the invention, rather than whole embodiments.It is based on
Embodiment in the present invention, those of ordinary skill in the art obtained on the premise of creative work is not made it is all its
His embodiment, belongs to the scope of protection of the invention.
Fig. 1 is referred to, Fig. 1 is a kind of implementation environment of distributed virus feature samples verification method in the embodiment of the present invention
Structural representation.
Implementation environment shown in Fig. 1 is used to realize any embodiment of the present invention or the distributed virus feature described in implementation method
Sample verification method, including management server 100, test bag storage server 200, sample storage server 300 and at least one
Platform test machine 400, can be by wireless network or limited between the management server 100 and test bag storage server 200
Network is attached, and each described test machine 400 takes with management server 100, the storage of test bag storage server 200, sample
Can be attached by wireless network or finite element network between business device 300.For ease of description, Fig. 1 only shows a test machine
400, as needed, can actually increase the quantity of test machine.
Wherein, every test machine 400 disposes many android virtual machines, while designing a plurality of thread, Yi Yitai
Android virtual machines and a thread constitute test node, i.e., every test machine includes multiple test nodes.The test node is used
Test assignment (test assignment includes main task and subtask) is obtained to management server 100 in active, the test for obtaining is performed
Task, and implementing result is fed back into management server 100, if the test assignment for performing is subtask, in addition it is also necessary to from test
Bag storage server 200 downloads test bag, and obtains feature samples from sample storage server 300.Further, test section
Point also needs to the implementation status to the feedback test task of management server 100, so that each test assignment of record management server
Execution state, the task addition that will perform failure is not carried out task queue, is reacquired by test node and is performed.The present invention
In, the test machine 400 can be mobile terminal, terminal or similar arithmetic unit, preferably install windows
The terminal of system.The terminal includes processor and the memory for storing feature samples, in the meter
Android running environment is simulated in calculation machine terminal, using Oracle VM VirtualBox and android mirror images at computer end
Android virtual machines are built on end, and the file for storing feature samples is configured to virtual machine Shared Folders, start is set
Automatic carry.During subtasking, feature samples from management service can be eliminated from Shared Folders direct access feature samples
The time required to device 100push to android virtual machines.
Management server of the invention 100 monitors test bag storage server with polling mode, when discovery has new test
When bag is stored in test bag storage server 200, test main task and corresponding task row are automatically generated according to new test bag
Table, and the request of test assignment is obtained according to test node, test assignment is sent into test node performs, and, receiving
To after the implementing result of test node feedback, task list is updated.In the present invention, management server 100 can for mobile terminal,
Terminal or similar arithmetic unit, preferably install terminal (such as personal computer of windows systems
PC).Terminal can include that (processor can include but is not limited to Micro-processor MCV or can to one or more processors
The processing unit of programmed logic device FPGA etc.) and for the memory of data storage, certainly, the structure of terminal is not
It is limited to above-mentioned electronic installation, for example, may also include than more components.Memory can be used for the software of data storage, application software
Inquiry test assignment, generation are realized in program and module, such as storage test assignment, task list and test report, and storage
Test report and the subtask of failure will be performed rejoin and be not carried out the corresponding programmed instruction/mould of the data processings such as task queue
Block.
The test bag stored in test bag storage server 200 refers to be generated by other compiling platforms, can be formally outer
The checking and killing virus software of a certain version being dealt on line for users to use, that is, prepare the bag of issue.Sample storage server 300 is used
In storage feature samples, test node can obtain feature samples in subtasking from sample storage server 300,
The spent time of test node 400 is transferred data to reduce from management server 100.Test bag storage server 200 and sample
Storage server 300 includes memory, and memory can include high speed random access memory, may also include non-volatile memories
Device, such as one or more magnetic storage devices, flash memory or other non-volatile solid state memories.
Fig. 2 is referred to, Fig. 2 is that the flow of one embodiment of distributed virus feature samples verification method of the invention is shown
It is intended to.
