云防御系统中多引擎检测机制

云防御系统中多引擎检测机制 Multi-Engine Detection in Cloud-Based Defence System 羌卫中 QIANG Weizhong 1 first-author 秦攀 QIN Pan 1 邹德清 ZOU Deqing 1 文子龙 WEN Zilong 1 华中科技大学计算机科学与技术学院 华中科技大学计算机科学与技术学院 School of Computer Science and Technology,Huazhong University of Science and Technology School of Computer Science and Technology,Huazhong University of Science and Technology 通过在云端构建多种类型的检测引擎为客户端提供安全防御.将传统安装在客户端的杀毒引擎移入云端,客户端只保留轻量级的主机入侵防御软件,拦截本地的文件访问,并把文件上传到云端进行多引擎的扫描,云端使用综合决策算法进行检测.为了测试系统检测率,使用1 789个恶意代码样本进行扫描,系统的综合检测率达到95.6%.测试结果表明,使用多引擎检测能为客户端提供多角度和全方位的安全防御. This paper attempts to move traditional host-based antivirus engine into the cloud.We propose a mechanism in which the clients only keep the lightweight host intrusion prevention functionality,the local file interception functionality,and upload the file to the cloud for multi-engine scanning.The cloud service uses comprehensive decision-making algorithm to process the independent scanning results.In order to test the applicability of the cloud defense system,all kinds of malwares are running in clients,the cloud service successfully detects those malwares.The cloud also scans 1 789 malware samples and achieves a detection rate of 95.6%.The evaluation shows that the multiengine detection can provide a full range of security defense for clients. 恶意代码检测 多引擎检测 综合决策 证据理论 主动防御 malware detection multi-engine detection comprehensive decision-making evidence theory active defense 10.14188/j.1671-8836.2014.05.003 TP393.08 国家高技术研究发展计划（973）项目（2012AA012600） 2014-05-01 2021-04-01 5 60