CN104134039B - Checking and killing virus method, client, server and checking and killing virus system - Google Patents
Checking and killing virus method, client, server and checking and killing virus system Download PDFInfo
- Publication number
- CN104134039B CN104134039B CN201410356648.2A CN201410356648A CN104134039B CN 104134039 B CN104134039 B CN 104134039B CN 201410356648 A CN201410356648 A CN 201410356648A CN 104134039 B CN104134039 B CN 104134039B
- Authority
- CN
- China
- Prior art keywords
- checking
- virus
- file
- killing virus
- killing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/568—Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Virology (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- General Health & Medical Sciences (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Stored Programmes (AREA)
Abstract
The invention provides a kind of checking and killing virus method, client, server and checking and killing virus system.Wherein checking and killing virus method includes：Checking and killing virus client receives the checking and killing virus script issued by checking and killing virus server, and checking and killing virus script includes carrying out file to be checked the instruction of virus characteristic matching；Checking and killing virus script is compiled into the executable code matched with hardware platform where checking and killing virus client using compiler preset in checking and killing virus client；Checking and killing virus is carried out to file to be checked by checking and killing virus client call executable code.Unified checking and killing virus script is issued using the checking and killing virus method, preset compiler is compiled into corresponding executable code in checking and killing virus client, corresponding checking and killing virus flow is carried out, the efficiency of checking and killing virus is improved, the operating pressure of checking and killing virus server is alleviated.
Description
Technical field
The present invention relates to computer safety field, more particularly to a kind of checking and killing virus method, client, server and
Checking and killing virus system.
Background technology
With the development of internet, the computer rogue program such as computer virus, worm, trojan horse program popular cycle
Shorter and shorter, substantial amounts of viral and all kinds of malicious files seriously endanger the safety of user.With the continuous renewal and change of virus,
Checking and killing virus client is also required to upgrade in time its checking and killing virus engine and virus characteristic storehouse.
In existing checking and killing virus method, when finding new virus, it is necessary to which checking and killing virus service side provider is for new
Virus, extract virus characteristic, and the virus characteristic is added in virus base, be handed down to checking and killing virus client.If
When the matching of the virus characteristic can not be performed by current antivirus engine, it is necessary to increase the algorithm of antivirus engine.Now not only
Need to update virus base, also need to update killing engine.This both provides very big fiber crops to user and killing bogusware provider
It is tired, and waste substantial amounts of time and efforts.
And because hardware platform used in user is different, such as including Intel 32,64 bit platforms, ARM frameworks
Platform, reduced instruction set computer architecture platform, checking and killing virus attendant is after the design of checking and killing virus logic is completed, in addition it is also necessary to will look into
Algorithm correspondence killing code compilation is killed into the corresponding executable code of different platform, destination client is handed down to, so as to target
Client interpretation is performed, and adds workload.And checking and killing virus client is performed to killing code interpreter, killing speed is slow,
Also it have impact on checking and killing virus efficiency.
The content of the invention
In view of the above problems, it is proposed that the present invention so as to provide one kind overcome above mentioned problem or at least in part solve on
State the checking and killing virus client and checking and killing virus server and corresponding checking and killing virus method of problem.
The present invention one is further objective is that improve the efficiency of checking and killing virus.
The present invention another further objective is that to reduce the pressure of checking and killing virus server.
According to one aspect of the present invention, there is provided a kind of checking and killing virus method.The checking and killing virus method includes：Virus is looked into
Kill client and receive the checking and killing virus script issued by checking and killing virus server, checking and killing virus script includes carrying out file to be checked
The instruction of virus characteristic matching；Checking and killing virus script is compiled into and virus using compiler preset in checking and killing virus client
The executable code of hardware platform matching where killing client；By checking and killing virus client call executable code to text to be checked
Part carries out checking and killing virus.
Alternatively, checking and killing virus script is compiled into and checking and killing virus using compiler preset in checking and killing virus client
The executable code of hardware platform matching includes where client：Preset compiler looks into virus in checking and killing virus client
Kill script and be compiled into file destination, and file destination is linked into and holding that hardware platform where checking and killing virus client is matched
Line code.
Alternatively, carrying out checking and killing virus to file to be checked by checking and killing virus client call executable code includes：Obtain
File to be checked；Recognize the file format of file to be checked；According to the data structure of File Format Analysis file to be checked；By checking and killing virus
Client call executable code carries out checking and killing virus to data structure.
Alternatively, checking and killing virus is carried out to file to be checked to data structure by checking and killing virus client call executable code
Including：The data for extracting ad-hoc location in data structure according to the arithmetic logic of executable code by checking and killing virus client are special
Levy；Judge whether data characteristics meets the viral decision condition in executable code；If so, determining that file to be checked includes virus.
Alternatively, it is determined that file to be checked comprising virus after also include：The option of operation handled virus is exported,
And file to be checked is handled according to the operation to option of operation.
Alternatively, obtaining file to be checked includes：Receive by user to file type or the selection operation of file storage catalogue；
Extract the file belonged under file type or file storage catalogue.
Alternatively, recognize that the file format of file to be checked includes：Extract the suffix filename of file to be checked；Composed an essay after
Part name determines the file format of file to be checked.
Alternatively, checking and killing virus script is compiled into and looked into virus by compiler preset in using checking and killing virus client
Also include after the executable code of hardware platform matching where killing client：Executable code is preserved to local virus library
In.
According to another aspect of the present invention, a kind of checking and killing virus client is additionally provided.The checking and killing virus client bag
Include：Receiver, is configured to receive the checking and killing virus script issued by checking and killing virus server, checking and killing virus script is included to be checked
File carries out the instruction of virus characteristic matching；Compiler, is configured to checking and killing virus script being compiled into and checking and killing virus client
The executable code of place hardware platform matching；Killing device, is configured to call executable code to look into file to be checked progress virus
Kill.
Alternatively, compiler includes：Collector, is configured to checking and killing virus script being compiled into file destination；Link mould
Block, is configured to being linked into file destination into the executable code matched with hardware platform where checking and killing virus client.