The distributed meter virus characteristic sample verification method of one kind described in present embodiment, comprises the following steps：
Step S201, test node obtains test assignment to management server, and the test assignment is that main task or son are appointed
Business；
Step S202, if the test assignment that management server is returned is main task, creates son and appoints according to the main task
Business, and the subtask is sent to management server；
If the test assignment that management server is returned is subtask, test bag, the survey are downloaded according to the subtask
Examination includes scanning engine, virus base, sample information and corresponding expected results；Feature sample is obtained according to the sample information
This；Detect whether the feature samples carry the virus characteristic in the virus base using scanning engine, obtain testing result；Sentence
Whether the testing result of breaking is consistent with expected results, and will determine that result is sent to management server.
Verification efficiency to feature samples is remarkably improved using the inventive method, is mainly reflected in：First, by test node
Main task is split as multiple subtasks, because test node quantity is more, different main tasks can be carried out in the same time
Split, be once only capable of by the way of one main task of fractionation using management server compared in conventional method, significantly improve and hold
Line efficiency；2nd, management server is performing son times in being sent to the subtask of test node not comprising feature samples, test node
During business, feature samples can be obtained from virtual machine Shared Folders or sample storage server, so as to reduce feature sample
This is transferred to test node spent time from management server, beneficial to raising execution efficiency.
Below in conjunction with accompanying drawing 3-5, the step for performing distributed virus feature samples verification method of the invention is described in detail
Rapid flow.
Fig. 3 is referred to, Fig. 3 is acquisition and executive director's business in distributed virus feature samples verification method of the invention
Flow chart of steps.The step includes：
S301, management server generate main task and task list corresponding with the main task according to test bag, and deposit
Store up the main task and task list.
Specifically, test bag is generated by other compiling platforms, formally can outward be dealt into certain on line for users to use
The checking and killing virus software of one version, that is, prepare the bag of issue, needs to first pass through testing process test, test bag whole before issue
Storage is in test bag storage server.
Include automatically creating mode and manual creation mode according to the method that test bag generates main task and task list.Its
In, the mode of automatically creating is：Management server passes through monitoring programme monitor in real time test bag storage server, when discovery test bag
After storage server has the new test bag being stored in, main task and corresponding task list can be tested according to test bag generation,
Then main task and task list are stored in memory.Wherein, main task includes main task ID, priority description, test bag
Information and test event, the test package informatin can be including test bag storage address etc., and task list includes main task ID.
Manual creation mode is：Main task is tested according to test bag manual creation, it is possible to specify one or more test events.
Main task in memory has priority attribute, and priority is divided into high, medium and low three kinds, management server
After response test node, task can be sent according to the priority order of task.Preferably, the test master that will can be automatically created
During the priority of task is defaulted as, the test main task of manual creation can independently select high, normal, basic three kinds of priority, to avoid
When having hot job, because task is excessive in task queue, some urgent tasks are caused to perform in time.Correspondingly, survey
Swab task also has priority attribute, and the priority attribute of subtask is consistent with the priority attribute of main task.At certain a little
After the state of business is to perform failure, the subtask for performing failure is hung up again, and its priority keeps constant, but need to be same excellent
After other subtasks of first level are finished, the subtask of execution failure can just be retrieved and perform.Such as 10 sons
In task, there is a subtask Q to perform failure, subtask Q after the completion of other 9 subtasks are performed both by, by test node
Obtain and perform.
S302, test node are to management server request for test task.
Test node sends the request for obtaining test assignment to management server.
S303, management server queries whether there is the test assignment being not carried out, and the subtask that will be not carried out is sent to survey
Examination node.
Management server receives the request of the acquisition task that test node sends, with the presence or absence of not in preferential inquiry memory
The main task of execution, if inquiring in the presence of the main task being not carried out, is sent to test node, if not inquiring about by the main task
To the main task being not carried out, then further inquiry whether there is the subtask being not carried out.
Specifically, main task or the subtask being not carried out can be judged whether by query task list.Task
The execution of the subtask ID after main task ID, the execution state of main task, main task split and each subtask is have recorded in list
State.During query task list, the execution state of preferential inquiry main task, then the main task that will be not carried out according to priority from height to
It is low to be sent to different test nodes successively.
S304, test node create one or more subtasks according to main task, and subtask is back into management service
Device.
After test node receives the main task of management server return, test event in main task create one or
Multiple subtasks, are that subtask ID is distributed in each subtask according to main task ID, and generate master according to the implementation status of main task
Tasks carrying reports that the main task performs report includes main task ID, the execution state of main task and subtask ID；Then will
Subtask and main task perform report and send to management server.
