FREQUENCY-VARIABLE ANTI-VIRUS TECHNOLOGY

• US 20140351936A1
• Filed: 12/19/2011
• Published: 11/27/2014
• Est. Priority Date: 12/19/2011
• Status: Abandoned Application

• Current Assignee: Beijing Rising Information Technology Co., Ltd.
• Original Assignee: Beijing Rising Information Technology Co., Ltd.
• Inventors: Hao, Xiaojun
• Application Number:
  US14/366,693
• Publication Number:
  US 20140351936A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]

Abstract

A frequency-variable anti-virus technology relates to a method and apparatus for dynamically adjusting an amount of system resources occupied by security protection software running on a user device. The method comprises: collecting, by the security protection software, state information associated with the user device; calculating the expected operating intensity of the security protection software based on the state information; and operating the security protection software based on the calculated expected operating intensity, so as to adjust the amount of system resources occupied by the security protection software. The apparatus may comprise means for performing the abovementioned steps, respectively. The method and apparatus may be used to dynamically adjust an operating policy of the security protection software, so as to more rationally allocate system resources among the software of the user device, thus improving the usage efficiency of the system resources and improving the usage experience of the user.

Claims

1. A method for dynamically adjusting an amount of system resources occupied by security protection software running on a user device, the method comprises:

collecting, by the security protection software, state information associated with the user device;

calculating an expected operating intensity of the security protection software based on the state information; and

operating the security protection software based on the calculated expected operating intensity, so as to adjust the amount of system resources occupied by the security protection software.

2. The method according to claim 1, wherein the state information includes:

timing, type, number of times and/or frequency of an operation performed by a user of the user device; and

/or

software environment information and/or hardware environment information of the user device.

3. The method according to claim 2, wherein the operation performed by the user is directly obtained from a driver layer, so as to avoid a collision with other software running on the user device.

4. The method according to claim 2, wherein the software environment information and/or hardware environment information includes at least one of:

a size of memory of the user device, a usage condition of the memory of the user device, a speed of a processor of the user device, a usage condition of the processor of the user device, information of processes currently running on the user device, a current network connection condition of the user device, a current bandwidth usage condition of the user device, and a usage condition of an input device of the user device.

5. The method according to claim 4, further comprises:

reducing an amount of various network request data associated with the security protection software if the network connection condition belongs to per-flow accounting.

6. The method according to claim 1, wherein the state information includes state information at present and/or in a past period of time.

7. The method according to claim 1, wherein the operating intensity includes an operating frequency of a thread of the security protection software.

8. The method according to claim 1, wherein the operating intensity does not have a limited number of fixed levels assigned thereto, such that the operating intensity is adjusted without being limited to the fixed levels.

9. The method according to claim 1, wherein a gradual change policy is used if the operating intensity of the security protection software is to be increased, and a sudden change policy is used if the operating intensity of the security protection software is to be decreased.

10. The method according to claim 5, wherein

the operation performed by the user is directly obtained from a driver layer, so as to avoid a collision with other software running on the user device;

the state information includes state information at present and/or in a past period of time;

the operating intensity includes an operating frequency of a thread of the security protection software;

the operating intensity does not have a limited number of fixed levels assigned thereto, such that the operating intensity is adjusted without being limited to the fixed levels; and

a gradual change policy is used if the operating intensity of the security protection software is to be increased, and a sudden change policy is used if the operating intensity of the security protection software is to be decreased.

11. An apparatus for dynamically adjusting an amount of system resources occupied by security protection software running on a user device, the apparatus comprises:

means for causing the security protection software to collect state information associated with the user device;

means for calculating an expected operating intensity of the security protection software based on the state information; and

means for operating the security protection software based on the calculated expected operating intensity, so as to adjust the amount of system resources occupied by the security protection software.

12. The apparatus according to claim 11, wherein the state information includes:

timing, type, number of times and/or frequency of an operation performed by a user of the user device; and

/or

software environment information and/or hardware environment information of the user device.

13. The apparatus according to claim 12, wherein the operation performed by the user is directly obtained from a driver layer, so as to avoid a collision with other software running on the user device.

14. The apparatus according to claim 12, wherein the software environment information and/or hardware environment information includes at least one of:

a size of memory of the user device, a usage condition of the memory of the user device, a speed of a processor of the user device, a usage condition of the processor of the user device, information of processes currently running on the user device, a current network connection condition of the user device, a current bandwidth usage condition of the user device, and a usage condition of an input device of the user device.

15. The apparatus according to claim 14, further comprises:

means for reducing an amount of various network request data associated with the security protection software if the network connection condition belongs to per-flow accounting.

16. The apparatus according to claim 11, wherein the state information includes state information at present and/or in a past period of time.

17. The apparatus according to claim 11, wherein the operating intensity includes an operating frequency of a thread of the security protection software.

18. The apparatus according to claim 11, wherein the operating intensity does not have a limited number of fixed levels assigned thereto, such that the operating intensity is adjusted without being limited to the fixed levels.

19. The apparatus according to claim 11, wherein a gradual change policy is used if the operating intensity of the security protection software is to be increased, and a sudden change policy is used if the operating intensity of the security protection software is to be decreased.

20. The apparatus according to claim 15, wherein

the operation performed by the user is directly obtained from a driver layer, so as to avoid a collision with other software running on the user device;

the state information includes state information at present and/or in a past period of time;

the operating intensity includes an operating frequency of a thread of the security protection software;

the operating intensity does not have a limited number of fixed levels assigned thereto, such that the operating intensity is adjusted without being limited to the fixed levels; and

a gradual change policy is used if the operating intensity of the security protection software is to be increased, and a sudden change policy is used if the operating intensity of the security protection software is to be decreased.