CN104318159A - Server virus killing method, device and system - Google Patents

Abstract

The invention discloses a server antivirus method, device and system, relates to the field of computer security, and is invented to solve the problem that a server installed with a Linux operating system cannot effectively detect and kill viruses in an isolated network environment. The method of the present invention includes: detecting the version information of the Linux operating system currently running on the server; obtaining an antivirus engine supporting the Linux operating system according to the version information; installing the antivirus engine on the server, so that the server Run the antivirus engine to scan and kill viruses. The invention is mainly applied in the process of checking and killing viruses of servers in an isolated environment.

Description

Method, device and system for server antivirus

technical field

The invention relates to the field of computer security, in particular to a server antivirus method, device and system.

Background technique

The antivirus engine is a set of technical mechanisms to judge whether the behavior of a specific program is a virus or a suspicious program, and the performance of the antivirus engine also directly determines the quality of the virus detection and killing effect.

In order to ensure the normal operation of the server, virus detection and killing can be performed on the server through the local antivirus engine and the cloud engine. Using a local antivirus engine to scan and kill viruses means installing an antivirus engine locally on the server to scan and kill viruses on the server; using a cloud engine to scan and kill viruses means using an antivirus engine installed on a remote server to scan and kill viruses on the server Virus killing.

In prior art, for the server that Windows operating system is installed, can carry out cloud engine and local antivirus engine to carry out virus killing, and for the server (for example mail server, file server etc.) that is installed with Linux operating system, then usually use cloud engine Perform a virus scan. In the isolated network environment, due to the physical isolation of data interaction inside and outside the network, the cloud engine inside the isolated network cannot update the virus sample database through the external network. Effective virus scanning and killing of the server.

Contents of the invention

In view of the above problems, the present invention provides a server antivirus method, device and system, which are used to solve the problem that the server installed with the Linux operating system cannot effectively detect and kill viruses in an isolated network environment.

In order to achieve the above object, the present invention mainly provides the following technical solutions:

In the first aspect, the embodiment of the present invention provides a method for server antivirus, the method comprising:

Detect the version information of the Linux operating system currently running on the server;

Obtain an antivirus engine supporting the Linux operating system according to the version information;

An anti-virus engine is installed on the server, so that the server runs the anti-virus engine to scan and kill viruses.

In the second aspect, the embodiment of the present invention also provides a server antivirus device, the device comprising:

The detection unit is used to detect the version information of the Linux operating system currently running on the server;

An acquisition unit, configured to acquire an antivirus engine supporting the Linux operating system according to the version information detected by the detection unit;

The installation unit is configured to install the antivirus engine obtained by the acquisition unit on the server, so that the server runs the antivirus engine to perform virus scanning and killing.

In the third aspect, the embodiment of the present invention further provides a server antivirus system, the system includes: a virus server and an application server, wherein the virus server includes the device as described in the aforementioned second aspect;

The virus server is used to detect the version information of the currently running Linux operating system; obtain an antivirus engine supporting the Linux operating system according to the version information; send the antivirus engine to the application server;

The application server is configured to receive and install the antivirus engine, and run the antivirus engine to scan and kill viruses.

By means of the above-mentioned technical solution, the server antivirus method, device and system provided by the present invention, in the isolated network environment, by detecting the version information of the Linux operating system currently running on the server, obtain the antivirus engine supporting the Linux operating system according to the version information. , and install the obtained antivirus engine into the server, so that the server can use the antivirus engine to scan and kill viruses. Compared with the prior art, the present invention supports the virus-killing engine installed on the server running the Linux operating system, utilizes the virus-killing engine to check and kill the virus in the server, improves the checking and killing efficiency of the server to a large extent, thereby avoiding This solves the problem in the prior art that the cloud engine cannot effectively scan and kill viruses on the server due to the effect of the isolation network.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same parts. In the attached picture:

FIG. 1 shows a flow chart of a server antivirus method provided in an embodiment of the present invention;

FIG. 2 shows a schematic structural diagram of a server antivirus device provided in an embodiment of the present invention;

FIG. 3 shows a schematic structural diagram of another server antivirus device provided in an embodiment of the present invention;

FIG. 4 shows a schematic diagram of a server antivirus system provided in an embodiment of the present invention;

FIG. 5 shows a schematic diagram of a server antivirus system provided in an application embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

The operating system (Operating System, referred to as OS) is a computer program that manages and controls computer hardware and software resources. It is the most basic system software that runs directly on the "bare metal". Any other software must be supported by the operating system to run. . Currently, the operating system commonly used by application servers is the Linux operating system. Wherein, the application server includes: a mail server, a file server, and the like.

