CN102970283B - Document scanning system - Google Patents

Abstract

The embodiment of the invention discloses a file scanning system to solve the problem of low file scanning efficiency. The system includes a client and a server, wherein the client includes a file upload module; the server includes a storage server, a file download server and a scanning server, the storage server includes a database: a file download module; the scanning server includes a file scanning The device, the file scanning device includes: a probability calculation module; a sorting module; an extraction module, adapted to obtain the number K of scanned files, and extract K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned, K is a positive integer; the scanning module is adapted to scan the K sample files to be scanned, and identify suspicious sample files among them. The invention improves scanning efficiency, can identify as many suspicious sample files as possible, and improves the accuracy of scanning sample files.

Description

file scanning system

technical field

The invention relates to the technical field of network security, in particular to a file scanning system.

Background technique

Malicious program is an umbrella term for any software program intentionally created to perform unauthorized and often harmful acts. Computer viruses, backdoor programs, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses (batch, windows shell, java, etc.), Trojan horses, crimeware, spyware and adware, etc., These are examples of what could be called malicious programs.

In order to prevent malicious programs from attacking the computer, it is generally necessary to install anti-virus software on the computer to scan files in the system to identify and kill malicious programs.

In order to quickly identify and kill malicious programs, and at the same time reduce the resource consumption of the client, more and more current security protection software uses cloud security technology. The cloud security technology transmits the files from the client to the server, stores a large number of sample files in the server, and compares the files uploaded by the client with the sample files stored in the server to ensure the security of the client files. Then, the client security software reports and processes the malicious program according to the information sent back from the server.

As the types and quantities of malicious programs are constantly increasing, the sample files in the server are also constantly updated. Therefore, the client needs to upload tens of thousands of sample files to the server every day. The antivirus software (that is, other antivirus software except the cloud security center) scans all sample files every day to identify suspicious sample files therein. However, the scanning capability of the third-party antivirus software is limited. As the number of sample files increases, this method will obviously reduce the efficiency of file scanning.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a file scanning system that overcomes the above problems or at least partially solves the above problems.

According to the present invention, a file scanning system is provided, including: a client and a server,

in,

Clients include:

A file upload module, suitable for uploading sample files to a storage server;

The server side includes: storage server, file download server and scanning server,

The storage server includes:

A database adapted to store sample files uploaded by the file upload module;

The file download server includes:

A file download module, adapted to download sample files from the database and transmit them to the scanning server;

The scanning server includes a file scanning device, and the file scanning device includes:

The probability calculation module is adapted to calculate the probability that each sample file to be scanned is identified as suspicious for the sample file to be scanned;

A sorting module, adapted to sort the sample files to be scanned according to the probability of being identified as suspicious;

The extraction module is suitable for obtaining the number K of scanned files, and extracts K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned, and K is a positive integer;

The scanning module is adapted to scan the K sample files to be scanned, and identify suspicious sample files among them.

In the embodiment of the present invention, the document scanning device further includes:

The level detection module is adapted to detect the levels of all sample files before the probability calculation module calculates the probability that each sample file to be scanned is identified as suspicious, and the levels of the sample files include security level, unknown level, suspicious/highly suspicious level, and malicious level;

The obtaining module is adapted to obtain sample files of unknown grades, and uses the obtained sample files of unknown grades as sample files to be scanned.

In the embodiment of the present invention, the sorting module sorts the sample files to be scanned according to the probability that they are identified as suspicious from large to small;

The K sample files to be scanned are the first K sample files to be scanned in the sorted sample files to be scanned.

In the embodiment of the present invention, the probability calculation module includes:

The time point acquisition submodule is adapted to obtain the time point _n2 of this scan and the time point n1 _of the last scan corresponding to the sample file to be scanned for each sample file to be scanned;

The probability calculation sub-module is adapted to calculate the probability Pr( _{N≥n 1 , N≤n 2 |} α, β):

Pr(N≥n ₁ , N≤n ₂ |α,β)=Pr(N≥n ₁ |α,β)-Pr(N≥n ₂ +1|α,β);

Wherein, parameters α and β are parameters obtained by performing maximum likelihood estimation on the sample file data to be scanned.