S305, management server store the subtask, and subtask information is added in task list.
Management server receives the subtask created according to main task of test node return and main task performs report, will
The subtask is stored in memory, and according to main task perform report the execution state of main task is updated to be carrying out,
Subtask ID is added in task list.
Referring to Fig. 4, Fig. 4 is the step of acquisition and subtasking in distributed virus feature samples verification method of the invention
Rapid flow chart.The step includes：
S401, management server generate main task and task list according to test bag, and store the main task and task
List.
Management server can create main task by automatically creating mode, specially：By monitoring programme with poll side
Formula monitors test bag storage server, after finding that test bag storage server has the test bag being newly stored in, automatically according to described
Test bag generates main task and corresponding task list, and then main task and task list are stored in memory.Wherein, director
Business includes main task ID, priority description, test package informatin and test event, and the test package informatin can be deposited including test bag
Storage address etc., task list includes main task ID.
Main task in memory has priority attribute, and priority is divided into high, medium and low three kinds, management server
After response test node, task can be sent according to the priority order of task.Correspondingly, the subtask for being created according to main task
Also there is priority attribute, the priority attribute of subtask is consistent with the priority attribute of main task.State in subtask is to hold
After row failure, the subtask for performing failure is hung up again, and its priority keeps constant.
S402, test node are to management server request for test task.
Test node sends the request for obtaining test assignment to management server.
S403, management server queries whether there is the test assignment being not carried out, and the subtask that will be not carried out is sent to survey
Examination node.
Management server receives the request of the acquisition task that test node sends, with the presence or absence of not in preferential inquiry memory
The main task of execution, if not inquiring the main task being not carried out, further inquiry whether there is the subtask being not carried out, and will
The subtask being not carried out is sent to test node.
Specifically, main task or the subtask being not carried out can be judged whether by query task list.Task
The execution of the subtask ID after main task ID, the execution state of main task, main task split and each subtask is have recorded in list
State.During query task list, the execution state of preferential inquiry main task, in all main tasks all in completing to perform or
After execution state, the execution state of subtask is inquired about, the subtask that will be not carried out according to priority is sent to not successively from high to low
Same test node.
S404, test node perform the subtask, and implementing result is fed back into management server.
Referring to Fig. 5, Fig. 5 is test node subtasking in distributed virus feature samples verification method of the invention
Flow chart of steps, the step includes：
S4041, according to subtask download test bag, the test bag include scanning engine, virus base, sample information and with
The corresponding expected results of the sample information.
Specifically, according to the test bag download address included in subtask, downloaded from test bag storage server corresponding
Test bag, the test bag includes scanning engine, virus base, sample information and expected results corresponding with the sample information.
The corresponding sample of the sample information is defaulted as carrying the sample of virus characteristic in virus base, and its corresponding expected results is defaulted as
Sample contains virus, it is contemplated that result is stored with sample information, certainly, it is contemplated that result can also be the result of artificial compiling.
S4042, the sample information in test bag obtain feature samples.
Feature in sample information searches feature samples, inquire about first on test machine of the test node where it whether
Be stored with the feature samples matched with the feature in the sample information, if so, then directly transferring the spy from test machine
Sample is levied, if it is not, the then download features sample from sample storage server of the address in the feature samples information.
S4043, using scanning engine detect feature samples whether containing the virus characteristic in virus base, obtain detection knot
Really.
In by adb install installation scanning engines to android virtual machines, new thread A is opened, by adb
Logcat is waited and is collected scanning implementing result, is driven tested scanning engine using uiautomator test frames and is simulated click
Scan operation, whether it is special with the virus in detecting the feature samples containing the virus base that scanning engine is run in virtual machine
Levy, obtain testing result.
S4044, judge that whether detection crosses consistent with expected results with regard to Ei, and will determine that result is back to management server.
Testing result is contrasted with expected results, testing result and the inconsistent content of expected results is recorded, is formed
Variance data, management server is sent to using variance data as judged result.