In practical applications, the number of application servers is generally multiple. In order to effectively protect the application server, a virus server can be installed on the upper layer of the application server. The virus server can issue an antivirus engine that supports the operating system currently running on the application server. So that the application server can install and start the antivirus engine to perform virus scanning and killing.

In order to solve the problem that under the isolated network environment, the server with the Linux operating system cannot be effectively checked and killed, the embodiment of the present invention provides a method for server virus killing, as shown in Figure 1, the method includes:

Step 101, detecting the version information of the Linux operating system currently running on the server.

In an embodiment, Linux is a set of Unix-like operating systems for free use and free dissemination, and is a multi-user, multi-tasking, multi-threading and multi-CPU based on POSIX (Portable Operating System Interface, Portable Operating System Interface) and UNIX operating system. It can run major UNIX utility software, application programs and network protocols. It supports 32-bit and 64-bit hardware. Linux inherits Unix's network-centric design idea and is a multi-user network operating system with stable performance. With the continuous upgrading of Linux, Linux itself has a series of updated versions. In addition, in order to meet the needs of different users, many manufacturers have developed versions of many Linux operating systems based on the Linux kernel. The more commonly used Linux operating systems include: Ubuntu, community enterprise operating systems CentOS, and Red Hat CentOS operating systems. , as well as Red Flag Linux, Linux Mint, Debian, etc., which will not be listed one by one here, but a brief introduction to Ubuntu below.

The version information of the Linux operating system referred to in the embodiment, in addition to including information such as operating system information such as Ubuntu, CentOS and CentOS, can also include different update version information of each kind of Linux operating system, such as Ubuntu 1.1.0, Ubuntu 1.1.1 etc.

In the embodiment, the virus server detects the version information of the Linux operating system currently running on the application server, and the application server needs to be in a running state. If the system is a Linux operating system, the specific version information of the Linux operating system is detected, and the obtained detection information is saved. In another application scenario, the server antivirus method provided by the embodiment of the present invention can also be applied to other servers with non-Linux operating systems installed.

Step 102, acquire an antivirus engine supporting the Linux operating system according to the version information of the Linux operating system.

In the embodiment, according to the above-mentioned step 101, it can be known that the Linux operating system includes many categories and version models, and the antivirus engine also includes many kinds, such as artificial intelligence engine QVM (QihooSupport Vector Machine, Qihoo Support Vector Machine), heuristic antivirus Engine AVE and Little Red Umbrella Avira AntiVir and so on. Since there are many types of Linux operating systems, there are also many types of antivirus engines, and different antivirus engines do not necessarily support all Linux operating systems. Therefore, when the virus server detects the version information of the Linux operating system currently running on the application server, it needs to search for an antivirus engine that supports the Linux operating system.

Step 103, installing the obtained antivirus engine supporting the Linux operating system on the server, so that the server runs the antivirus engine to scan and kill viruses.

In an embodiment, when the virus server obtains the version information of the Linux operating system currently running on the application server, and finds the antivirus engine corresponding to the Linux operating system according to the version information, the virus server sends the antivirus engine to the application server, After the application server receives the anti-virus engine, it installs and starts the anti-virus engine, and after the anti-virus engine starts, it scans and kills viruses on the application server.