In the embodiment of the present invention, the document scanning device further includes:

The establishment module is suitable for establishing an information library for each sample file to be scanned before the probability calculation module calculates the probability that each sample file to be scanned is identified as suspicious, and the information library includes the corresponding The time point n ₁ of the last scan.

In the embodiment of the present invention, the probability calculation submodule includes:

The probability calculation unit is adapted to calculate the probability Pr(N≥n|α, β) that each sample file to be scanned is not identified as suspicious for the first n-1 times, and is identified as suspicious for the nth time:

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; ></span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.<span\; class="notranslate">\; ;</span>$

The first replacement unit is adapted to replace n in the Pr(N≥n|α, β) with n ₁ , and calculate Pr(N≥n ₁ |α, β);

The second replacement unit is adapted to replace n in the Pr(N≥n|α, β) with n ₂ +1, and calculate Pr(N≥n ₂ +1|α, β);

A difference calculation unit, adapted to calculate the difference between Pr(N≥n ₁ |α, β) and Pr(N≥n ₂ +1|α, β), to obtain the probability Pr(N≥n|α, β ).

According to the file scanning system of the embodiment of the present invention, for the sample files to be scanned, the probability that each sample file to be scanned is identified as suspicious can be calculated respectively, and then the sample files to be scanned are sorted according to the probability of being identified as suspicious , and extract K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned, and finally scan the K sample files to be scanned to identify suspicious sample files among them. This solves the problem of low file scanning efficiency in the prior art due to the need to scan all sample files every day, and achieves the beneficial effect of improving scanning efficiency. Moreover, since the present invention scans by extracting K sample files to be scanned with a high suspicious probability, it can identify as many suspicious sample files as possible and improve the accuracy of scanning sample files.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same parts. In the attached picture:

Fig. 1 shows a flow chart of a method for scanning files according to an embodiment of the present invention;

Fig. 2 shows a flow chart of a method for scanning files according to an embodiment of the present invention; and

Fig. 3 shows a structural block diagram of a document scanning device according to an embodiment of the present invention;

Fig. 4 shows a structural block diagram of a file scanning system according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Embodiments of the invention may be applied to computer systems/servers that are operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments and/or configurations suitable for use with computer systems/servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, Microprocessor-based systems, set-top boxes, programmable consumer electronics, networked personal computers, minicomputer systems, mainframe computer systems, and distributed cloud computing technology environments including any of the foregoing, among others.

Computer systems/servers may be described in the general context of computer system-executable instructions, such as program modules, being executed by the computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform particular tasks or implement particular abstract data types. The computer system/server can be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computing system storage media including storage devices.

Referring to FIG. 1 , it shows a flowchart of a method for scanning files according to an embodiment of the present invention.

In order to quickly identify and kill malicious programs, and at the same time reduce the resource consumption of the client, more and more current security protection software uses cloud security technology. The cloud security technology transmits the files from the client to the server, stores a large number of sample files in the server, and compares the files uploaded by the client with the sample files stored in the server to ensure the security of the client files. Then, the client security software reports and processes the malicious program according to the information sent back from the server.

As the types and numbers of malicious programs continue to increase, the sample files in the server must also be updated continuously, so the client needs to upload tens of thousands of sample files to the server every day, and the server uses regularly updated third-party antivirus The software scans all sample files every day to identify suspicious sample files. However, the scanning capability of the third-party antivirus software is limited. As the number of sample files increases, this method will obviously reduce the efficiency of file scanning.

Therefore, in order to improve file scanning efficiency, the embodiment of the present invention proposes a method of extracting part of the sample files that meet the conditions from the sample files according to the scanning capability of the third-party anti-virus software (that is, the maximum number of files that can be scanned). The method of scanning out some sample files.

Specifically, the method for scanning files in this embodiment includes the following steps:

Step S101, for the sample files to be scanned, respectively calculate the probability that each sample file to be scanned is identified as suspicious.

This embodiment proposes to extract some sample files from the sample files to be scanned for scanning. Therefore, it is first necessary to determine which sample files are specifically extracted for scanning. In order to identify as many suspicious sample files as possible and improve the accuracy of file scanning, it is proposed in this embodiment to extract sample files based on the probability that the sample files to be scanned are identified as suspicious.

