Method and device for detecting viruses and gateway equipment

Abstract

The embodiment provides a method and a device for detecting viruses and gateway equipment. The method comprises the steps of: obtaining attribute information to be detected for loading the application protocol of a document to be detected, and searching in a current attribute information library according to the attribute information to be detected, wherein the attribute information library comprises a suspicious attribute information library or a credible attribute information library; judging whether the document to be detected is a virus document when searching suspicious attribute information which is the same with the attribute information to be detected in the suspicious attribute information library; and judging whether the document to be detected is a safe document when searching credible attribute information which is the same with the attribute information to be detected in the credible attribute information library. The document to be detected is judged to be a virus document or not by searching in the current suspicious attribute information library according to the attribute information to be detected of the application protocol, which avoids scanning viruses to each document to be detected according to a virus library, improves the scanning performance of a gateway anti-virus method, and lowers the cost.

Description

technical field [0001] The present invention relates to the technical field of communications, in particular to a virus detection method, device and gateway equipment. Background technique [0002] With the rapid development of the network, more and more computer viruses are spreading through the network. For these viruses, especially the popular network worms in recent years, virus scanning must be performed at the gateway to filter out the viruses, so as to effectively prevent the viruses from entering the intranet and spreading. Therefore, gateway anti-virus has become one of the important measures in the future anti-virus system. [0003] Files currently scanned for viruses at the gateway are generally based on the following application protocols: HTTP, FTP, SMTP, POP3, or IMAP. The existing gateway anti-virus method is generally: first extract the file, then submit the file to the virus scanning engine for scanning, and when extracting a certain file to be detected, i...

AI Technical Summary

Problems solved by technology

[0004] The inventor found that due to the need to cache the entire file and traverse a large number of virus signatures, the scanning performance of the existing gateway anti-virus method is low. In order to improve the scanning performance, the prior art provides hardware acceleration technology. technology can improve the scanning performance of gateway antivirus methods, but the cost of hardware acceleration technology is higher

Images