Specifically, the embodiment of the present invention is mainly applied in an isolated network environment. In an isolated network environment, a private cloud is generally deployed, and the required antivirus engines of different types can be stored in the virus server of the private cloud. When the application After the server obtains the antivirus engine supporting the currently running Linux operating system, the application server can send request information to the private cloud. Wherein, the request information includes information such as the type information of the antivirus engine. In the embodiment, all antivirus engines in the virus server in the private cloud can be numbered. When the version information of the Linux operating system currently running on the application server is detected, and the application server obtains After supporting the antivirus engine of the Linux operating system, the application server can convert the version type information of the antivirus engine into request information and send it to the private cloud. According to the actual application, the request information may also include other information, such as the time and method of requesting the private cloud to deliver the antivirus engine. After the virus server receives the request information sent by the application server, the virus server will analyze the request information, and send the antivirus engine required by the application server to the application server according to the analysis result. The sending timing can be: the virus server sends it to the application server immediately, it can also send it to the application server at a specific time, or it can send it to the application server when the network is idle, and so on. The distribution method may be that the application server may download the antivirus engine delivered by the virus server through a download tool, or the virus server may directly send it to the application server. In addition, the request information sent by the application server to the virus server may also include information on the number of required antivirus engines, and the number of antivirus engines may be one or multiple. After the application server obtains an antivirus engine supporting the current running Linux operating system, the antivirus engine is installed in the server, and the server runs the antivirus engine to perform virus scanning and killing.

In the server antivirus method provided in the embodiment of the present invention, in an isolated network environment, by detecting the version information of the Linux operating system currently running on the server, the antivirus engine supporting the Linux operating system is acquired according to the version information, and the obtained antivirus engine is obtained. The antivirus engine is installed in the server so that the server can use the antivirus engine to scan and kill viruses. Compared with the prior art, the present invention installs the antivirus engine supporting the Linux operating system on the server running the Linux operating system, utilizes the antivirus engine to check and kill the virus in the server, and avoids the inability of the cloud engine inside the isolated network to The virus sample library is updated through the external network, which leads to the low virus detection and killing rate of the cloud engine, and the problem that the virus detection and killing of the server installed with the Linux operating system cannot be carried out effectively.

Further, as a refinement of the method in Figure 1, in another embodiment of the present invention, before the server obtains the antivirus engine supporting the Linux operating system according to the detected version information, it also includes: establishing the version information of the Linux operating system The mapping table between the supported Linux operating system.

Specifically, as mentioned above, the version information of the Linux operating system includes information on operating systems such as Ubuntu, CentOS, and RedHat. In addition, the version information also includes an updated version of each Linux operating system, such as: an updated version of the Ubuntu operating system Including: 13.10, 14.04LTS, etc. Antivirus engines include: QVM, AVE, Avira AntiVir, etc.

In the embodiment, since each antivirus engine supports a different version of the Linux operating system, it is necessary to establish a relationship mapping table between the antivirus engine and the Linux operating system. After the virus server detects the version information of the Linux operating system currently running on the application server, it can quickly find the antivirus engine supporting the Linux operating system by searching the relational mapping table. For example: QVM and AVE respectively support Ubuntu, CentOS and RedHat operating systems, and QVM and AVE respectively establish relationship mapping with Ubuntu, CentOS and RedHat, and write them into the relationship mapping table. Then, the virus server can know that QVM and AVE support Ubuntu, CentOS and RedHat operating systems respectively by looking up the relational mapping table. Exemplary: when the virus server detects that the operating system currently running on the application server is Ubuntu, CentOS or RedHat, the virus server sends QVM and AVE to the application server, and the application server receives and installs QVM and/or AVE locally, And run QVM and/or AVE to scan and kill viruses.

Further, when the virus server detects the version information of the currently running Linux operating system, and the virus server obtains at least two antivirus engines that support the Linux operating system according to the version information, then the virus server can use these to support Linux operations. The antivirus engines of the system are all sent to the application server, and after the application server receives these antivirus engines, these antivirus engines are installed on the server (or only a few of them are installed) to perform multi-engine antivirus.

Specifically, the multi-engine antivirus for the application server may be that multiple antivirus engines perform virus inspection and killing on the application server at the same time, or multiple antivirus engines sequentially perform virus inspection and killing on the application server, or send the results of the previous antivirus engines. Give the latter antivirus engine, and the latter antivirus engine performs virus inspection and killing according to the results of the previous antivirus engine.