Therefore, in this step S101 , for the sample files to be scanned, the probability that each sample file to be scanned is identified as suspicious can be calculated respectively, and the specific calculation process will be described in detail in the following embodiments.

In the embodiment of the present invention, in order to check and kill the ever-increasing malicious programs, the antivirus software can periodically scan the sample files, correspondingly, in this step, the calculation of the probability is performed regularly, and, in order to more accurately determine the Sample files, each calculation can be calculated for all sample files to be scanned, so as to make the scan more comprehensive.

In this embodiment, considering that the sample file may be infected by viruses at any time, for each sample file, even if the sample file is not identified as suspicious for the first n-1 times, this just shows that other samples were previously scanned. It is not infected with a virus, but it may also be infected with a virus later, so the probability calculation of it also needs to be performed at the nth scan. Therefore, in order to make the scanning more comprehensive and accurate, this embodiment proposes to calculate all the sample files to be scanned each time.

Of course, in this embodiment, the calculation may also be performed on some sample files each time, which is not limited in this embodiment of the present invention.

Wherein, for the time interval of calculation, it can be determined according to the time interval of antivirus software upgrade. For example, if the antivirus software is upgraded every time t, it can be set that every time t is aimed at all sample files to be scanned, and each to-be-scanned sample file can be calculated respectively. The probability that a scanned sample file is identified as suspicious. Of course, the calculation time interval may also be set to other values, which is not limited in this embodiment.

Step S102, sorting the sample files to be scanned according to the probability of being identified as suspicious.

In step S103, the number K of scanned files is acquired, and K sample files to be scanned with a high suspicious probability are extracted from the sorted sample files to be scanned, where K is a positive integer.

Step S104, scanning the K sample files to be scanned, and identifying suspicious sample files among them.

After calculating the probability that each sample file to be scanned is identified as suspicious in step S101, the sample file to be scanned is first sorted according to the calculated probability, and then according to the number K of files that can be scanned by a third-party antivirus software Extract K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned. Finally, the third-party antivirus software only needs to scan the extracted K sample files to be scanned, and further identify the suspicious sample files. Yes, instead of scanning all sample files. The specific process will be described in detail in the following embodiments.

Among them, the value of K can be determined according to the scanning capability of the third-party anti-virus software, and the maximum number of files that the third-party anti-virus software can scan can be used as the value of K. For example, if the anti-virus software can scan 1000 sample files a day , then K=1000.

Certainly, K may also take other values, which are not limited in this embodiment of the present invention.

The embodiment of the present invention solves the problem of low file scanning efficiency in the prior art due to the need to scan all sample files every day, and achieves the beneficial effect of improving the scanning efficiency. And because the present invention scans by extracting K sample files to be scanned with a high suspicious probability, it can identify as many suspicious sample files as possible and improve the scanning accuracy.

Referring to FIG. 2 , it shows a flow chart of a method for scanning files according to an embodiment of the present invention, the method comprising:

In step S201, the server receives all sample files uploaded by the client.

The process of virus detection and killing through cloud security technology is to transmit the client’s files to the server, and store a large number of sample files in the server, and the server compares the files uploaded by the client with the stored sample files, so as to The security of the client file is judged, and then the client security software reports and processes the client file according to the information sent back from the server.

Therefore, it is first necessary to determine the sample files stored in the cloud security center server and identify whether these sample files are suspicious, and then compare the files uploaded by the client with the sample files stored in the server to judge the security of the client files .

First, the client uploads all sample files to the server, and then the server performs subsequent processing. It should be noted that the sample files uploaded by the client described here are not to be compared with the sample files stored in the server, but to find out the sample files that need to be stored in the server from these sample files, and identify these Whether the sample file is suspicious.

Step S202, detecting the grades of all sample files.

After receiving all the sample files uploaded by the client, the server first detects the grades of these sample files.

In this embodiment, the levels of the sample files include: security level, unknown level, suspicious/highly suspicious level, and malicious level. For the level setting, you can set the security level when the level is 10-20, the unknown level when the level is 30-40, the suspicious/highly suspicious level when the level is 50-60, and the malicious level when the level is greater than or equal to 70. Of course, the levels may also be set in other forms, which are not limited in the present invention.

