Abstract: The present disclosure provides a virus signature matching method, including: obtaining an inputted target file; loading a virus signature database, and successively extracting signature function identifiers from the virus signature database, the virus signature database comprising the signature function identifiers and virus signature type identifiers corresponding to the signature function identifiers; obtaining signature functions corresponding to the signature function identifiers, and checking the target file by invoking the signature functions, to obtain corresponding check results; and obtaining a virus signature type identifier corresponding to the target file according to the check results. In addition, a virus signature matching apparatus is further provided. The foregoing virus signature matching method and apparatus can improve virus scanning and removing efficiency.

Abstract: The present disclosure provides a virus signature matching method, including: obtaining an inputted target file; loading a virus signature database, and successively extracting signature function identifiers from the virus signature database, the virus signature database comprising the signature function identifiers and virus signature type identifiers corresponding to the signature function identifiers; obtaining signature functions corresponding to the signature function identifiers, and checking the target file by invoking the signature functions, to obtain corresponding check results; and obtaining a virus signature type identifier corresponding to the target file according to the check results. In addition, a virus signature matching apparatus is further provided. The foregoing virus signature matching method and apparatus can improve virus scanning and removing efficiency.

Abstract: A method, a device and a system for identifying script virus are provided to improve identification rate of the script virus. The method includes: loading a script file runtime environment; setting, in the script file runtime environment, a characteristic function capturing function, correspondence between the characteristic function capturing function and a characteristic function, and a virus characteristic, by loading and running a characteristic script in the script file runtime environment; searching for the characteristic function in a script to be searched by loading and running the script to be searched in the script file runtime environment, replacing the characteristic function with the corresponding characteristic function capturing function, and obtaining executable codes in the characteristic function; determining whether the executable codes meet the virus characteristic; and reporting that the script to be searched is script virus if the executable codes meet the virus characteristic.

Abstract: A method and device for processing data in the field of data process are disclosed. The method includes: sorting samples according to primary keys, wherein the primary key includes a feature serial number and a sample serial number, and wherein a column value corresponding to the primary key is used as a feature value for the sample; acquiring a statistic of each feature in each category by taking the primary key and the feature value as an input key-value pair and calculating with a first algorithm model, and outputting the feature serial number and the statistic as an output key-value pair; and acquiring a contribution value of each feature to the category by performing calculation on the output key-value pair with a second algorithm model, and selecting a feature based on the contribution value. The device includes a sorting module, a first processing module and a second processing module.

Abstract: A data processing method is provided, which includes: performing a fingerprint calculation for each data element of a set of data elements to obtain fingerprint information of the data elements; grouping the data elements into data groups in accordance with the fingerprint information, including by grouping data elements with the same fingerprint information into a same data group; and selecting a particular data element from each of the data groups for modeling calculation. A corresponding device is described. With the technical solutions according to the present method, data processing amount for modeling calculation may be reduced, which may thereby reduce data processing time and improve the data processing efficiency.