First of all, the multi-engine anti-virus of the application server can be that multiple anti-virus engines perform virus scanning and killing on the server at the same time. Wherein, each antivirus engine operates independently relative to other antivirus engines and does not affect each other. After all the antivirus engines have finished virus scanning and killing the files on the application server, they send the results of the virus checking to the application server, and the application server can analyze the antivirus results of the above antivirus engines. For example: the same information contained in the killing results obtained above, such as the viruses and infected files found out, can be reconfirmed to determine whether the killing results are correct; Analyze the different parts of the killing results again to finally confirm the virus or infected files.

Secondly, the application server uses multiple antivirus engines to scan and kill viruses locally on the server in turn. The multi-antivirus engine checking and killing method in this way can be used when the first antivirus engine gets the killing result, such as when it contains multiple viruses or infected files, or the virus found is a dangerous virus (such as a very high infection rate). Advanced), or when the infected file found in the killing result is an important file, other antivirus engines can be started in turn to perform another virus killing on the application server. When no virus or infected file is found in the killing result obtained by the first or an antivirus engine in the middle, the virus killing is terminated. In another application scenario in the embodiment, it can also be that when the killing result obtained by the first or the previous antivirus engine does not contain viruses or infected files, in order to prevent missed killing, the following antivirus engine can be started to perform Scanning and killing, when there are two (or more) anti-virus engines in a row that the results of scanning and killing do not contain viruses or infected files, terminate this virus scanning and killing.

Finally, the anti-virus results of the preceding anti-virus engine are sent to the latter anti-virus engine, and the latter anti-virus engine performs virus inspection and killing according to the anti-virus results of the previous anti-virus engine. In this multi-engine scanning method, multiple antivirus engines also perform virus scanning on the application server in sequence. After the current antivirus engine completes the scanning and killing on the application server, the scanning result is obtained. Wherein, the killing result should generally include two parts, one is to confirm that some files do not contain virus or confirmed information of infected files, and the other is to determine whether the remaining files contain suspected information of viruses or infected files. In order to improve the efficiency of checking and killing, the latter antivirus engine can directly check and kill the suspected information part obtained in the previous antivirus engine, that is, check and kill the files that are not sure whether there are viruses or infected files in the part, and finally determine the Kill the results.

Further, when the server obtains at least two antivirus engines supporting the Linux operating system according to the detected version information of the currently running Linux operating system, the antivirus engine with the highest priority is selected for antivirus.

Specifically, firstly, the priority relationship of the antivirus engines may be set, for example, the priority of the antivirus engines may be sorted according to parameters such as the detection rate of the antivirus engines. When the virus server obtains at least two antivirus engines that support the Linux operating system currently running on the application server, the virus server sends these antivirus engines to the application server, and the application server can choose the antivirus engine that supports the application server with the highest priority. installed, so that the application server runs the antivirus engine with the highest priority to scan and kill viruses, which can more effectively scan and kill viruses on the server.

Further, before the virus server detects the version information of the Linux operating system currently running on the application server, it may also firstly perform virus scanning and killing on the server through the cloud engine. Generally, the cloud engine matches the program in the application server with the virus sample in the virus database by constantly updating the virus database. When the matching degree is greater than the threshold, it is judged that the program is a virus. Due to the existence of the isolation network, the cloud engine cannot exchange data with the Internet in a timely and effective manner to update the virus database, so the cloud engine is likely to miss viruses. However, the anti-virus engine involved in the embodiment of the present invention can perform anti-virus through methods such as heuristic anti-virus, and can not rely on the update of the virus database, which greatly improves the efficiency of virus detection and killing. Wherein, the heuristic antivirus refers to detecting and killing viruses by analyzing the behavior of the program when scanning the program.