Step S203, acquiring a sample file of an unknown level, and using the acquired sample file of an unknown level as a sample file to be scanned.

In this embodiment, it is set that only sample files with unknown suspicious levels are used as sample files to be scanned. For the grades of the sample files detected in the above-mentioned step S202, the sample files whose grades are security grades are not suspicious sample files, and the grades are suspicious/highly suspicious grades and malicious grade sample files, for these sample files no further processing is required. Scanning; sample files with an unknown level are sample files with an unknown level of suspiciousness, so it is necessary to further scan these sample files with an unknown level to identify whether they are suspicious sample files.

Step S204, for the sample files to be scanned, respectively calculate the probability that each sample file to be scanned is identified as suspicious.

In order to improve the scanning efficiency, the embodiment of the present application does not scan all the sample files to be scanned, but selects some sample files to be scanned from the sample files to be scanned for scanning. Therefore, after the sample files to be scanned are determined in step S203, the sample files to be scanned need to be further analyzed to determine the sample files that actually need to be scanned.

In the embodiment of the present invention, the sample files satisfying the conditions are extracted according to the probability that the sample files to be scanned are identified as suspicious. Therefore, in this step S204, it is necessary to calculate the number of identified samples for each sample file to be scanned. is suspicious probability.

Similar to the first embodiment above, in order to check and kill the ever-increasing malicious programs, the anti-virus software can regularly scan the sample files, correspondingly, in this step, the probability calculation is performed regularly, and, in order to more accurately determine the Sample files, each calculation can be calculated for all sample files to be scanned, so as to make the scan more comprehensive. Of course, the embodiments of the present invention are not limited to this manner, and it is also feasible for those skilled in the art to adopt other manners based on actual experience.

Specifically, the probability that each sample file to be scanned is identified as suspicious can be calculated through the following sub-steps:

In sub-step a1, for each sample file to be scanned, the time point n ₂ of the current scan and the time point n ₁ of the last scan corresponding to the sample file to be scanned are obtained.

Wherein, the time point n ₂ is the current scanning time corresponding to the sample file to be scanned, and the time point n ₂ can be obtained by directly reading the current time.

Time point _n1 is the last scanning time corresponding to the sample file to be scanned. In this embodiment, before calculating the probability that each sample file to be scanned is identified as suspicious in step S204, an information base is established for each sample file to be scanned, and the sample file to be scanned is included in the information base. Time point n ₁ of the last scan corresponding to the file. The ID of each sample file to be scanned in the information base is the primary key, and the corresponding sample file to be scanned can be found in the information base through the ID, and the time point n ₁ of the last scan corresponding to the sample file to be scanned can be further obtained.

Sub-step a2, calculate the probability Pr( _{N≥n 1 , N≤n 2 |} α, β):

Pr(N≥n ₁ , N≤n ₂ |α,β)=Pr(N≥n ₁ |α,β)−Pr(N≥n ₂ +1|α,β).

Wherein, parameters α and β are parameters obtained by performing maximum likelihood estimation on the sample file data to be scanned.

The sub-step a2 may specifically include:

(1) Calculate the probability Pr(N≥n|α, β) that each sample file to be scanned is not identified as suspicious for the first n-1 times, and is identified as suspicious for the nth time by the following formula:

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; ></span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$

In this embodiment, considering that the sample files may be infected by viruses at any time, during the nth scan, calculations are also required for the files to be scanned that are not identified as suspicious for the first n-1 times (because even these files to be scanned Scanning the sample file for the first n-1 times has not been identified as suspicious, which just means that it was not infected with a virus during the previous scan, but it may also be infected with a virus later, so the probability calculation also needs to be performed at the nth scan).

Next, specifically analyze how to calculate the probability Pr(N≥n|α, β) that the sample file to be scanned is not identified as suspicious for the first n-1 times, but is identified as suspicious for the nth time.

