System and method for judging cloud safety malicious program

Abstract

The invention discloses a system for judging a cloud safety malicious program. The system comprises a cloud terminal, a client, a virtual defending group and a station, wherein light malicious code defending software is installed on the client. A local characteristic base maintains the current prevalent malicious code information and keeps relatively stable scale, so that the performance of the client is improved. The client organizes in the form of a virtual defending group, the cloud terminal distributes malicious risk solving schemes with the virtual defending group as a unit, and group members belonging to the same virtual defending group can interact malicious code information, so that the spending of the client terminal is reduced. According to a cloud safety malicious program judging method based on the system, the working mode thereof includes an online mode and an offline mode. The online mode comprises a series of sub steps, and the client updates the local characteristic base through an extranet or an intranet. In the offline mode, the client synchronizes the local characteristic base through the intranet, and the offline safety of the client is guaranteed.

Description

technical field [0001] The invention belongs to the field of computer security, and in particular relates to a cloud security malicious program judging system and method. Background technique [0002] With the development of cloud computing, using cloud security to analyze, judge and make decisions about malicious programs is an inevitable trend in the prevention and control of malicious programs. Due to the limitations of the existing business model, the cloud of "cloud antivirus" products launched by companies such as 360 and Trending is composed of multiple detection engines of a single type, which improves the detection speed of malicious programs to a certain extent, but does not improve the detection speed. range and precision. In addition, the current cloud security system puts too much emphasis on the defense of the "cloud" composed of servers to malicious codes, while ignoring the capabilities of user terminal equipment. This route is prone to the following disadv...

AI Technical Summary

Problems solved by technology

With the continuous expansion of the scale of cloud security, on the one hand, higher requirements are bound to be placed on the malicious analysis capabilities of the cloud. Massive real-time client requests will easily lead to processing bottlenecks in the cloud; The bandwidth requirements are very high, and the existing network environment is likely to cause a bottleneck in cloud access

[0004] 2. It is not conducive to mutual notification of malicious code information between users

The client passively receives malicious code information from the cloud, so that the network life cycle of malicious code is still long, and the damage and loss caused are still relatively large

[0005] 3. It has a great impact on the performance of the client system

Once the connection with the cloud is lost (that is, offline), the client will lose immunity to the latest malicious programs, and there is no good strategy for how to ensure the security of the client computer in the offline state

Images