In the server antivirus method provided in the embodiment of the present invention, in an isolated network environment, by detecting the version information of the Linux operating system currently running on the server, the antivirus engine supporting the Linux operating system is acquired according to the version information, and the obtained antivirus engine is obtained. The antivirus engine is installed in the server so that the server can use the antivirus engine to scan and kill viruses. Compared with the prior art, the present invention installs the anti-virus engine supporting the Linux operating system on the server running the Linux operating system, utilizes the anti-virus engine to check and kill the virus in the server, and avoids the cloud engine inside the isolated network from being unable to pass through. The virus sample library is updated on the external network, which leads to the low virus detection and killing rate of the cloud engine, and the problem that the virus detection and killing of the server installed with the Linux operating system cannot be carried out effectively.

In addition, in the server anti-virus method provided in the embodiment of the present invention, when the server detects that there are multiple anti-virus engines supporting the currently running Linux operating system, all or part of these anti-virus engines can be installed on the server, and multiple anti-virus engines can be installed on the server. Engine antivirus; the server can also select the antivirus engine with the highest priority, and install the antivirus engine on the server to perform virus inspection and killing. In addition, before detecting the version information of the Linux operating system currently running on the server, the cloud engine may be used to scan and kill viruses on the server. Through the server antivirus method provided in the embodiment of the present invention, efficient virus inspection and antivirus can be performed on the server.

The above embodiments of the methods are described by taking the virus server as an example to configure the antivirus engine for the application server. In practical applications, the antivirus engine required by the application server may also be stored in the internal storage space of the application server. The above steps of detecting the version of the operating system and obtaining the corresponding antivirus engine may also be performed by the application server. After detecting the version information of the currently running Linux operating system and obtaining the antivirus engine supporting the Linux operating system, the application server searches for the required antivirus engine from the storage space for the antivirus engine. After the antivirus engine is installed, the application server installs the antivirus engine and runs the antivirus engine to scan and kill viruses. Further, as the implementation of the above-mentioned embodiments, the embodiment of the present invention also provides a server antivirus device, the device is located in the server, by detecting the version information of the Linux operating system currently running on the server, according to the version information to obtain support The antivirus engine of the Linux operating system, and the obtained antivirus engine is installed in the server, so that the server can utilize the antivirus engine to carry out virus inspection and killing, as shown in Figure 2, the device includes: detection unit 10, acquisition unit 20 and installation unit 30.

The detection unit 10 is used to detect the version information of the Linux operating system currently running on the server;

Acquisition unit 20, for obtaining the antivirus engine supporting Linux operating system according to the version information detected by detection unit 10;

The installation unit 30 is configured to install the antivirus engine acquired by the acquisition unit 20 on the server, so that the server runs the antivirus engine to scan and kill viruses.

It should be noted that the server can obtain the required antivirus engine from the virus server through the obtaining unit 20, and can also obtain the required antivirus engine from the local storage space.

Further, as shown in FIG. 3, the acquiring unit 20 also includes:

The mapping module 21 is used to establish a relationship mapping table between the version information of the Linux operating system detected by the detection unit 10 and the antivirus engine, wherein the relationship mapping table includes the corresponding relationship between the version information of the Linux operating system and the antivirus engine.

The acquiring module 22 is configured to acquire the antivirus engine supporting the Linux operating system according to the relational mapping table established by the mapping module 21 .

Further, as shown in FIG. 3 , the installation unit 30 also includes: a setting module 31 , a selection module 32 and an installation module 33 ;

A setting module 31, configured to set the priority relationship between the antivirus engines acquired by the acquisition unit 20;

The selection module 32 is used to determine the antivirus engine that supports the highest server priority according to the priority relationship set by the setting module 31;

The installation module 33 is configured to install the antivirus engine with the highest priority determined by the selection module 31 on the server, so that the server runs the antivirus engine with the highest priority to scan and kill viruses.

Further, as shown in FIG. 3 , the server antivirus device provided in the embodiment of the present invention further includes: a cloud engine antivirus unit 40;

The cloud engine antivirus unit 40 is configured to perform cloud engine antivirus on the server. Wherein, the cloud engine antivirus unit 40 is connected to the detection unit 10, and is executed before the detection unit 10 detects the version information of the Linux operating system currently running on the server.

