反病毒引擎可扩展框架的研究与实现

摘要

Anti-virus engine depends too much upon signatures database and each detection modules couples tightly.To solve this problem, this paper presented an extensible framework.It decoupled function modules and data modules by using intelligent signatures and decomposing composite modules, used inversion of control to change control coupling into interface coupling in modules of anti-virus engine.The extensible framework not only solves the disadvantages of anti-virus software, but also can be applied to the design of embedded security device.Implemented a prototvpe to verify the validity of the design scheme and core algorithm.The experimental results show that the novel anti-virus engine can detect virus more effectively than traditional model.%针对当前反病毒软件中引擎对特征码数据库过分依赖和各功能模块间耦合度大的问题,提出了一个可扩展的引擎框架,利用智能特征码和分解复合检测活动的方法实现了功能与数据的解耦合,应用控制反转的思想将功能模块之间控制耦合转换为接口耦合.该引擎框架不仅解决了当前反病毒引擎缺乏可扩展性的问题,而且能方便地应用到嵌入式安全设备的设计中.原型系统验证了设计方案和核心算法的有效性,实验结果表明其具有较好的检测性能.