Alternatively, killing device includes：Acquisition module, is configured to obtain file to be checked；Identification module, is configured to identification to be checked
The file format of file；Parsing module, is configured to the data structure according to File Format Analysis file to be checked；Performing module, matches somebody with somebody
It is set to and calls executable code to carry out checking and killing virus to data structure.
Alternatively, performing module is additionally configured to：Certain bits in data structure are extracted according to the arithmetic logic of executable code
The data characteristics put；Judge whether data characteristics meets the viral decision condition in executable code；If so, determining file to be checked
Include virus.
Alternatively, killing device also includes：Virus treated module, is configured as output to the option of operation handled virus,
And file to be checked is handled according to the operation to option of operation.
Alternatively, acquisition module is additionally configured to：Receive by user to file type or the selection operation of file storage catalogue；
Extract the file belonged under file type or file storage catalogue.
Alternatively, identification module is additionally configured to；Extract the suffix filename of file to be checked；Determined to treat according to suffix filename
Look into the file format of file.
Alternatively, above-mentioned checking and killing virus client also includes：Memory, is configured to preserve executable code to local disease
In malicious storehouse.
According to another aspect of the present invention, a kind of checking and killing virus method is additionally provided.The checking and killing virus method includes：Root
The instruction that virus characteristic matching is carried out to file to be checked is generated according to virus characteristic, and the set of instruction is written as checking and killing virus pin
This；Issue checking and killing virus script to checking and killing virus client, for checking and killing virus client by checking and killing virus script be compiled into
The executable code of hardware platform matching where checking and killing virus client, and call executable code to carry out checking and killing virus.
Alternatively, the set of instruction is being written as after checking and killing virus script also to include：Checking and killing virus script is carried out
Debugging checking.
Alternatively, also include before the instruction to file to be checked progress virus characteristic matching is generated according to virus characteristic：
Obtain virus document sample；Virus characteristic is extracted from virus document sample.
According to another aspect of the present invention, a kind of checking and killing virus server is additionally provided.The checking and killing virus server bag
Include：Script generation module, is configured to generate the instruction for carrying out file to be checked virus characteristic matching according to virus characteristic, and will refer to
The set of order is written as checking and killing virus script；Script issues module, is configured to issue checking and killing virus pin to checking and killing virus client
This, for checking and killing virus client by checking and killing virus script be compiled into checking and killing virus client where hardware platform match can
Code is performed, and calls executable code to carry out checking and killing virus.
Alternatively, the checking and killing virus server that the present invention is provided also includes：Debugging module, is configured to checking and killing virus script
Carry out debugging checking.
Alternatively, the checking and killing virus server that the present invention is provided also includes：Virus characteristic extraction module, is configured to obtain disease
Malicious paper sample, and extract virus characteristic from virus document sample.
According to another aspect of the present invention, a kind of checking and killing virus system is additionally provided.The checking and killing virus system includes：With
Any checking and killing virus client of upper introduction；And any checking and killing virus server described above.
The checking and killing virus method of the present invention issues unified checking and killing virus script, the preset volume in checking and killing virus client
Translate device and be compiled into corresponding executable code, corresponding virus is issued for different platform compared in checking and killing virus server
Feature database and checking and killing virus engine, the data volume issued are small, significantly reduce the operating pressure of checking and killing virus server, processing effect
Rate is higher.
Further, checking and killing virus client of the invention carries out checking and killing virus using the code after compiling, compared to existing
Some code interpreter executive modes, substantially increase checking and killing virus efficiency.
Described above is only the general introduction of technical solution of the present invention, in order to better understand the technological means of the present invention,
And can be practiced according to the content of specification, and in order to allow above and other objects of the present invention, feature and advantage can
Become apparent, below especially exemplified by the embodiment of the present invention.
According to the accompanying drawings to the detailed description of the specific embodiment of the invention, those skilled in the art will be brighter
Above-mentioned and other purposes, the advantages and features of the present invention.
Brief description of the drawings
By reading the detailed description of hereafter preferred embodiment, various other advantages and benefit is common for this area
Technical staff will be clear understanding.Accompanying drawing is only used for showing the purpose of preferred embodiment, and is not considered as to the present invention
Limitation.And in whole accompanying drawing, identical part is denoted by the same reference numerals.In the accompanying drawings：
Fig. 1 is the schematic diagram of checking and killing virus system according to an embodiment of the invention；
Fig. 2 is the schematic diagram of checking and killing virus client according to an embodiment of the invention；
Fig. 3 is the schematic diagram of checking and killing virus server according to an embodiment of the invention；
Fig. 4 is a kind of schematic diagram of checking and killing virus method according to an embodiment of the invention；And
Fig. 5 is the schematic diagram of another checking and killing virus method according to an embodiment of the invention.
Embodiment
Algorithm and display be not inherently related to any certain computer, virtual system or miscellaneous equipment provided herein.
Various general-purpose systems can also be used together with based on teaching in this.As described above, construct required by this kind of system
Structure be obvious.In addition, the present invention is not also directed to any certain programmed language.It is understood that, it is possible to use it is various
Programming language realizes the content of invention described herein, and the description done above to language-specific is to disclose this hair
Bright preferred forms.
Fig. 1 is the schematic diagram of checking and killing virus system according to an embodiment of the invention, and the checking and killing virus system includes：Extremely
The checking and killing virus server 200 that a few checking and killing virus client 100 is connected by network data therewith.Checking and killing virus server
The checking and killing virus script write according to newfound virus characteristic is handed down to checking and killing virus client 100 by 200, by checking and killing virus
Preset compiler, which is compiled into executable code, in client 100 is used for checking and killing virus.
Different from checking and killing virus system of the prior art, checking and killing virus server 200 is handed down to the virus of different platform
The script of killing client 100 is identical, i.e., what general code (code for for example meeting C or C Plus Plus rule) was write
Checking and killing virus script, the executable code for being compiled into matching by checking and killing virus client 100 carries out checking and killing virus, is looked into without virus
Kill server 200, into different versions, will reduce checking and killing virus for same viral killing logic identical code compilation
The pressure of server 200, while the response speed to virus is improved, and due to 100 pairs of antivirus pin of checking and killing virus client
This is compiled, and is performed compared to explaining, faster, killing is more efficient for speed.