It should be noted that, in practical applications, the server antivirus device provided in the embodiment of the present invention may be located in a virus server or an application server. When the server antivirus device provided by the embodiment is located in the virus server, the virus server completes the detection of the version information of the Linux operating system currently running on the application server, and sends the antivirus engine supporting the Linux operating system to the application server, so that The application server completes the installation and startup of the antivirus engine, which is used to scan and kill viruses on the application server. When the server antivirus device provided by the embodiment is located in the application server, the application server detects the version information of the currently running Linux operating system locally, and the application server acquires an antivirus engine supporting the Linux operating system, installs the antivirus engine and Run to complete the virus scanning and killing of itself.

The server antivirus device provided in the embodiment of the present invention, in the isolated network environment, by detecting the version information of the Linux operating system currently running on the server, obtains the antivirus engine supporting the Linux operating system according to the version information, and will obtain the antivirus engine. The antivirus engine is installed in the server so that the server can use the antivirus engine to scan and kill viruses. Compared with the prior art, the present invention installs the anti-virus engine supporting the Linux operating system on the server running the Linux operating system, utilizes the anti-virus engine to check and kill the virus in the server, and avoids the cloud engine inside the isolated network from being unable to pass through. The virus sample library is updated on the external network, which leads to the low virus detection and killing rate of the cloud engine, and the problem that the virus detection and killing of the server installed with the Linux operating system cannot be carried out effectively.

In addition, the server anti-virus device provided in the embodiment of the present invention, when the server detects that there are multiple anti-virus engines supporting the currently running Linux operating system, these anti-virus engines can be installed or partially installed on the server, and multiple anti-virus engines can be installed on the server. Engine antivirus; the server can also select the antivirus engine with the highest priority, and install the antivirus engine on the server to perform virus inspection and killing. In addition, before detecting the version information of the Linux operating system currently running on the server, the cloud engine may be used to scan and kill viruses on the server. Through the server antivirus device provided in the embodiment of the present invention, efficient virus inspection and antivirus can be performed on the server.

Further, as the realization of the above-mentioned embodiments, the embodiment of the present invention also provides a server antivirus system, which can be deployed in an isolated network environment. The system detects the version information of the Linux operating system currently running on the server, obtains an antivirus engine that supports the currently running Linux operating system according to the version information, and installs the antivirus engine on the server so that the server can run the antivirus engine for virus detection. kill. As shown in FIG. 4 , the system includes: a virus server 50 and an application server 60 .

The virus server 50 is used to detect the version information of the currently running Linux operating system; obtain an antivirus engine supporting the Linux operating system according to the version information of the currently running Linux operating system; send the antivirus engine to the application server 60 .

The application server 60 is configured to receive the antivirus engine and install the antivirus engine locally, and run the antivirus engine to scan and kill viruses.

Specifically, the application server 60 includes many types and quantities of servers, such as file servers and mail servers. These application servers are mainly installed with a Linux operating system. Taking the file server in the application server 60 as an example, as shown in Figure 5, In the computer local area network, with the goal of file data sharing, it is necessary to store the files shared by multiple computers in one computer, and this computer can become a file server. Since the file server is connected to many terminals and performs file sharing, the security of the file server is the primary issue. Once the file server is infected by a virus, it will cause serious consequences.

Therefore, utilize the server antivirus system provided by the present invention, the virus server 50 sends the antivirus engine that supports the Linux operating system to the file server by detecting the version information of the Linux operating system currently running on the file server, and the file server receives and passes the antivirus The engine is installed locally, so that the file server starts the antivirus engine to scan and kill the virus of the local shared files and transmitted data, which can efficiently scan and kill the virus on the file server, ensuring the security of the data on the file server and the terminal.

The server antivirus system provided in the embodiment of the present invention, by detecting the version information of the Linux operating system currently running on the server, obtains the antivirus engine supporting the Linux operating system according to the version information, and installs the obtained antivirus engine into the server, So that the server can use the antivirus engine to scan and kill viruses. Compared with the prior art, the present invention installs the anti-virus engine supporting the Linux operating system on the server running the Linux operating system, utilizes the anti-virus engine to check and kill the virus in the server, and avoids the cloud engine inside the isolated network from being unable to pass through. The virus sample library is updated on the external network, which leads to the low virus detection and killing rate of the cloud engine, and the problem that the virus detection and killing of the server installed with the Linux operating system cannot be carried out effectively.