Additionally, test node performs report always according to subtask implementation status generation subtask, and the subtask is held
Row report is sent to management server.The subtask performs report and have recorded subtask ID and corresponding execution state, described
Execution state includes completing to perform and performs failure, if successful execution above-mentioned steps S4041-S4044, is judged to that subtask is complete
Into execution, if during step S4041-S4044 is performed, running into the failure of download test bag, to download sample failure, engine initial
Change or scanning unsuccessfully etc., then be judged to that subtask performs failure.
The implementing result of S405, management server storage test node feedback, and update holding for subtask in task list
Row state.
Management server receives the judged result of test node feedback and subtask performs report, and the judged result is deposited
In entering memory, and the execution state that report updates subtask in task list is performed according to subtask, the subtask is held
Row state includes completing to perform and perform failure.
Further, distributed virus feature samples verification method also includes：Management server monitors the task list,
After all subtasks of main task are updated to complete to perform, test report corresponding with the main task, test report are generated
Announcement can embody variance data of the corresponding testing result in subtask, testing result and expected results etc.；When monitoring subtask
To perform during failure, the subtask that will perform failure adds the subtask queue being not carried out to execution state, for test node again
Obtain and perform.
In the inventive method, management server catches the performing failure of the task by updating execution status of task, and will
The performing failure of the task has been adjusted again, is reacquired for test node and performed, and improves the success rate of tasks carrying.
Corresponding with above-mentioned distributed virus feature samples verification method, the embodiment of the present invention also provides a kind of distributed disease
Malicious feature samples checking system.As shown in fig. 6, the system includes：Test bag storage server 200, sample storage server
300th, management server 100 and at least one test machine 400, the test machine 400 include multiple test nodes 410.The pipe
Connected by wireless network or finite element network between reason server 100 and test bag storage server 200, the test machine 400
Respectively between management server 100, test bag storage server 200 and sample storage server 300 by wireless network or
Finite element network is connected.
The test bag storage server 200, for storing test bag.The test bag is generated by other compiling platforms
, the checking and killing virus software of a certain version that formally can be dealt into outward on line for users to use prepare the bag of issue.
The sample storage server 300, for storing feature samples.
Fig. 8 is referred to, the management server 100 includes task creation module 110, enquiry module 120, update module
130th, Mission Monitor module 140 and memory module 150.
The task creation module 110, in test bag storage server 200 test bag create main task and
Task list corresponding with main task.Task creation module 110 works as hair with polling mode monitoring test bag storage server 200
After existing new test bag is stored in test bag storage server 200, main task and corresponding is generated automatically according to the test bag
, then be stored in memory for main task and task list by task list.Wherein, main task is retouched comprising main task ID, priority
State, test package informatin and test event, the test package informatin can be including test bag storage address etc., and task list can be used
The execution state of subtask ID and each subtask after record main task ID, the execution state of main task, main task split.
The enquiry module 120, the request of test assignment is obtained for response test node 410, inquires about memory module 150
In with the presence or absence of the main task that is not carried out, if so, then send to test node the main task, if it is not, then inquiry storage mould
Sent to test node with the presence or absence of the subtask being not carried out, and the subtask that will be not carried out in block.Specifically, can be by looking into
Task list is ask to judge whether the main task or the subtask that are not carried out.During query task list, main task is preferentially inquired about
Execution state, in all main tasks all in completing to perform or after being carrying out state, inquire about the execution state of subtask.
When sending main task or subtask, different test sections are sent to successively from high to low according to the priority of main task or subtask
Point.
The update module 130, for behind the subtask for receiving test node return, subtask information being added to
In task list, and, after the judged result for receiving test node return, correspondence subtask holds in renewal task list
Row state, the execution state includes completing to perform and perform failure.Specifically, the main task for being returned according to test node is performed
It is reported in and subtask information is added in task list, the subtask returned according to test node performs and is reported in task list more
The execution state of new subtask.
The Mission Monitor module 140, for monitoring the task list, when all subtasks of main task are updated to
After completing to perform, test report corresponding with the main task is generated；When the execution state for monitoring subtask is to perform failure
When, the subtask of failure will be performed as the subtask being not carried out, reacquired for test node.
The memory module 150, the main task and task list, performing module created for store tasks creation module is returned
The subtask returned and judged result and the test report of Mission Monitor module generation.
Fig. 7 is referred to, the test node 410 includes acquisition module 411 and performing module 412.