Fig. 2 and Fig. 3 are checking and killing virus client 100 according to an embodiment of the invention and checking and killing virus server respectively
200 schematic diagram；Wherein, the checking and killing virus client 100 of the embodiment of the present invention can include in general manner：Receiver 110, volume
Device 120, killing device 130 are translated, the checking and killing virus server 200 of the embodiment of the present invention can include in general manner：Script generates mould
Block 210, script issue module 220, in some preferred embodiments, and the checking and killing virus client 100 of the embodiment of the present invention is also
It can increase and be provided with memory 140, a kind of alternative construction of compiler 110 is to include：Collector 122 and link module
124, a kind of alternative construction of killing device 130 is to include：Acquisition module 131, identification module 132, parsing module 133, execution mould
Block 134, virus treated module 135.The checking and killing virus server 200 of the embodiment of the present invention, which can also increase, is provided with debugging module
230 and virus characteristic extraction module 240.Part in above checking and killing virus client 100 and checking and killing virus server 200 can be with
The function and specifically used environment needed to have according to embodiment is flexibly configured, may not necessarily in some alternative embodiments
Possesses above all of part.
In the checking and killing virus client 100 of the present embodiment, receiver 110 can be received to be issued by checking and killing virus server
Checking and killing virus script, the checking and killing virus script include to file to be checked carry out virus characteristic matching instruction, these instructions can
To be generated using the general code of multiple hardware platforms according to virus characteristic, for example the checking and killing virus script can be looked into as needed
The viral feature killed is write according to general language rule (such as C and C++), and this kind of checking and killing virus script can spirit
The executable code that different platform can be performed is compiled into livingly.
Compiler 120 checking and killing virus script can be compiled into checking and killing virus client where hardware platform match can
Perform code.Compiling is from source code (being usually high-level language) to the object code that directly can be performed by computer or virtual machine
The translation process of (being usually low-level language or machine language).For different hardware platform or operating system, it can perform
Object code be different, common processor architectures include x86 frameworks (16,32,64 can be subdivided into again), simplify
Instruction set architecture (RISC), is made a distinction according to operating system, and Windows, Linux, Android, and same system can be divided into again
The operating system of row, the executable code of the operating system of different editions is also distinguishing.Face largely in the prior art not
Congener system and platform waste substantial amounts of resource, it is necessary to issue different feature database or killing program respectively.In this reality
In the checking and killing virus client 100 for applying example, compiler 120 is arranged at client-side, it is only necessary to which unified script is compiled into symbol
The object code itself needed is closed, the pressure of server side is substantially reduced.
Compiler 120 can specifically include：Collector 122 and link module 124, wherein collector checking and killing virus pin
Originally it is compiled into file destination；File destination is linked into and matched with hardware platform where checking and killing virus client by link module 124
Executable code.In general, source code needs to be processed as object code (object by compiling (compiler)
Code), then also need to be converted to executable program (executables) by linking (linker), could be by hardware device
Perform.Namely high level language into processing of the script Jing Guo collector 122, be compiled into common intermediate language (MSIL/
The additional storehouse of object code is linked as an executable file by target byte code (Byte Code) CIL), link module 124,
For checking and killing virus.Link module 124 is needed to parse undefined symbolic reference, and the placeholder in file destination is replaced with into symbol
Number address.
Killing device 130 calls executable code to carry out checking and killing virus to file to be checked.Wherein acquisition module 131 is configured to obtain
File to be checked is taken, for example, is received by user to file type or the selection operation of file storage catalogue；Extraction belongs to file type
Or the file under file storage catalogue；Identification module 132 recognizes the file format of file to be checked, for example, extract file to be checked
Suffix filename；The file format of file to be checked is determined according to suffix filename；Parsing module 133 is configured to according to file format
Parse the data structure of file to be checked；Performing module 134 is configured to call executable code to carry out checking and killing virus to data structure.
A kind of killing flow of performing module 134 is：Arithmetic logic according to executable code extracts special in data structure
Position the data characteristics put；Judge whether data characteristics meets the viral decision condition in executable code；If so, determining to be checked
File includes virus.The data characteristics specified location for example parsed in parsing module 131 finds out offset, then by skew
The data characteristics of new position is calculated, this feature is compared with Virus Sample feature.When the one or more features of appearance
Matching is compared just it is considered that this document has the virus of killing.
The killing object of killing device 130 can be transplantable execution body (Portable Execute, abbreviation PE file),
Can also be non-PE files.For PE files, file instruction sequence is obtained by parsing module 131, function name, export letter is imported
The data structure features such as several and character visible string, using above command sequence, import function name, export function name and visible word
One or more of symbol string is matched.The file of different file formats can be set for non-PE files in performing environment
Object, wherein the file format that can be set include but is not limited to Doc, xml, ppt, pdf, swf, Apk, Bat, ini, vbs,
js.For different file formats, it is possible to use corresponding performing environment carries out parsing and feature extraction matching, completes virus
Killing.
Executable code is called to carry out checking and killing virus to data structure in performing module 134, confirmation has file and pacified
After full problem, virus treated module 135 exports the option of operation handled virus, and according to the operation pair to option of operation
File to be checked is handled.Option of operation can include：Delete, isolate, ignore, selected by user, or in user
When not selected, the operation given tacit consent to.
Memory 140 can also preserve executable code into local virus library, be operated for follow-up checking and killing virus.
In the checking and killing virus server 200 of the present embodiment, script generation module 210 is generated to be checked according to virus characteristic
File carries out the instruction of virus characteristic matching, and the set of instruction is written as into checking and killing virus script, that is, using multiple hard
The general code command of part platform generates checking and killing virus script according to virus characteristic.Checking and killing virus server 200 intercepting or
Person, which receives, to be uploaded after new Virus Sample, and virus characteristic is extracted by analysis, checking and killing virus is generated by script generation module
Script.Script issues module 220 to issue checking and killing virus script to checking and killing virus client 100, for checking and killing virus client
100 are compiled into checking and killing virus script the executable code matched with the place hardware platform of checking and killing virus client 100, and call
Executable code carries out checking and killing virus to file to be checked.Checking and killing virus server 200 just can be straight in completion checking and killing virus script
Connect the checking and killing virus client 100 for issuing different platform, compared to prior art, for new samples reaction speed faster, place
Reason is more efficient.