In addition, in the server anti-virus system provided in the embodiment of the present invention, when the server detects that there are multiple anti-virus engines supporting the currently running Linux operating system, these anti-virus engines can be installed or partially installed on the server, and multiple anti-virus engines can be installed on the server. Engine antivirus; the server can also select the antivirus engine with the highest priority, and install the antivirus engine on the server to perform virus inspection and killing. In addition, before detecting the version information of the Linux operating system currently running on the server, the cloud engine can be used to scan and kill viruses on the server. Through the server antivirus system provided in the embodiment of the present invention, efficient virus inspection and antivirus can be performed on the server.

The present invention also provides the following technical solutions:

A1, a method for server antivirus, said method comprising:

Detect the version information of the Linux operating system currently running on the server;

Obtain an antivirus engine supporting the Linux operating system according to the version information;

The antivirus engine is installed on the server, so that the server runs the antivirus engine to scan and kill viruses.

A2. The method according to claim A1, said obtaining an antivirus engine supporting said Linux operating system according to said version information, comprising:

Establishing a relationship mapping table between the version information of the Linux operating system and the antivirus engine, the relationship mapping table including the corresponding relationship between the version information and the antivirus engine;

An antivirus engine supporting the Linux operating system is obtained according to the relational mapping table.

A3. The method according to claim A1, said installing said antivirus engine on said server, comprising:

When the number of antivirus engines supporting the Linux operating system is at least two, the at least two antivirus engines are installed on the server, so that the server runs the at least two antivirus engines for multiple Engine virus detection and killing.

A4. The method according to claim A1, said installing said antivirus engine on said server, comprising:

When obtaining at least two antivirus engines supporting the Linux operating system, set the priority relationship between the antivirus engines;

Determine the antivirus engine that supports the server with the highest priority;

The antivirus engine with the highest priority is installed on the server, so that the server runs the antivirus engine with the highest priority to scan and kill viruses.

A5. The method according to claim A1, before detecting the version information of the Linux operating system currently running on the server, further comprising: performing cloud engine antivirus on the server.

A6. The method according to claim A1, wherein the antivirus engine comprises: an artificial intelligence engine QVM and a heuristic antivirus engine AVE;

Said QVM and AVE respectively support Ubuntu, community enterprise operating system CentOS and Red Hat RedHat operating system.

B7, a device for server antivirus, said device comprising:

The detection unit is used to detect the version information of the Linux operating system currently running on the server;

An acquisition unit, configured to acquire an antivirus engine supporting the Linux operating system according to the version information detected by the detection unit;

The installation unit is configured to install the antivirus engine acquired by the acquisition unit on the server, so that the server runs the antivirus engine to perform virus scanning and killing.

B8. The device according to claim B7, the acquisition unit comprising: a mapping module and an acquisition module;

The mapping module is configured to establish a relationship mapping table between the version information of the Linux operating system detected by the detection unit and the antivirus engine, and the relationship mapping table includes the version information and the antivirus engine Correspondence between;

The acquiring module is configured to acquire an antivirus engine supporting the Linux operating system according to the relational mapping table established by the mapping module.

B9. The device according to claim B7, the installation unit comprising: a setting module, a selection module and an installation module;

The setting module is configured to set the priority relationship between the antivirus engines acquired by the acquisition unit;

The selection module is configured to determine the antivirus engine that supports the server with the highest priority according to the priority relationship set by the setting module;

The installation module is configured to install the antivirus engine with the highest priority determined by the selection module on the server, so that the server runs the antivirus engine with the highest priority to scan and kill viruses.

B10. The device according to claim B7, said device further comprising: a cloud engine antivirus unit;

The cloud engine antivirus unit is configured to perform cloud engine antivirus on the server.

B11. The device according to any one of claims B7-B10, the antivirus engine comprising: an artificial intelligence engine QVM and a heuristic antivirus engine AVE;

Said QVM and AVE respectively support Ubuntu, community enterprise operating system CentOS and Red Hat RedHat operating system.