The acquisition module 411, for obtaining test assignment to management server, the test assignment is main task or son
Task.
The performing module 412, when the test assignment for being returned in management server is main task, according to the director
Business creates one or more subtasks, and the subtask is sent to management server, in the test that management server is returned
When task is subtask, test bag is downloaded according to the subtask, the test bag includes scanning engine, virus base, sample letter
Breath and corresponding expected results；Feature samples are obtained according to the sample information；The feature samples are detected using scanning engine
Whether the virus characteristic in the virus base is carried, testing result is obtained；Judge the testing result and expected results whether one
Cause, and will determine that result is sent to management server.
The performing module 412 includes acquiring unit 4121, detection unit 4122 and judging unit 4123.
The acquiring unit 4121, tests for being downloaded from the test bag storage server 200 according to the subtask
Bag, is additionally operable to the sample information in the test bag and obtains feature samples, including：Survey where inquiry test node 410
Whether test-run a machine 400 is stored with the feature samples matched with the feature in the sample information, if so, then being obtained from the test machine
The feature samples are taken, if it is not, the then download features from sample storage server of the address in the feature samples information
Sample.
The detection unit 4122, in detecting whether the feature samples carry the virus base using scanning engine
Virus characteristic, obtain testing result.
The judging unit 4123, judges whether the testing result is consistent with expected results, and will determine that result sends
To management server 100.
Above disclosed is only presently preferred embodiments of the present invention, can not limit right of the invention with this certainly
Scope, the equivalent variations made according to the claims in the present invention still belong to the scope that the present invention is covered.
Claims (10)
1. a kind of distributed virus feature samples verification method, it is characterised in that including：
Test node obtains test assignment to management server, and the test assignment is main task or subtask；
If the test assignment that management server is returned is main task, subtask is created according to the main task, and by the son
Task is sent to management server；
If the test assignment that management server is returned is subtask, test bag, the test bag are downloaded according to the subtask
Including scanning engine, virus base, sample information and corresponding expected results；Feature samples are obtained according to the sample information；Profit
Detect whether the feature samples carry the virus characteristic in the virus base with scanning engine, obtain testing result；Judge institute
State testing result whether consistent with expected results, and will determine that result is sent to management server.
2. method according to claim 1, it is characterised in that the test node obtains test assignment to management server
Including：
Test node sends the request for obtaining test assignment to management server；
The request of management server response test node, inquiry whether there is the main task being not carried out, if so, then by the director
Business is sent to test node, if it is not, then inquiry is sent to survey with the presence or absence of the subtask being not carried out, and the subtask that will be not carried out
Examination node；
Test node receives the test assignment that management server sends.
3. method according to claim 1, it is characterised in that obtain test to management server in the test node and appoint
Before business, also include：According to the test bag being stored in test bag storage server, in management server create main task and
Task list corresponding with main task.
4. method according to claim 3, it is characterised in that methods described also includes：
Management server stores the subtask, and subtask information is added behind the subtask for receiving test node return
It is added in task list；
Management server stores the judged result, and more new task after the judged result for receiving test node return
The execution state of correspondence subtask in list, the execution state includes completing to perform and perform failure.
5. method according to claim 4, it is characterised in that methods described also includes：Management server monitoring is described to appoint
Business list, after all subtasks of main task are updated to complete to perform, generates test report corresponding with the main task；
When the execution state for monitoring subtask is to perform failure, the subtask of failure will be performed as the subtask being not carried out, supplied
Test node is reacquired.
6. method according to claim 3, it is characterised in that
It is described to be included according to subtask download test bag：Downloaded from the test bag storage server according to the subtask
Test bag；
It is described to be included according to sample information acquisition feature samples：Inquiry test node where test machine whether be stored with
The feature samples that feature in the sample information matches, if so, the feature samples then are obtained from the test machine, if
It is no, then the download features sample from sample storage server of the address in the feature samples information.
7. a kind of distributed virus feature samples checking system, it is characterised in that tested including management server and at least one
Machine, the test machine includes multiple test nodes,
The test node includes：
Acquisition module, for obtaining test assignment to management server, the test assignment is main task or subtask；
Performing module, when the test assignment for being returned in management server is main task, one is created according to the main task
Or multiple subtasks, and the subtask is sent to management server, the test assignment returned in management server is son times
During business, test bag is downloaded according to the subtask, the test bag includes scanning engine, virus base, sample information and corresponding
Expected results；Feature samples are obtained according to the sample information；Detect whether the feature samples carry institute using scanning engine
The virus characteristic in virus base is stated, testing result is obtained；Judge whether the testing result is consistent with expected results, and will determine that
Result is sent to management server.