, can also be using debugging module 230 to checking and killing virus pin after the generation checking and killing virus script of script generation module 210
This progress debugging checking, has confirmed that the validity of checking and killing virus script, sets different running environment compiling checking and killing virus scripts
And perform, confirm its killing validity to test sample.
The virus characteristic that script generation module 210 is used can be extracted by virus characteristic extraction module 240, specifically
Ground, virus characteristic extraction module 240 can obtain virus document sample, and analysis extracts viral spy from virus document sample
Levy.The method that virus characteristic extraction module 240 obtains virus document sample can use various ways, for example, intercept network transmission
File, receive the apocrypha that checking and killing virus client 100 is uploaded, the present embodiment is without limitation.
The checking and killing virus system of the embodiment of the present invention, compared to existing mode, checking and killing virus server 200 is sick by identical
Malicious killing script is handed down to the checking and killing virus client 100 of different platform, by the Complied executing of checking and killing virus client 100, improves
Checking and killing virus server 200 improves killing efficiency to the reaction speed of new discovery virus.
The embodiment of the present invention additionally provides checking and killing virus method, can be respectively by any checking and killing virus visitor described above
Family end 100 and checking and killing virus server 200 are performed.To improve checking and killing virus efficiency, Fig. 4 and Fig. 5 are according to the present invention one respectively
The schematic diagram of two kinds of checking and killing virus methods of individual embodiment, wherein in checking and killing virus server side, checking and killing virus method includes：
Step S402, the instruction that virus characteristic matching is carried out to file to be checked is generated according to virus characteristic, and by instruction
Set is written as checking and killing virus script；
Step S404, checking and killing virus script is issued to checking and killing virus client.The checking and killing virus script issued is available for virus
Checking and killing virus script is compiled into the executable code matched with hardware platform where checking and killing virus client by killing client, and
Executable code is called to carry out checking and killing virus to file to be checked.
Virus document sample can also be obtained in several ways before step S402；Extracted from virus document sample
Go out virus characteristic, be used as the basis of generation checking and killing virus script.Various ways can be used by obtaining the method for virus document sample,
Such as intercepting the file of network transmission, receive the apocrypha that checking and killing virus client 100 is uploaded.
In addition after step S402 completes checking and killing virus script, debugging checking can also be carried out to checking and killing virus script.Adjust
Testing card can be perfect to the progress of checking and killing virus script, it is ensured that its reliability and validity, for example, put different running environment and compile
Translate checking and killing virus script and perform, confirm its killing validity to test sample, and it is timely when effect goes wrong testing
Modify.
A kind of optional flow carried out the following is malicious killing server after new Virus Sample is found：Receive what is uploaded
Apocrypha, checking and killing virus engineer confirms to include new virus characteristic in apocrypha, and needs to existing virus characteristic
Storehouse is modified, now, and corresponding killing algorithm is specified according to the feature of the new virus, according to the generation of killing algorithm to text to be checked
Part carries out the instruction of virus characteristic matching, is then combined these instructions and is written as checking and killing virus script, so that the virus
Killing script can be performed to the virus characteristic killing algorithm.Multiple tune can be carried out in the process of generation checking and killing virus script
Experiment card, until confirming that the antivirus script can carry out killing to the virus exactly, killing effect reaches requirement.Then this is killed
Malicious script is handed down to various checking and killing virus clients.
Wherein in client-side, checking and killing virus method includes：
Step S502, checking and killing virus client receives the checking and killing virus script issued by checking and killing virus server；
Checking and killing virus script, is compiled into and is looked into virus by step S504 using compiler preset in checking and killing virus client
The executable code of hardware platform matching where killing client；
Step S506, checking and killing virus is carried out by checking and killing virus client call executable code to file to be checked.
Above checking and killing virus script includes carrying out file to be checked the instruction of virus characteristic matching, for example, can be looked into by virus
Server is killed to be generated according to virus characteristic using the general instruction code of multiple hardware platforms.Such as checking and killing virus script can be with
The viral feature of killing as needed is write according to general language rule (such as C and C++), this kind of checking and killing virus
Script can neatly be compiled into the executable code that different platform can be performed.For example in script can using arithmetical operation,
Logic judgment, skip instruction, Do statement, compare the basic instruction set such as sentence and complete extraction and comparison to virus characteristic.
A kind of step S504 compiling flow can be：Preset compiler looks into virus in checking and killing virus client
Kill script and be compiled into file destination, and file destination is linked into and holding that hardware platform where checking and killing virus client is matched
Line code.The code of checking and killing virus script needs to be processed as object code (object code) by compiling (compiler), passes through
Cross link (linker) and be converted to and the file that killing user specifies is performed after executable program (executables).In compiling
During script can also be checked, report raising reliability in time for the grammar issue occurred in script.
A kind of step S506 killing flow includes：Obtain file to be checked；Recognize the file format of file to be checked；According to text
The data structure of part format analysis file to be checked；Virus is carried out to data structure by checking and killing virus client call executable code
Killing.Wherein, file to be checked can be the file under the file type or specified address that user specify, for example, receive by user couple
The selection operation of file type or file storage catalogue；Extract the file belonged under file type or file storage catalogue.Know
The file format of other file can be determined by the suffix name of file, for example, extract the suffix filename of file to be checked；According to rear
Sew the file format that filename determines file to be checked.
Checking and killing virus is carried out by checking and killing virus client call executable code to data structure to be specifically as follows：By virus
Killing client extracts the data characteristics of ad-hoc location in data structure according to the arithmetic logic of executable code；Judge that data are special
Levy the viral decision condition whether met in executable code；If so, determining that file to be checked includes virus.It is determined that file to be checked
Comprising can also be exported after virus to the option of operation that is handled of virus, and according to the operation to option of operation to text to be checked
Part is handled.Keyword, feature program section content, virus characteristic and spread path, text such as in computer virus
The change of part length, on the basis of tagsort carry out detection work, or some file or data segment are tested and
Calculate and preserve its result and then this document or data segment are tested with the presence or absence of virus characteristic etc. according to the result of preservation.
