Method and system for quickly detecting malicious code

Abstract

The invention discloses a method and a system for quickly detecting a malicious code. The method comprises the following steps of: acquiring all files at preset detection points; performing conventional engine scanning on all the acquired files; reporting a suspicious file if the suspicious file is discovered; performing behavior pattern judgment on files at detection points for the behavior pattern judgment in all the files if the suspicious file is not discovered; and reporting the suspicious file if the suspicious file is discovered. In the method, other normal files can be prevented from being scanned and the malicious code can be quickly positioned, so that the detection speed is improved. Meanwhile, in the method, attributes of a file without a feature code can be directly judged, so data acquisition and directional analysis are performed on a special environment, and the malicious code which cannot be detected by the conventional quick scanning is detected.

Description

technical field [0001] The invention relates to malicious code detection technology, in particular to a method and system for rapidly detecting malicious codes. Background technique [0002] With the rapid development of computer technology, the capacity of the hard disk of the main storage device of the computer continues to increase, more and more software is installed by users, and the number and capacity of files in the hard disk continue to increase. [0003] Many malicious codes will copy themselves to Windows fixed and sensitive directories such as system32 and startup. Traditional conventional engines list these directories as high-risk directories and scan all files in these directories to achieve fast scanning. However, the files in this directory The vast majority of files are fine. [0004] Traditional detection technology is limited by disk IO read speed. It takes a long waiting process to fully and accurately detect viruses. Especially today, T-class hard disk...

AI Technical Summary

Problems solved by technology

[0004] Traditional detection technology is limited by disk IO read speed. It takes a long waiting process to fully and accurately detect viruses. Especially today, T-level hard disks have become mainstream storage devices, and detection speed has become the first problem that antivirus software needs to solve. the puzzle

Images