8. system according to claim 7, it is characterised in that the system also includes：
Test bag storage server, for storing test bag；
Sample storage server, for storing feature samples.
9. system according to claim 8, it is characterised in that the management server includes：
Task creation module, for creating main task and and main task according to the test bag being stored in test bag storage server
Corresponding task list；
Enquiry module, the request of test assignment is obtained for response test node, be whether there is in inquiry memory module and is not carried out
Main task, if so, then send to test node the main task, if it is not, then in inquiry memory module with the presence or absence of not holding
Capable subtask, and the subtask that will be not carried out sent to test node；
Update module, for behind the subtask for receiving test node return, subtask information being added in task list,
And, after the judged result for receiving test node return, the execution state of correspondence subtask in task list is updated, it is described
Execution state includes completing to perform and perform failure；
Mission Monitor module, for monitoring the task list, after all subtasks of main task are updated to complete to perform,
Generation test report corresponding with the main task；When the execution state for monitoring subtask is to perform failure, mistake will be performed
The subtask lost reacquires as the subtask being not carried out for test node；
The subtask that memory module, the main task created for store tasks creation module and task list, performing module are returned
The test report generated with judged result, Mission Monitor module.
10. system according to claim 8, it is characterised in that the performing module includes：
Acquiring unit, for downloading test bag from the test bag storage server according to the subtask, is additionally operable to according to institute
State the sample information in test bag and obtain feature samples, including：Whether the test machine where inquiry test node is stored with and institute
The feature samples that the feature in sample information matches are stated, if so, the feature samples then are obtained from the test machine, if it is not,
The then download features sample from sample storage server of the address in the feature samples information；
Detection unit, for detecting whether the feature samples carry the virus characteristic in the virus base using scanning engine,
Obtain testing result；
Judging unit, judges whether the testing result is consistent with expected results, and will determine that result is sent to management server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610626302.9A CN106708727B (en) | 2016-08-03 | 2016-08-03 | Distributed virus characteristic sample verification method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610626302.9A CN106708727B (en) | 2016-08-03 | 2016-08-03 | Distributed virus characteristic sample verification method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106708727A true CN106708727A (en) | 2017-05-24 |
| CN106708727B CN106708727B (en) | 2020-04-28 |
Family
ID=58939670
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610626302.9A Active CN106708727B (en) | 2016-08-03 | 2016-08-03 | Distributed virus characteristic sample verification method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106708727B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107391640A (en) * | 2017-07-11 | 2017-11-24 | 郑州云海信息技术有限公司 | A kind of method for realizing SQL Server database mirroring pattern automatic deployments |
| CN111212113A (en) * | 2019-12-19 | 2020-05-29 | 国家电网有限公司 | Virus sample distribution method, transmitting end, receiving end and system |
| CN111580946A (en) * | 2020-04-28 | 2020-08-25 | 北京达佳互联信息技术有限公司 | Port scanning method, device, equipment and storage medium |
| CN112817650A (en) * | 2020-12-28 | 2021-05-18 | 浙江中控技术股份有限公司 | Task creation method, device and system in laboratory management system |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101202761A (en) * | 2007-12-04 | 2008-06-18 | 赵晓宇 | System of distributed resource scheduling and method thereof |
| US20110126209A1 (en) * | 2009-11-24 | 2011-05-26 | Housty Oswin E | Distributed Multi-Core Memory Initialization |
| CN102710785A (en) * | 2012-06-15 | 2012-10-03 | 哈尔滨工业大学 | Cloud service node architecture in self-service tourism system, and service collaborating and balancing module and method among service nodes in self-service tourism system |