Assuming that the probability of each sample file to be scanned is identified as suspicious is calculated every time t. The identification of a sample file as suspicious is a random event. For example, the probability θ indicates that a sample is identified as suspicious. -1 time is not identified as suspicious, the probability of being identified as suspicious for the nth time is:

Pr(N=n|θ)=(1-θ) ^n-1 θ

The above probability Pr(N≥n|θ) obeys the geometric distribution, namely

Pr(N≥n|θ)=(1-θ) ^n-1

For different sample files, the value of the parameter θ is different, assuming that the parameter θ obeys the beta distribution with parameters α and β, that is

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}$

in, $B(\mathrm{\&alpha;},\mathrm{\&beta;})={\&Integral;}_0^1{t}^{\mathrm{\&alpha;}-1}(1-t^{\text{\&beta;-1}})\mathrm{dt}=\frac{\mathrm{\&Gamma;}\left(\mathrm{\&alpha;}\right)\mathrm{\&Gamma;}\left(\mathrm{\&beta;}\right)}{\mathrm{\&Gamma;}(\mathrm{\&alpha;}+\mathrm{\&beta;})},$ B(α, β) is a beta function, Γ(x) is a gamma function, which satisfies the property of Γ(x+1)=xΓ(x).

Therefore, it can be concluded that

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{<span\; class="notranslate">\; \&Integral;</span>}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; 1</span>}}\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; d\&theta;</span>}$

$<span\; class="notranslate">\; =</span>{<span\; class="notranslate">\; \&Integral;</span>}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; 1</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}\frac{{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\text{<span class="notranslate"> \&alpha;,\&beta;</span>}<span\; class="notranslate">\; )</span>}\mathrm{<span\; class="notranslate">\; d\&theta;</span>}$

$<span\; class="notranslate">\; =</span>{<span\; class="notranslate">\; \&Integral;</span>}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; 1</span>}}\frac{{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}\mathrm{<span\; class="notranslate">\; d\&theta;</span>}$

$<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}{<span\; class="notranslate">\; \&Integral;</span>}_{\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; 1</span>}}\frac{{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}^{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; )</span>}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&theta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}\mathrm{<span\; class="notranslate">\; d\&theta;</span>}$

$<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}$

further, yes Doing the calculation suspiciously yields:

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}$

$<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; \&Gamma;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; \&Gamma;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; \&Gamma;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>}\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}$

$<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\frac{\mathrm{<span\; class="notranslate">\; \&Gamma;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; \&Gamma;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; \&Gamma;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>}\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}$

$<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\frac{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>}$

$<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span>$

Therefore, it is finally concluded that the sample file to be scanned has not been identified as suspicious for the first n-1 times, and the probability Pr(N≥n|α, β) of being identified as suspicious for the nth time is:

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; ></span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.$

(2) replace n in the Pr(N≥n|α, β) with n ₁ , and calculate Pr(N≥n ₁ |α, β);

(3) Replace n in the Pr(N≥n|α, β) with n ₂ +1, and calculate Pr(N≥n ₂ +1|α, β);

(4) Calculate the difference between Pr(N≥n ₁ |α, β) and Pr(N≥n ₂ +1|α, β) to obtain the probability Pr(N≥n|α, β).

The probability that the sample file to be scanned is identified as suspicious in this scan is:

Pr(N≥n ₁ , N≤n ₂ |α,β)=Pr(N≥n ₁ |α,β)-Pr(N≥n ₂ +1|α,β),

Therefore, according to the probability Pr(N≥n|α, β) calculated in (1), Pr(N≥n ₁ |α, β) can be calculated by replacing n with n ₁ and n ₂ +1 respectively and Pr(N≥n ₂ +1|α, β), and then calculate the difference between Pr(N≥n ₁ |α, β) and Pr(N≥n ₂ +1|α, β), that is, the obtained The above probability Pr(N≥n|α, β).

Step S205, sorting the sample files to be scanned according to the probability of being identified as suspicious.

After the probability that each sample file to be scanned is identified as suspicious is calculated in step S204, the sample files to be scanned are sorted according to the probability of being identified as suspicious.

Preferably, in this embodiment, the to-be-scanned sample files are sorted according to the probability that the to-be-scanned sample files are identified as suspicious in descending order, wherein the to-be-scanned sample files ranked higher are the sample files with high suspicious probability.