Killing object can be transplantable execution body (Portable Execute, abbreviation PE file), or non-
PE files.For PE files, file instruction sequence can be obtained after parsing, function name, export function name and visible word is imported
The data structure features such as symbol string, utilize one in above command sequence, importing function name, export function name and character visible string
Or multiple matched.For non-PE files, the file object for different file formats can be set in performing environment, its
In the file format that can set include but is not limited to Doc, xml, ppt, pdf, swf, Apk, Bat, ini, vbs, js.For not
Same file format, it is possible to use corresponding performing environment carries out parsing and feature extraction matching, the killing of completion virus.
After confirming that there is file safety problem occurs, exporting can include to the option of operation that virus is handled：Delete
Remove, isolate, ignore, above option is selected by user, or when user is not selected, the operation given tacit consent to.
After killing is completed, the executable code after can also checking and killing virus script be compiled is preserved to local virus library
In, it is directly loaded into and calls in subsequent startup initialization for checking and killing virus engine.
Step S506 killings flow can utilize the executable program calls application interface for having checking and killing virus script
(Application Program Interface, abbreviation API) is completed, such as is called file operation api function, buffering area
Decode api function, and for file format special API function such as：Api function at MZ files, PE file process API letters
Number, OLE file process api function, boot section processing api function etc..By calling those file operation api functions, carry out
Following file operation, such as creates, deletes, replicates, searches, calls, refreshes, reads.
File operation, internal memory operation etc. are carried out using API.Following file operation is for example carried out, such as creates, delete, again
Make, search, call, refresh, read.
The checking and killing virus method of the present invention issues checking and killing virus script by checking and killing virus client Complied executing, checking and killing virus
Script is unrelated with hardware and operating system platform, reduces the debugging process of a large amount of different platforms, reduce virus treated when
Between, improve efficiency.
Checking and killing virus script is compiled into corresponding executable code by preset compiler in checking and killing virus client, is compared
In prior art, the data volume issued is small, checking and killing virus efficiency high.
In the specification that this place is provided, numerous specific details are set forth.It is to be appreciated, however, that the implementation of the present invention
Example can be put into practice in the case of these no details.In some instances, known method, structure is not been shown in detail
And technology, so as not to obscure the understanding of this description.
Similarly, it will be appreciated that in order to simplify the disclosure and help to understand one or more of each inventive aspect, exist
Above in the description of the exemplary embodiment of the present invention, each feature of the invention is grouped together into single implementation sometimes
In example, figure or descriptions thereof.However, the method for the disclosure should be construed to reflect following intention：It is i.e. required to protect
The application claims of shield features more more than the feature being expressly recited in each claim.More precisely, such as following
Claims reflect as, inventive aspect is all features less than single embodiment disclosed above.Therefore,
Thus the claims for following embodiment are expressly incorporated in the embodiment, wherein each claim is in itself
All as the separate embodiments of the present invention.
Those skilled in the art, which are appreciated that, to be carried out adaptively to the module in the equipment in embodiment
Change and they are arranged in one or more equipment different from the embodiment.Can be the module or list in embodiment
Member or component be combined into a module or unit or component, and can be divided into addition multiple submodule or subelement or
Sub-component.In addition at least some in such feature and/or process or unit exclude each other, it can use any
Combination is disclosed to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so to appoint
Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (including adjoint power
Profit is required, summary and accompanying drawing) disclosed in each feature can or similar purpose identical, equivalent by offer alternative features come generation
Replace.
Although in addition, it will be appreciated by those of skill in the art that some embodiments described herein include other embodiments
In included some features rather than further feature, but the combination of the feature of be the same as Example does not mean in of the invention
Within the scope of and form different embodiments.For example, in detail in the claims, embodiment claimed it is one of any
Mode it can use in any combination.
The present invention all parts embodiment can be realized with hardware, or with one or more processor run
Software module realize, or realized with combinations thereof.It will be understood by those of skill in the art that can use in practice
Microprocessor or digital signal processor (DSP) realize that checking and killing virus client according to embodiments of the present invention and virus are looked into
Kill some or all functions of some or all parts in server.The present invention is also implemented as being used to perform here
The some or all equipment or program of device of described method are (for example, computer program and computer program production
Product).Such program for realizing the present invention can be stored on a computer-readable medium, or can have one or more
The form of signal.Such signal can be downloaded from internet website and obtained, and either be provided or on carrier signal to appoint
What other forms is provided.
It should be noted that the present invention will be described rather than limits the invention for above-described embodiment, and ability
Field technique personnel can design alternative embodiment without departing from the scope of the appended claims.In the claims,
Any reference symbol between bracket should not be configured to limitations on claims.Word "comprising" is not excluded the presence of not
Element or step listed in the claims.Word "a" or "an" before element does not exclude the presence of multiple such
Element.The present invention can be by means of including the hardware of some different elements and coming real by means of properly programmed computer
It is existing.In if the unit claim of equipment for drying is listed, several in these devices can be by same hardware branch
To embody.The use of word first, second, and third does not indicate that any order.These words can be explained and run after fame
Claim.
So far, although those skilled in the art will appreciate that detailed herein have shown and described multiple showing for the present invention
Example property embodiment, still, still can be direct according to present disclosure without departing from the spirit and scope of the present invention
It is determined that or deriving many other variations or modifications for meeting the principle of the invention.Therefore, the scope of the present invention is understood that and recognized
It is set to and covers other all these variations or modifications.
The embodiments of the invention provide a kind of checking and killing virus methods of A1., including：
Checking and killing virus client receives the checking and killing virus script issued by checking and killing virus server, the checking and killing virus script
Instruction including carrying out virus characteristic matching to file to be checked；
The checking and killing virus script is compiled into using compiler preset in checking and killing virus client and looked into the virus
The executable code of hardware platform matching where killing client；
Executable code carries out checking and killing virus to the file to be checked as described in the checking and killing virus client call.
A2. the method according to A1, wherein, the virus is looked into using compiler preset in checking and killing virus client
Killing script and being compiled into includes with the executable code that matches of hardware platform where the checking and killing virus client：
The checking and killing virus script is compiled into file destination by preset compiler in the checking and killing virus client, and
The file destination is linked into the executable code matched with hardware platform where the checking and killing virus client.