| CN102821162A (en) * | 2012-08-24 | 2012-12-12 | 上海和辰信息技术有限公司 | System for novel service platform of loose cloud nodes under cloud computing network environment |
| CN104539681A (en) * | 2014-12-23 | 2015-04-22 | 北京超图软件股份有限公司 | Distributed GIS accelerating system and GIS service processing method |
-
2016
- 2016-08-03 CN CN201610626302.9A patent/CN106708727B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101202761A (en) * | 2007-12-04 | 2008-06-18 | 赵晓宇 | System of distributed resource scheduling and method thereof |
| US20110126209A1 (en) * | 2009-11-24 | 2011-05-26 | Housty Oswin E | Distributed Multi-Core Memory Initialization |
| CN102710785A (en) * | 2012-06-15 | 2012-10-03 | 哈尔滨工业大学 | Cloud service node architecture in self-service tourism system, and service collaborating and balancing module and method among service nodes in self-service tourism system |
| CN102821162A (en) * | 2012-08-24 | 2012-12-12 | 上海和辰信息技术有限公司 | System for novel service platform of loose cloud nodes under cloud computing network environment |
| CN104539681A (en) * | 2014-12-23 | 2015-04-22 | 北京超图软件股份有限公司 | Distributed GIS accelerating system and GIS service processing method |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107391640A (en) * | 2017-07-11 | 2017-11-24 | 郑州云海信息技术有限公司 | A kind of method for realizing SQL Server database mirroring pattern automatic deployments |
| CN107391640B (en) * | 2017-07-11 | 2020-12-08 | 浪潮云信息技术股份公司 | Method for realizing automatic deployment of SQL Server database mirror mode |
| CN111212113A (en) * | 2019-12-19 | 2020-05-29 | 国家电网有限公司 | Virus sample distribution method, transmitting end, receiving end and system |
| CN111212113B (en) * | 2019-12-19 | 2024-05-14 | 国家电网有限公司 | Virus sample distribution method, sending end, receiving end and system |
| CN111580946A (en) * | 2020-04-28 | 2020-08-25 | 北京达佳互联信息技术有限公司 | Port scanning method, device, equipment and storage medium |
| CN112817650A (en) * | 2020-12-28 | 2021-05-18 | 浙江中控技术股份有限公司 | Task creation method, device and system in laboratory management system |
| CN112817650B (en) * | 2020-12-28 | 2022-04-26 | 浙江中控技术股份有限公司 | Task creation method, device and system in laboratory management system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106708727B (en) | 2020-04-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10691433B2 (en) | Split front end for flexible back end cluster processing | |
| JP4650203B2 (en) | Information system and management computer | |
| CN106708727A (en) | Verification method and system for distributed virus characteristic sample | |
| CN110162977A (en) | A kind of Android vehicle-mounted terminal system leakage location and method | |
| CN104346148B (en) | Obtain method, the apparatus and system of program feature consumption information | |
| CN112989330B (en) | Container intrusion detection method, device, electronic equipment and storage medium | |
| CN108600311B (en) | Method and device for simulating interface data by client | |
| CN104410671B (en) | A kind of snapshot grasping means and data supervising device | |
| CN107704369B (en) | Operation log recording method, electronic device, storage medium and system | |
| CN103701641B (en) | A kind of method and system for automating O＆M | |
| CN107370796A (en) | A kind of intelligent learning system based on Hyper TF | |
| CN113157411B (en) | Celery-based reliable configurable task system and device | |
| CN109902028A (en) | Automated testing method, device, equipment and the storage medium of ACL characteristic | |
| CN108268365A (en) | Abnormal task method for implanting, device and system | |
| CN105224450B (en) | Concurrent testing method and device | |
| CN113568604B (en) | Method and device for updating wind control strategy and computer readable storage medium | |
| CN109582560A (en) | Test file edit methods, device, equipment and computer readable storage medium | |
| CN104035821B (en) | management system and method | |
| CN115687119A (en) | Interface fuzzy test system based on generation and variation modes | |
| CN107656849B (en) | Method and device for positioning performance problem of software system | |
| CN111290855B (en) | GPU card management method, system and storage medium for multiple GPU servers in distributed environment | |
| US20190026360A1 (en) | Data processing using an enumeration utility | |
| Sweeney et al. | Early experience using amazon batch for scientific workflows | |
| CN112860398A (en) | Data processing method, device, equipment and medium based on rule engine | |
| CN112418720A (en) | Management method and device for mapping of business and process engine, electronic equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |