WO2013010394A1

WO2013010394A1 - Internet virus detection method, apparatus thereof and system thereof

Info

Publication number: WO2013010394A1
Application number: PCT/CN2012/074607
Authority: WO
Inventors: 蒋敏; 丁成林
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-07-20
Filing date: 2012-04-24
Publication date: 2013-01-24
Also published as: CN102255915A

Abstract

An internet virus detection method is provided, which comprises the following steps: carrying out a virus detection on the downloadable resources corresponding to the Uniform Resource Locator (URL) with a server; recording the result information of the virus detection; according to the URL virus query request of a network terminal, sending the result information corresponding to the URL to the network terminal. An internet virus detection apparatus and a system thereof are also provided, with which a network terminal does not need to install anti-virus software, can learn through the query whether the downloadable resources to be downloaded contain viruses, and thus avoids a virus infection of the network terminal.

Description

Internet virus detection method, device and system

The present invention relates to virus detection technology, and more particularly to an Internet virus detection method, apparatus and system. Background technique

With the development of technology and the continuous improvement of people's living standards, more and more users access the Internet through network terminals such as computers or mobile phones, and browse or download software. However, there are a large number of viruses on the Internet, and downloading and running a file containing a virus can cause the network terminal to be infected with a virus.

At present, users usually install anti-virus software on their own network terminals, and perform virus checking and anti-virus operations on the downloaded files by running the anti-virus software installed on the terminal to prevent the network terminal from being infected with viruses. However, due to the untimely update of the virus database of the anti-virus software, some viruses may not be quarantined or deleted, which may cause the network terminal to be infected with the virus.

In particular, with the popularity of smartphones, people often download files such as games or software online via smartphones. However, the CPU of the smartphone is slower and has less storage space, and the anti-virus software usually takes up a lot of storage space, and running the anti-virus software consumes a lot of system resources, affecting the normal operation of other programs, so most smartphones No anti-virus software is installed, which makes the smartphone very susceptible to viruses. Summary of the invention

In view of this, the main object of the present invention is to provide an Internet virus detection method, apparatus, and system, which can enable a network terminal to know whether a resource to be downloaded contains a virus without installing anti-virus software, thereby preventing the network terminal from being infected with a virus. In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The invention provides a method for detecting an internet virus, the method comprising:

The server performs virus detection on the downloadable resource corresponding to the uniform resource locator URL; and records the result information of the virus detection;

Sending result information corresponding to the URL to the network terminal according to a URL virus query request of the network terminal.

Preferably, before the server performs virus detection on the downloadable resource corresponding to the URL, the method further includes: the server determining whether the resource corresponding to the URL is a downloadable resource, and performing virus detection when the resource is downloadable.

Preferably, the server performs virus detection on the downloadable resource corresponding to the URL, and is: the server downloads the downloadable resource corresponding to the URL, and performs virus detection on the downloadable resource.

Preferably, before the downloading the downloadable resource, the method further includes:

Determining whether the downloadable resource has been tested for viruses, and when the virus detection has not been performed, downloading the downloadable resource.

Preferably, after the determining whether the downloadable resource has been tested for viruses, the method further includes:

It is determined whether the time interval between the detection date and the current time of the virus detection exceeds a set period, and when the set period is exceeded, virus detection is performed on the downloadable resource.

Preferably, the server determines whether the resource corresponding to the URL is a downloadable resource, and the monthly server determines whether the resource corresponding to the URL is a downloadable resource according to the extension of the URL or the header information of the transmission protocol response.

Preferably, the result information includes: a URL and a resource corresponding to the URL whether the virus is included.

Preferably, the result information further includes: a time for performing virus detection, a name and a version of the antivirus software used for virus detection, a name of the detected virus, a size of the downloadable resource, One or more of the message digests of the downloadable resource.

The present invention also provides an Internet virus detection system, the system comprising a server and a network terminal, wherein

The server is configured to perform virus detection on the downloadable resource corresponding to the webpage address URL, and record the result information of the virus detection; and send the result information corresponding to the URL to the network terminal according to the URL virus query request of the network terminal;

The network terminal is configured to send a URL virus query request to the server, and receive result information corresponding to the URL sent by the server.

The present invention further provides a server, where the server is configured to perform virus detection on the downloadable resource corresponding to the URL, and record the result information of the virus detection; and send the result corresponding to the URL according to the URL virus query request of the network terminal. Information to the network terminal.

The present invention further provides a network terminal, where the network terminal is configured to send a URL virus query request to the server, and receive a result message corresponding to the URL sent by the server, which is known by the server. The downloadable resource corresponding to the Uniform I Universal Resource Locator (URL) is used for virus detection, and the result information of the virus detection is recorded; and the result information corresponding to the URL is sent to the network terminal according to the URL virus query request of the network terminal. In this way, the network terminal can be configured to detect whether the resource to be downloaded contains a virus by installing an anti-virus software, and the network terminal is prevented from being infected with the virus. DRAWINGS

1 is a schematic diagram showing an implementation flow of an Internet virus detecting method according to the present invention;

FIG. 2 is a schematic flowchart of an implementation process of an Internet virus detecting method according to an embodiment of the present invention. detailed description

The invention provides a method for detecting an internet virus. As shown in FIG. 1, the method includes: Step 101: The server performs virus detection on the downloadable resource corresponding to the URL. Specifically, the server detects each URL on the Internet, and when the resource corresponding to the detected URL is a downloadable resource, the server downloads the downloadable resource corresponding to the URL, and performs virus detection on the downloadable resource; The URL is also referred to as a web page address.