A3. the method according to A1, wherein, executable code is to described as described in the checking and killing virus client call
File to be checked, which carries out checking and killing virus, to be included：
Obtain the file to be checked；
Recognize the file format of the file to be checked；
According to the data structure of file to be checked described in the File Format Analysis；
Executable code carries out checking and killing virus to the data structure as described in the checking and killing virus client call.
A4. the method according to A3, wherein, executable code is to described as described in the checking and killing virus client call
Data structure, which carries out checking and killing virus, to be included：
Extract special in the data structure according to the arithmetic logic of the executable code by the checking and killing virus client
Position the data characteristics put；
Judge whether the data characteristics meets the viral decision condition in the executable code；
If so, determining that the file to be checked includes virus.
A5. the method according to A4, wherein, it is determined that the file to be checked comprising virus after also include：
The option of operation handled virus is exported, and according to the operation to the option of operation to the file to be checked
Handled.
A6. the method according to any one of A3 to A5, wherein, obtaining the file to be checked includes：
Receive by user to file type or the selection operation of file storage catalogue；
Extract the file belonged under the file type or the file storage catalogue.
A7. the method according to any one of A3 to A6, wherein, recognizing the file format of the file to be checked includes：
Extract the suffix filename of the file to be checked；
The file format of the file to be checked is determined according to the suffix filename.
A8. the method according to any one of A1 to A7, wherein, using compiling preset in checking and killing virus client
Device by the checking and killing virus script be compiled into the executable code that matches of hardware platform where the checking and killing virus client it
Also include afterwards：
The executable code is preserved into local virus library.
The embodiment of the present invention additionally provides a kind of checking and killing virus clients of B9., including：
Receiver, is configured to receive the checking and killing virus script issued by checking and killing virus server, the checking and killing virus script
Instruction including carrying out virus characteristic matching to file to be checked；
Compiler, is configured to the checking and killing virus script being compiled into and hardware platform where the checking and killing virus client
The executable code of matching；
Killing device, is configured to call the executable code to carry out checking and killing virus to the file to be checked.
B10. the client according to B9, wherein, the compiler includes：
Collector, is configured to the checking and killing virus script being compiled into file destination；
Link module, is configured to the file destination being linked into and hardware platform where the checking and killing virus client
The executable code matched somebody with somebody.
B11. the client according to B9, wherein, the killing device includes：
Acquisition module, is configured to obtain the file to be checked；
Identification module, is configured to recognize the file format of the file to be checked；
Parsing module, is configured to the data structure according to file to be checked described in the File Format Analysis；
Performing module, is configured to call the executable code to carry out checking and killing virus to the data structure.
B12. the client according to B11, wherein, the performing module is additionally configured to：
The data characteristics of ad-hoc location in the data structure is extracted according to the arithmetic logic of the executable code；
Judge whether the data characteristics meets the viral decision condition in the executable code；
If so, determining that the file to be checked includes virus.
B13. the client according to B12, wherein, killing device also includes：
Virus treated module, is configured as output to the option of operation handled virus, and according to the option of operation
Operation the file to be checked is handled.
B14. the client according to any one of B11 to B13, the acquisition module is additionally configured to：
Receive by user to file type or the selection operation of file storage catalogue；
Extract the file belonged under the file type or the file storage catalogue.
B15. the client according to any one of B11 to B14, wherein, the identification module is additionally configured to；
Extract the suffix filename of the file to be checked；
The file format of the file to be checked is determined according to the suffix filename.
B16. the client according to any one of B9 to B15, in addition to：
Memory, is configured to preserve the executable code into local virus library.
The embodiment of the present invention additionally provides a kind of checking and killing virus methods of C17., including：
The instruction that virus characteristic matching is carried out to file to be checked is generated according to virus characteristic, and the collection of the instruction is compiled in collaboration with
It is written as checking and killing virus script；
The checking and killing virus script is issued to checking and killing virus client, so that the checking and killing virus client is by the virus
Killing script be compiled into the executable code that match of hardware platform where the checking and killing virus client, and can hold described in calling
Line code carries out checking and killing virus to the file to be checked.
C18. the method according to C17, wherein, after the set of the instruction to be written as to checking and killing virus script also
Including：
Debugging checking is carried out to the checking and killing virus script.
C19. the method according to C17 or C18, wherein, virus is being carried out to file to be checked according to virus characteristic generation
Also include before the instruction of characteristic matching：
Obtain virus document sample；
The virus characteristic is extracted from the virus document sample.
The embodiment of the present invention additionally provides a kind of checking and killing virus servers of D20., including：
Script generation module, is configured to generate the instruction for carrying out file to be checked virus characteristic matching according to virus characteristic,
And the set of the instruction is written as checking and killing virus script；
Script issues module, is configured to issue the checking and killing virus script to checking and killing virus client, for the virus
The checking and killing virus script is compiled into and holding that hardware platform where the checking and killing virus client is matched by killing client
Line code, and call the executable code to carry out checking and killing virus to the file to be checked.
D21. the server according to D20, in addition to：
Debugging module, is configured to carry out debugging checking to the checking and killing virus script.
D22. the server according to D20 or D21, in addition to：
Virus characteristic extraction module, is configured to obtain virus document sample, and extract from the virus document sample
The virus characteristic.
The embodiment of the present invention additionally provides a kind of checking and killing virus systems of E23., including：
Checking and killing virus client according to any one of B9 to B15；
Checking and killing virus server according to any one of D20 to D22.
Claims (21)
1. a kind of checking and killing virus method, comprises the following steps：
Checking and killing virus client receives the checking and killing virus script issued by checking and killing virus server, and the checking and killing virus script includes
The instruction of virus characteristic matching is carried out to file to be checked；
The checking and killing virus script is compiled and linked into and the virus using compiler preset in checking and killing virus client
The executable code of hardware platform matching where killing client, the step includes：It is preset in the checking and killing virus client
Compiler the checking and killing virus script is compiled into file destination, and the file destination is linked into and the checking and killing virus
The executable code of hardware platform matching where client；
Executable code carries out checking and killing virus to the file to be checked as described in the checking and killing virus client call.