C12. A system for server antivirus, said system comprising: a virus server and an application server, wherein said virus server comprises the device according to any one of claims B7-B11;

The virus server is used to detect the version information of the currently running Linux operating system; obtain an antivirus engine supporting the Linux operating system according to the version information; send the antivirus engine to the application server;

The application server is configured to receive and install the antivirus engine, and run the antivirus engine to scan and kill viruses.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

It can be understood that related features in the above methods and devices can refer to each other. In addition, "first", "second" and so on in the above embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the components in the title of the invention (such as the device for determining the link level in the website) according to the embodiment of the present invention some or all of the features. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (10)

1. A method for server antivirus, characterized in that the method comprises: Detect the version information of the Linux operating system currently running on the server; Obtain an antivirus engine supporting the Linux operating system according to the version information; The antivirus engine is installed on the server, so that the server runs the antivirus engine to scan and kill viruses. 2. The method according to claim 1, wherein said acquisition of an antivirus engine supporting said Linux operating system according to said version information comprises: Establishing a relationship mapping table between the version information of the Linux operating system and the antivirus engine, the relationship mapping table including the corresponding relationship between the version information and the antivirus engine; An antivirus engine supporting the Linux operating system is acquired according to the relational mapping table. 3. The method according to claim 1, wherein the installation of the antivirus engine on the server comprises: When the number of antivirus engines supporting the Linux operating system is at least two, the at least two antivirus engines are installed on the server, so that the server runs the at least two antivirus engines for multiple Engine virus detection and killing. 4. The method according to claim 1, wherein the installation of the antivirus engine on the server comprises: When obtaining at least two antivirus engines supporting the Linux operating system, set the priority relationship between the antivirus engines; Determine the antivirus engine that supports the server with the highest priority; The antivirus engine with the highest priority is installed on the server, so that the server runs the antivirus engine with the highest priority to scan and kill viruses. 5. The method according to claim 1, wherein the antivirus engine comprises: an artificial intelligence engine QVM and a heuristic antivirus engine AVE; Said QVM and AVE respectively support Ubuntu, community enterprise operating system CentOS and Red Hat RedHat operating system. 6. A device for server antivirus, characterized in that the device comprises: The detection unit is used to detect the version information of the Linux operating system currently running on the server; An acquisition unit, configured to acquire an antivirus engine supporting the Linux operating system according to the version information detected by the detection unit; The installation unit is configured to install the antivirus engine acquired by the acquisition unit on the server, so that the server runs the antivirus engine to perform virus scanning and killing. 7. The device according to claim 6, wherein the acquiring unit comprises: a mapping module and an acquiring module; The mapping module is configured to establish a relationship mapping table between the version information of the Linux operating system detected by the detection unit and the antivirus engine, and the relationship mapping table includes the version information and the antivirus engine Correspondence between; The acquiring module is configured to acquire an antivirus engine supporting the Linux operating system according to the relational mapping table established by the mapping module. 8. The device according to claim 6, wherein the installation unit comprises: a setting module, a selection module and an installation module; The setting module is configured to set the priority relationship between the antivirus engines acquired by the acquisition unit; The selection module is configured to determine the antivirus engine that supports the server with the highest priority according to the priority relationship set by the setting module; The installation module is configured to install the antivirus engine with the highest priority determined by the selection module on the server, so that the server runs the antivirus engine with the highest priority to scan and kill viruses. 9. The device according to any one of claims 6-8, wherein the antivirus engine comprises: an artificial intelligence engine QVM and a heuristic antivirus engine AVE; Said QVM and AVE respectively support Ubuntu, community enterprise operating system CentOS and Red Hat RedHat operating system. 10. A server antivirus system, characterized in that the system comprises: a virus server and an application server, wherein the virus server comprises the device according to any one of claims 6-9; The virus server is used to detect the version information of the currently running Linux operating system; obtain an antivirus engine supporting the Linux operating system according to the version information; send the antivirus engine to the application server; The application server is configured to receive and install the antivirus engine, and run the antivirus engine to scan and kill viruses.