Step 102: Record result information of the virus detection.

Here, the result information includes: the URL and the resource corresponding to the URL contain a virus; and may further include: a time for performing virus detection, a name and a version of the antivirus software used for virus detection, a name of the detected virus, and a downloadable One or more of the size of the resource, the message digest of the downloadable resource. The summary of the downloadable resource may be an MD5 (Message-Digest Algorithm 5) 4 message.

Step 103: Send the result information corresponding to the URL to the network terminal according to the URL virus query request of the network terminal.

Correspondingly, the user can know whether the downloadable resource to be downloaded contains a virus according to the content in the result information. If the result information indicates that the resource corresponding to the URL contains a virus, the user can abandon downloading the resource corresponding to the URL, thereby avoiding infection. .

In order to implement the above method, the present invention provides an Internet virus detection system, including a server and a network terminal;

The server is configured to perform virus detection on the downloadable resource corresponding to the URL, and record the result information of the virus detection; and send the result information corresponding to the URL to the network terminal according to the URL virus query request of the network terminal;

An embodiment of the present invention will be described in detail below.

As shown in FIG. 2, the implementation process of the Internet virus detection method in this embodiment includes the following steps: Step 201: The server determines whether the resource corresponding to the URL is a downloadable resource, and if yes, Then step 202 is performed; otherwise, step 207 is performed.

Specifically, the server uses the network crawler technology to detect each URL on the Internet, and determines whether the resource corresponding to the URL is a downloadable resource according to the header information of the transmission protocol response; or the resource corresponding to the URL may be determined according to the extension of the URL. Download resources.

Generally, the header information of the transmission protocol response indicates the type of the transmission content, and it is known whether the transmission content is a downloadable resource according to the type of the transmission content. For example, the response header information of the Hyper Text Transfer Protocol (HTTP) includes image/gif, and the image/gif indicates that the transmission content is a Gif format image, and the image resource corresponding to the detected URL is a downloadable resource. For example, the HTTP response header information includes text/html, and the text/html indicates that the transmission content is a html format page, and the page resource corresponding to the URL is a non-downloadable resource.

When the header information of the transmission protocol response does not indicate the type of the transmission content, it may be determined according to the extension of the URL whether the resource corresponding to the URL is a downloadable resource. For example, the URL is http://www.xxx.com/path/abc.mp3 , where .mp3 is the extension of the URL, and the extension indicates that the resource corresponding to the URL is a downloadable resource. In general, extensions such as .exe, .pdf, .doc, .xls, .MP3, and . apk all indicate that the resource corresponding to the URL to which they belong is a downloadable resource.

Step 202: Determine whether the downloadable resource has been tested for viruses. If yes, execute step 203; otherwise, perform step 204.

Step 203: Determine whether the time interval between the detection date of the virus detection and the current time exceeds a set period, and if yes, perform step 204; otherwise, perform step 207.

Step 204: The server downloads the downloadable resource corresponding to the URL, and performs virus detection on the downloadable resource.

Step 205: Record result information of the virus detection.

Step 206: Send result information corresponding to the URL to the network terminal according to the URL virus query request of the network terminal. Step 207, ending the current processing flow.

In addition, the server can parse the website corresponding to the URL through the URL, and according to the result of the virus detection recorded in step 205, the security status of the download resources of each website can be known.

The user can log in to the server to check the security status of the download resources of each website, so that the user can select the website to download the required resources according to the security situation. At the same time, the administrators of each website can also log in to the server to check the security status of the download resources of their websites, so as to strengthen the website management.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A method for detecting an Internet virus, characterized in that the method comprises:

The method according to claim 1, wherein before the server performs virus detection on the downloadable resource corresponding to the URL, the method further includes: the server determining whether the resource corresponding to the URL is a downloadable resource, and is downloadable When the resource is used, virus detection is performed.

The method according to claim 2, wherein the server performs virus detection on the downloadable resource corresponding to the URL, which is:

The server downloads the downloadable resource corresponding to the URL, and performs virus detection on the downloadable resource.

The method according to claim 3, wherein before the downloading the downloadable resource, the method further comprises:

The method according to claim 4, wherein, after the determining whether the downloadable resource has been subjected to virus detection, the method further comprises:

The method according to claim 2, wherein the server determines whether the resource corresponding to the URL is a downloadable resource,

The server determines whether the resource corresponding to the URL is a downloadable resource according to the extension of the URL or the header information of the transmission protocol response.

The method according to claim 1, wherein the result information comprises: a URL and a resource corresponding to the URL whether a virus is included.

The method according to claim 7, wherein the result information further comprises: a time for performing virus detection, a name and a version of the antivirus software used for virus detection, a name of the detected virus, and a downloadable resource. One or more of the message digests of size and downloadable resources.

A system for detecting an Internet virus, the system comprising a server and a network terminal, wherein

10. A server, characterized in that

The server is configured to perform virus detection on the downloadable resource corresponding to the URL, and record the result information of the virus detection; and send the result information corresponding to the URL to the network terminal according to the URL virus query request of the network terminal.

11. A network terminal, characterized in that