2. according to the method described in claim 1, wherein, executable code is to institute as described in the checking and killing virus client call
Stating file progress checking and killing virus to be checked includes：
Obtain the file to be checked；
Recognize the file format of the file to be checked；
According to the data structure of file to be checked described in the File Format Analysis；
Executable code carries out checking and killing virus to the data structure as described in the checking and killing virus client call.
3. method according to claim 2, wherein, executable code is to institute as described in the checking and killing virus client call
Stating data structure progress checking and killing virus includes：
By the checking and killing virus client certain bits in the data structure are extracted according to the arithmetic logic of the executable code
The data characteristics put；
Judge whether the data characteristics meets the viral decision condition in the executable code；
If so, determining that the file to be checked includes virus.
4. method according to claim 3, wherein, it is determined that the file to be checked comprising virus after also include：
The option of operation handled virus is exported, and the file to be checked is carried out according to the operation to the option of operation
Processing.
5. the method according to any one of claim 2 to 4, wherein, obtaining the file to be checked includes：
Receive by user to file type or the selection operation of file storage catalogue；
Extract the file belonged under the file type or the file storage catalogue.
6. the method according to any one of claim 2 to 4, wherein, recognizing the file format of the file to be checked includes：
Extract the suffix filename of the file to be checked；
The file format of the file to be checked is determined according to the suffix filename.
7. method according to any one of claim 1 to 4, wherein, using volume preset in checking and killing virus client
Translate device and the checking and killing virus script is compiled into the executable code matched with hardware platform where the checking and killing virus client
Also include afterwards：
The executable code is preserved into local virus library.
8. a kind of checking and killing virus client, including：
Receiver, is configured to receive the checking and killing virus script issued by checking and killing virus server, the checking and killing virus script includes
The instruction of virus characteristic matching is carried out to file to be checked；
Compiler, is configured to be compiled and linked into the checking and killing virus script to put down with hardware where the checking and killing virus client
The executable code of platform matching, and the compiler includes：Collector, is configured to the checking and killing virus script being compiled into
File destination, link module is configured to the file destination being linked into and hardware platform where the checking and killing virus client
The executable code of matching；
Killing device, is configured to call the executable code to carry out checking and killing virus to the file to be checked.
9. client according to claim 8, wherein, the killing device includes：
Acquisition module, is configured to obtain the file to be checked；
Identification module, is configured to recognize the file format of the file to be checked；
Parsing module, is configured to the data structure according to file to be checked described in the File Format Analysis；
Performing module, is configured to call the executable code to carry out checking and killing virus to the data structure.
10. client according to claim 9, wherein, the performing module is additionally configured to：
The data characteristics of ad-hoc location in the data structure is extracted according to the arithmetic logic of the executable code；
Judge whether the data characteristics meets the viral decision condition in the executable code；
If so, determining that the file to be checked includes virus.
11. client according to claim 10, wherein, killing device also includes：
Virus treated module, is configured as output to the option of operation handled virus, and according to the behaviour to the option of operation
The file to be checked of opposing is handled.
12. the client according to any one of claim 9 to 11, the acquisition module is additionally configured to：
Receive by user to file type or the selection operation of file storage catalogue；
Extract the file belonged under the file type or the file storage catalogue.
13. the client according to any one of claim 9 to 11, wherein, the identification module is additionally configured to；
Extract the suffix filename of the file to be checked；
The file format of the file to be checked is determined according to the suffix filename.
14. the client according to any one of claim 8 to 11, in addition to：
Memory, is configured to preserve the executable code into local virus library.
15. a kind of checking and killing virus method, including：
The instruction that virus characteristic matching is carried out to file to be checked is generated according to virus characteristic, and the set of the instruction is written as
Checking and killing virus script；
The checking and killing virus script is issued to checking and killing virus client, so that the checking and killing virus client is by the checking and killing virus
Script be compiled and linked into the executable code that match of hardware platform where the checking and killing virus client, and can described in calling
Perform code and checking and killing virus is carried out to the file to be checked, wherein the checking and killing virus client compiles the checking and killing virus script
The step of translating and be linked into the executable code matched with hardware platform where the checking and killing virus client includes：By the disease
The checking and killing virus script is compiled into file destination by preset compiler in malicious killing client, and by the file destination chain
It is connected into the executable code matched with hardware platform where the checking and killing virus client.
16. method according to claim 15, wherein, it is written as by the set of the instruction after checking and killing virus script
Also include：
Debugging checking is carried out to the checking and killing virus script.
17. the method according to claim 15 or 16, wherein, virus is being carried out to file to be checked according to virus characteristic generation
Also include before the instruction of characteristic matching：
Obtain virus document sample；
The virus characteristic is extracted from the virus document sample.
18. a kind of checking and killing virus server, including：
Script generation module, is configured to generate the instruction for carrying out file to be checked virus characteristic matching according to virus characteristic, and will
The set of the instruction is written as checking and killing virus script；
Script issues module, is configured to issue the checking and killing virus script to checking and killing virus client, for the checking and killing virus
Client by the checking and killing virus script be compiled and linked into the checking and killing virus client where hardware platform match can
Code is performed, and calls the executable code to carry out checking and killing virus to the file to be checked, wherein the checking and killing virus client
Hold and be compiled and linked into the checking and killing virus script and can perform that checking and killing virus client place hardware platform is matched
The step of code, includes：The checking and killing virus script is compiled into target by preset compiler in the checking and killing virus client
File, and the file destination is linked into the executable code matched with hardware platform where the checking and killing virus client.
19. server according to claim 18, in addition to：
Debugging module, is configured to carry out debugging checking to the checking and killing virus script.
20. the server according to claim 18 or 19, in addition to：
Virus characteristic extraction module, is configured to obtain virus document sample, and extract from the virus document sample described
Virus characteristic.