In step S206, the number K of scanned files is obtained, and K sample files to be scanned with a high suspicious probability are extracted from the sorted sample files to be scanned, where K is a positive integer. In this embodiment, the sample files to be scanned can be selected for scanning according to the scanning capability of the third-party anti-virus software. The scanning capability is the maximum number of files that the anti-virus software can scan. Therefore, the third-party anti-virus software can be The maximum number of files that can be scanned is used as the value of K, and then K sample files to be scanned with a high suspicious probability are selected for scanning.

Specifically, if in step S205, the sample files to be scanned are sorted according to the probability that the sample files to be scanned are identified as suspicious from large to small, then in step S206, the sample files to be scanned are directly extracted The first K sample files to be scanned are sufficient.

It should be noted that, for the above-mentioned steps S204-S206, after the server determines the sample files to be scanned, the probability that each sample file to be scanned is identified as suspicious can be directly calculated by the server, and sorted according to the probability, and then K sample files to be scanned with high suspicious probability are extracted from the sorted sample files to be scanned. Of course, the server can also transmit the determined sample files to be scanned to the local client, and perform the above probability calculation, sorting and extraction process through the local client, and then the client uploads the extracted K sample files to be scanned to the server. This embodiment does not limit it.

Step S207, scanning the K sample files to be scanned, and identifying suspicious sample files among them.

After determining the K sample files to be scanned, the cloud security center uses third-party anti-virus software to scan the K sample files to be scanned to identify suspicious sample files and store them on the server for subsequent use. When antivirus is performed, it is compared with the client file, so as to make a judgment on the security of the client file.

As for the specific scanning process and identification process, those skilled in the art can handle it according to actual experience, which is not limited in this embodiment of the present invention.

The embodiment of the present invention specifically describes the process of how to determine the sample files that actually need to be scanned. According to the scanning capability K of the third-party antivirus software, K sample files to be scanned with a high suspicious probability are determined, and then only the K sample files to be scanned are determined. The sample file can be scanned, thereby improving the file scanning efficiency, and because the embodiment of the present invention scans by extracting K sample files to be scanned with a high suspicious probability, it can identify as many suspicious sample files as possible, and improve the scanning sample rate. Document Accuracy.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence, because Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions involved are not necessarily required by this application.

Referring to FIG. 3 , it shows a structural block diagram of a file scanning device according to an embodiment of the present invention, the device includes: a receiving module 301, a grade detection module 302, an acquisition module 303, an establishment module 304, a probability calculation module 305, sorting module 306 , extracting module 307 and scanning module 308 .

in,

The receiving module 301 is adapted to receive all sample files uploaded by the client;

The level detection module 302 is adapted to detect the levels of all sample files before the probability calculation module calculates the probability that each sample file to be scanned is identified as suspicious;

The levels of the sample files include security level, unknown level, suspicious/highly suspicious level, and malicious level.

The acquiring module 303 is adapted to acquire a sample file of an unknown level, and use the acquired sample file of an unknown level as a sample file to be scanned.

The establishment module 304 is adapted to establish an information base for each sample file to be scanned before the probability calculation module separately calculates the probability that each sample file to be scanned is identified as suspicious;

The information base includes the time point n ₁ of the last scan corresponding to the sample file to be scanned.

The probability calculation module 305 is adapted to calculate the probability that each sample file to be scanned is identified as suspicious for the sample file to be scanned;

Specifically, the probability calculation module can regularly calculate the probability that each sample file to be scanned is identified as suspicious for the sample files to be scanned, and the calculation can be performed for all sample files to be scanned each time, which is not included in this embodiment. Not limited.

The probability calculation module 305 may specifically include the following submodules:

The time point acquisition submodule is adapted to obtain the time point _n2 of this scan and the time point n1 _of the last scan corresponding to the sample file to be scanned for each sample file to be scanned;

The probability calculation sub-module is adapted to calculate the probability Pr( _{N≥n 1} , _N≤ n ₂ |α,β):

Pr(N≥n ₁ , N≤n ₂ |α,β)=Pr(N≥n ₁ |α,β)-Pr(N≥n ₂ +1|α,β);

Wherein, parameters α and β are parameters obtained by performing maximum likelihood estimation on the sample file data to be scanned.

