一种特征代码过滤方法的改进  

IMPROVING THE METHOD OF CHARACTERISTIC CODE FILTERING

作　　者：马金鑫[1,2] 袁丁[1] 

机构地区：[1]四川师范大学计算机科学学院,四川成都610101 [2]四川省计算机研究院,四川成都610041

出　　处：《计算机应用与软件》2010年第8期286-288,共3页Computer Applications and Software

基　　金：国家自然科学基金项目(60473030);四川省科技厅科技攻关项目(05GG007-008)

摘　　要：特征代码检测方法是一种严谨的病毒检测解决方法,在病毒防杀领域应用很广泛,具有较大的研究价值。对几种病毒检测技术分析研究,并且以文件过滤驱动的方法对特征代码检测方法进行了实现,针对这种方法的缺点提出了优化方案,添加专门的内核线程负责处理规则匹配。经过测试表明,优化方案比原有的方法处理速度更快。Characteristic code detection is a conscientious and careful solution of virus detection, which is used widely in virus defence and killing area, and is highly valuable to research. In the paper we analyzed and studied a couple of virus detection technologies, and realized the characteristic code detection based on file filter driver. We proposed to optimise this method in allusion to its disadvantages by adding special kernel thread to deal with the rule matching. According to the test, the method can work faster than the original one.

关 键 词：文件过滤驱动 特征代码 内核线程 

分 类 号：TP311.56[自动化与计算机技术—计算机软件与理论]