21. a kind of checking and killing virus system, including：
Checking and killing virus client according to any one of claim 8 to 13；
Checking and killing virus server according to any one of claim 18 to 20.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410356648.2A CN104134039B (en) | 2014-07-24 | 2014-07-24 | Checking and killing virus method, client, server and checking and killing virus system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410356648.2A CN104134039B (en) | 2014-07-24 | 2014-07-24 | Checking and killing virus method, client, server and checking and killing virus system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104134039A CN104134039A (en) | 2014-11-05 |
| CN104134039B true CN104134039B (en) | 2017-09-26 |
Family
ID=51806714
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410356648.2A Active CN104134039B (en) | 2014-07-24 | 2014-07-24 | Checking and killing virus method, client, server and checking and killing virus system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104134039B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105302851B (en) * | 2015-09-10 | 2018-12-21 | 国家计算机网络与信息安全管理中心 | A kind of automatic machine remote distribution and initial method based on file serializing |
| CN105653953B (en) * | 2015-12-24 | 2019-04-26 | 珠海豹趣科技有限公司 | A kind of checking and killing virus method and device |
| CN105975860B (en) * | 2016-04-26 | 2019-04-05 | 珠海豹趣科技有限公司 | A kind of trust file management method, device and equipment |
| CN107317799B (en) * | 2017-05-26 | 2020-09-11 | 北京金山安全管理***技术有限公司 | Virus early warning processing method and device |
| CN108898014B (en) * | 2018-06-22 | 2022-09-27 | 珠海豹趣科技有限公司 | Virus checking and killing method, server and electronic equipment |
| CN112580036B (en) * | 2019-09-30 | 2024-01-30 | 奇安信安全技术(珠海)有限公司 | Virus defense optimization method and device, storage medium and computer equipment |
| CN111143848A (en) * | 2019-12-31 | 2020-05-12 | 成都科来软件有限公司 | System for recording sample behaviors and formulating virus rules |
| CN111368298B (en) * | 2020-02-27 | 2023-07-21 | 腾讯科技（深圳）有限公司 | Virus file identification method, device, equipment and storage medium |
| CN112948829B (en) * | 2021-03-03 | 2023-11-03 | 深信服科技股份有限公司 | File searching and killing method, system, equipment and storage medium |
| CN114172736B (en) * | 2021-12-14 | 2022-09-09 | 河南中医药大学 | Computer network safety protection device based on big data |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101158999A (en) * | 2007-11-20 | 2008-04-09 | 北京派瑞根科技开发有限公司 | Method and device for preventing from computer virus |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1516011A (en) * | 2003-01-07 | 2004-07-28 | 珠海金山软件股份有限公司 | System for detecting and removing computer virus and its method |
| CN1743990A (en) * | 2005-08-12 | 2006-03-08 | 珠海金山软件股份有限公司 | Transplatform virus detecting and killing method |
| US8019700B2 (en) * | 2007-10-05 | 2011-09-13 | Google Inc. | Detecting an intrusive landing page |
| CN101710375B (en) * | 2009-12-16 | 2013-01-23 | 珠海市君天电子科技有限公司 | Anti-viral device in anti-viral software and anti-viral method thereof |
| CN102819697B (en) * | 2011-12-26 | 2015-07-22 | 哈尔滨安天科技股份有限公司 | Method and system for detecting multi-platform malicious codes based on thread decompiling |
-
2014
- 2014-07-24 CN CN201410356648.2A patent/CN104134039B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101158999A (en) * | 2007-11-20 | 2008-04-09 | 北京派瑞根科技开发有限公司 | Method and device for preventing from computer virus |
Non-Patent Citations (1)
| Title |
|---|
| 病毒查杀的脚本执行技术研究及实现;李宇雄;《万方学位论文》;20130320;论文第16页至第50页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104134039A (en) | 2014-11-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104134039B (en) | Checking and killing virus method, client, server and checking and killing virus system | |
| Wang et al. | Ramblr: Making Reassembly Great Again. | |
| US10277617B2 (en) | Method and device for feature extraction | |
| CN103902910B (en) | Detect method and the device of malicious code in intelligent terminal | |
| US9697022B2 (en) | Run time incremental compilation of script code | |
| EP3654215B1 (en) | Applying control flow integrity verification in intermediate code files | |
| JP2017517821A (en) | System and method for a database of software artifacts | |
| US9652209B2 (en) | Static analysis and reconstruction of deep link handling in compiled applications | |
| CN110245467B (en) | Android application program protection method based on Dex2C and LLVM | |
| Ďurfina et al. | PsybOt malware: A step-by-step decompilation case study | |
| Della Toffola et al. | Saying ‘hi!’is not enough: Mining inputs for effective test generation | |
| KR102011725B1 (en) | Whitelist construction method for analyzing malicious code, computer readable medium and device for performing the method | |
| Lehmann et al. | Finding the dwarf: recovering precise types from WebAssembly binaries | |
| EP3867784A1 (en) | Applying security mitigation measures for stack corruption exploitation in intermediate code files | |
| CN114443041A (en) | Method for parsing abstract syntax tree and computer program product | |
| Zhao et al. | Compile-time code virtualization for android applications | |
| Rahimian et al. | RESource: a framework for online matching of assembly with open source code | |
| Hosseini et al. | Beyond the C: Retargetable decompilation using neural machine translation | |
| Park et al. | Static analysis of jni programs via binary decompilation | |
| Escalada et al. | An efficient platform for the automatic extraction of patterns in native code | |
| Kroustek et al. | Preprocessing of binary executable files towards retargetable decompilation | |
| Küchler et al. | Representing llvm-ir in a code property graph | |
| Utkin et al. | Evaluating the impact of source code parsers on ML4SE models | |
| Woodruff et al. | Differential analysis of x86-64 instruction decoders | |
| Shahkar | On matching binary to source code |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20211210 Address after: 300450 No. 9-3-401, No. 39, Gaoxin 6th Road, Binhai Science Park, high tech Zone, Binhai New Area, Tianjin Patentee after: 3600 Technology Group Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Qizhi software (Beijing) Co.,Ltd. |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20230712 Address after: 1765, floor 17, floor 15, building 3, No. 10 Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: Beijing Hongxiang Technical Service Co.,Ltd. Address before: 300450 No. 9-3-401, No. 39, Gaoxin 6th Road, Binhai Science Park, high tech Zone, Binhai New Area, Tianjin Patentee before: 3600 Technology Group Co.,Ltd. |