Anti-virus host product-oriented test system and test method

Abstract

The invention discloses an anti-virus host product-oriented test system. The system includes a test management module and a test execution module. The test management module includes a management and control unit, a test case library, a virus sample library, an analysis and judgment unit and a test report unit, and is used for managing test processes, test cases and virus samples, analyzing and judging test results and generating test reports. The test execution module includes a C&C server (command and control server), sandboxes, a virus monitoring server and an environment restoration unit, and is used for executing test tasks and returning test data. The invention also discloses an anti-virus host product-oriented test method at the same time. Through the system and the method, problems of low efficiency, insufficient accuracy, nonstandard processes, incomplete test contents and the like which are ubiquitous in current tests can be solved, and the test capability and efficiency are greatly improved.

Description

technical field [0001] The invention belongs to the field of network security, and relates to a test system and a test method for antivirus products facing hosts. Background technique [0002] Antivirus products are divided into two types: network antivirus products and host antivirus products. The former detects viruses by intercepting and analyzing network traffic (data packets), and the latter detects viruses by monitoring the code or behavior of viruses on the host. The present disclosure is directed to host antivirus products. [0003] Now the concept of virus is a broad concept, including all types of malicious codes such as viruses, worms, Trojan horses, bot programs, spyware and malware. A virus sample usually includes two parts: a virus sample and a control program. The former intrudes into the target host to perform various destructive activities, and the latter performs operations such as remote control and upgrade of the virus sample. Antivirus products refer t...

AI Technical Summary

Problems solved by technology

[0007] (1) Insufficient system: the test content is not comprehensive, the coverage of virus samples is insufficient in terms of type and quantity, and there is a large randomness in the selection of virus samples by testers;

[0008] (2) Low efficiency: Mainly through manual testing, the system restoration is slow and there may be leftover traces, and the testing process is uncontrollable; some advanced malicious codes can perceive the virtual machine environment, and the testing through the virtual machine may be inaccurate;

Images