The probability calculation submodule may specifically include the following units:

The probability calculation unit is adapted to calculate the probability Pr(N≥n|α, β) that each sample file to be scanned is not identified as suspicious for the first n-1 times and is identified as suspicious for the nth time by the following formula:

$\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; ></span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.<span\; class="notranslate">\; ;</span>$

The first replacement unit is adapted to replace n in the Pr(N≥n|α, β) with n ₁ , and calculate Pr(N≥n ₁ |α, β);

The second replacement unit is adapted to replace n in the Pr(N≥n|α, β) with n ₂ +1, and calculate Pr(N≥n ₂ +1|α, β);

A difference calculation unit, adapted to calculate the difference between Pr(N≥n ₁ |α, β) and Pr(N≥n ₂ +1|α, β), to obtain the probability Pr(N≥n|α, β ).

A sorting module 306, adapted to sort the sample files to be scanned according to the probability of being identified as suspicious;

Preferably, in this embodiment, the sorting module 306 sorts the sample files to be scanned according to the probability that the sample files to be scanned are identified as suspicious from the largest to the smallest.

The extraction module 307 is adapted to obtain the number K of scanned files, extract K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned, and K is a positive integer;

In this embodiment, the number K of scanned files can be determined according to the scanning capability of the third-party antivirus software, that is, the maximum number of files that can be scanned by the third-party antivirus software can be used as the value of K.

If the sorting module 306 sorts the sample files to be scanned according to the probability that the sample files to be scanned are identified as suspicious in descending order, then the extraction module 307 can directly extract the first K sample files to be scanned from the sorted sample files to be scanned.

The scanning module 308 is adapted to scan the K sample files to be scanned, and identify suspicious sample files among them.

Finally, it should be noted that the above-mentioned receiving module 301, grade detection module 302, acquisition module 303, establishment module 304, probability calculation module 305, sorting module 306 and extraction module 307 can be functional modules in the server, because when scanning The scanning is performed by third-party anti-virus software, so the scanning module 308 may be a functional module in the third-party anti-virus software.

In addition, the probability calculation module 305, the sorting module 306 and the extraction module 307 may also be functional modules in the local client, that is, after the server determines the sample files to be scanned, these sample files to be scanned are transmitted to the local client, The probability calculation module 305 , the sorting module 306 and the extraction module 307 of the local client determine K sample files to be scanned, and then transmit the K sample files to be scanned to the server, which is not limited in the embodiment of the present invention.

The device for scanning files according to the embodiment of the present invention can separately calculate the probability that each sample file to be scanned is identified as suspicious for the sample files to be scanned, and then sort the sample files to be scanned according to the probability of being identified as suspicious , and extract K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned, and finally scan the K sample files to be scanned to identify suspicious sample files among them. This solves the problem of low file scanning efficiency in the prior art due to the need to scan all sample files every day, and achieves the beneficial effect of improving scanning efficiency. Moreover, since the embodiment of the present invention scans by extracting K sample files to be scanned with a high suspicious probability, as many suspicious sample files as possible can be identified to improve the accuracy of scanning sample files.

As for the above embodiment of the device for scanning files, since it is basically similar to the method embodiment, the description is relatively simple, and for the related parts, please refer to the part of the description of the method embodiment shown in FIG. 1 and FIG. 2 .

Based on the above embodiment of the device for scanning files, the embodiment of the present invention also provides a file scanning system, the system includes a client and a server,

in,

Clients include:

The file upload module 401 is suitable for uploading the sample file to the storage server;

The server side includes: a storage server 402, a file download server 403 and a scanning server 404,

The storage server 402 includes:

The database 4021 is suitable for storing the sample files uploaded by the file upload module;

Described file download server 403 comprises:

The file download module 4031 is adapted to download sample files from the database of the storage server and transmit them to the scanning server;

The scanning server 404 includes the document scanning device 4041 described in the above-mentioned embodiment, for details, please refer to the related description of the above-mentioned embodiment.

In addition, it should be noted that the scanning server 404 may also include an input interface 4042 and an output interface 4043, and the file download module 4031 transmits the downloaded sample file to the file scanning device 4041 of the scanning server through the input interface 4042, and the file scanning device 4041 processes the sample file, and then outputs the processing result through the output interface 4043 . As for the specific processing process, this embodiment will not discuss in detail here.

