Abstract: The present invention provides a method, apparatus, system, device and a computer storage medium for treating virus. A client reports a scan log to a cloud service platform, and/or reports virus family information to the cloud service platform after the virus family information is identified based on the scan log. The cloud service platform identifies the scan log to obtain virus family information, and/or issues the virus removal instruction corresponding to the virus family information to the client after receiving the virus family information from the client, for the client to execute the virus removal instruction. Compared with the method of simply performing the behavior analysis and deleting files by the client, it is more advantageous that the method of the present invention issues virus removal instructions regarding the virus family information from the cloud, the virus treating is more personalized and precise, and the security of the machine system is improved.

Abstract: A method, apparatus and system for detecting a malicious process behavior. A detection apparatus monitors a process to obtain behavior information about a target process behavior, and then sends the behavior information to a server, which determines whether the target process behavior is a malicious process behavior. The detection apparatus can receive first operation indication information returned by the server according to a detection result of the target process behavior, and perform an operation on the target process behavior according to the first operation indication information. The target process behavior is subjected to a comprehensive detection by the server according to the behavior information, rather than depending on a specified feature analysis of a single sample of the target process behavior by the detection apparatus, so that malicious process behavior can be detected in time, thereby improving the security performance of the system.

Abstract: The present invention provides a method, apparatus, system, device and a computer storage medium for treating virus. A client reports a scan log to a cloud service platform, and/or reports virus family information to the cloud service platform after the virus family information is identified based on the scan log. The cloud service platform identifies the scan log to obtain virus family information, and/or issues the virus removal instruction corresponding to the virus family information to the client after receiving the virus family information from the client, for the client to execute the virus removal instruction. Compared with the method of simply performing the behavior analysis and deleting files by the client, it is more advantageous that the method of the present invention issues virus removal instructions regarding the virus family information from the cloud, the virus treating is more personalized and precise, and the security of the machine system is improved.

Abstract: A method, apparatus and system for detecting a malicious process behavior. A detection apparatus monitors a process to obtain behavior information about a target process behavior, and then sends the behavior information to a server, which determines whether the target process behavior is a malicious process behavior. The detection apparatus can receive first operation indication information returned by the server according to a detection result of the target process behavior, and perform an operation on the target process behavior according to the first operation indication information. The target process behavior is subjected to a comprehensive detection by the server according to the behavior information, rather than depending on a specified feature analysis of a single sample of the target process behavior by the detection apparatus, so that malicious process behavior can be detected in time, thereby improving the security performance of the system.

Abstract: In general, techniques are described for managing timers for large scale service statistics collection. For example, as described herein, a network device includes a timing wheel data structure defining a plurality of slots. A rate limiter selects up to a rate limit value of timer events stored in a first one of the slots, wherein the rate limit value is less than a total number of the plurality of timer events stored in the first one of the time slots. A timer service module services the selected timer events during the first time interval, wherein the timer service module defers at least one of the unserviced timer events from the first one of the slots to a second one of the slot. During a second time interval, the timer service module services at least one of the timer events deferred from the first one of the slots.