The scanning server in the system for scanning files proposed in this embodiment can select some sample files satisfying the conditions from the sample files to be scanned for scanning, which improves the scanning efficiency. Moreover, since the present invention scans by extracting K sample files to be scanned with a high suspicious probability, it can identify as many suspicious sample files as possible and improve the accuracy of scanning sample files.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other.

It is easy for those skilled in the art to think that: any combination of the above-mentioned embodiments is feasible, so any combination of the above-mentioned embodiments is the embodiment of the present application, but due to space limitations, this description will be limited here Not detailed one by one.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the contents of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the document scanning system according to the embodiment of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (5)

1. A file scanning system, comprising: a client and a server, wherein, Clients include: A file upload module, suitable for uploading sample files to a storage server; The server side includes: storage server, file download server and scanning server, The storage server includes: A database adapted to store sample files uploaded by the file upload module; The file download server includes: A file download module, adapted to download sample files from the database of the storage server and transmit them to the scanning server; The scanning server includes a file scanning device, and the file scanning device includes: The probability calculation module is adapted to calculate the probability that each sample file to be scanned is identified as suspicious for the sample file to be scanned; the probability calculation module includes: a time point acquisition submodule, which is suitable for each sample file to be scanned, Obtain the time point n _{2 of this scan and the time point n 1 of} the last scan corresponding to the sample file to be scanned; the probability calculation sub-module is suitable for calculating from time point n ₁ to time point n ₂ , the to-be The probability that the scanned sample file is identified as suspicious in this scan Pr(N≥n ₁ , N≤n ₂ │α, β)=Pr(N≥n ₁ │α, β)-Pr(N≥n ₂ + 1│α, β), where the parameters α and β are parameters obtained by performing maximum likelihood estimation on the sample file data to be scanned; A sorting module, adapted to sort the sample files to be scanned according to the probability of being identified as suspicious; The extraction module is suitable for obtaining the number K of scanned files, and extracts K sample files to be scanned with high suspicious probability from the sorted sample files to be scanned, and K is a positive integer; The scanning module is adapted to scan the K sample files to be scanned, and identify suspicious sample files among them. 2. The system according to claim 1, wherein the document scanning device further comprises: The level detection module is adapted to detect the levels of all sample files before the probability calculation module calculates the probability that each sample file to be scanned is identified as suspicious, and the levels of the sample files include security level, unknown level, suspicious/highly suspicious level, and malicious level; The obtaining module is adapted to obtain sample files of unknown grades, and uses the obtained sample files of unknown grades as sample files to be scanned. 3. The system of claim 1, wherein, The sorting module is sorted according to the probability that the sample files to be scanned are identified as suspicious from large to small; The K sample files to be scanned are the first K sample files to be scanned in the sorted sample files to be scanned. 4. The system according to claim 1, wherein the document scanning device further comprises: The establishment module is suitable for establishing an information library for each sample file to be scanned before the probability calculation module calculates the probability that each sample file to be scanned is identified as suspicious, and the information library includes the corresponding The time point n ₁ of the last scan. 5. The system according to claim 1, wherein the probability calculation submodule comprises: The probability calculation unit is adapted to calculate the probability Pr(N≥n│α, β) that each sample file to be scanned is not identified as suspicious for the first n-1 times, and is identified as suspicious for the nth time: $\mathrm{<span\; class="notranslate">\; PR</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}\\ \frac{\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>& \mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; ></span>\mathrm{<span\; class="notranslate">\; 1</span>}\end{array}\right.<span\; class="notranslate">\; ;</span>$ The first replacement unit is adapted to replace n in the Pr(N≥n│α, β) with n ₁ to calculate Pr(N≥n ₁ │α, β); The second replacement unit is adapted to replace n in the Pr(N≥n│α, β) with n ₂ +1, and calculate Pr(N≥n ₂ +1│α, β); A difference calculation unit, adapted to calculate the difference between Pr(N≥n ₁ │α, β) and Pr(N≥n ₂ +1│α, β), to obtain the probability Pr(N≥n│α, β ).