CN108133154B - Method and device for storing file - Google Patents

Abstract

The embodiment of the present invention discloses a method and device for storing a file. After receiving the target file, the method obtains the target storage space value of the target file, and if the target storage space value is small, the target file is stored. Go to the first storage medium with a faster file reading speed, perform virus detection and killing scanning on the target file on the first storage medium, and store the target file that does not carry viruses to the first storage medium with a slower file reading speed but larger storage capacity. 2. Storage medium. The method takes into account the nature of the storage medium, so that the target file with a smaller target storage space value is scanned for viruses in the first storage medium with a faster file reading speed, which improves the speed of virus detection and scanning and avoids the need for It solves the problem of excessive consumption of IO overhead caused by virus killing and scanning in the second storage medium with a slow file reading speed.

Description

A method and device for storing files

technical field

The present invention relates to the technical field of network security, and in particular, to a method and device for storing files.

Background technique

Both the magnetic disk and the memory are carriers used for storing information in the computer field, wherein the magnetic disk includes a hard disk and a floppy disk. Generally speaking, disk has more storage space but slower reading speed, while memory has less storage space but faster reading speed. Usually, after a terminal or a computer receives a file, it directly places the file on the disk for processing, stores the file in the disk, and then performs virus checking and killing on the file.

Based on this, although it is feasible to store the received files in the disk and then perform virus scanning and killing, this method leads to a large IO overhead of the disk, especially when the received files occupy a small storage space, which is more critical to performance. consumption.

In the process of implementing the embodiments of the present invention, the inventor found that the existing method of directly storing files in a disk for virus detection and killing does not fully utilize the properties of the storage medium, resulting in excessive consumption of IO overhead.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is how to solve the problem that the existing method of directly storing files in a disk for virus detection and killing does not fully utilize the properties of the storage medium, resulting in excessive consumption of IO overhead.

In view of the above technical problems, embodiments of the present invention provide a method for storing files, including:

Obtaining the target storage space value that needs to be occupied to store the target file, and if the target storage space value is less than the first storage space value, then storing the target file in the first storage medium;

Perform virus killing scanning on the target file to obtain a first scanning result;

If the first scan result is that the target file does not carry a virus, storing the target file in a second storage medium;

Wherein, the reading speed of the file in the first storage medium is greater than the reading speed of the file in the second storage medium.

Optionally, performing virus detection and killing scanning on the target file to obtain a first scan result, including:

If the target storage space value is greater than the second storage space value, perform virus scanning and killing scanning on the target file through cloud scanning and killing to obtain the first scanning result;

If the target storage space value is less than or equal to the second storage space value and greater than the third storage space value, perform virus detection and killing scanning on the target file through local killing to obtain the first scan result;

If the target storage space value is less than or equal to the third storage space value, perform virus detection and killing scanning on the target file through local scanning or cloud scanning to obtain the first scanning result;

Wherein, the local killing is heuristic killing or QEX script killing.

Optionally, also include:

If the first scan result is that the target file carries a virus, then determine whether the target file can be repaired as a first security file that does not carry a virus;

If the target file can be repaired into the first security file, repairing the target file into the first security file, and storing the first security file in the second storage medium;

If the target file cannot be restored to the first security file, the target file is deleted or the target file is stored in the virus isolation area of the second storage medium.

Optionally, also include:

If the target storage space value is greater than or equal to the first storage space value, the target file is stored in the second storage medium, and the target file is scanned for virus killing to obtain a second scan result;

If the second scan result is that the target file carries a virus, then determine whether the target file can be repaired to a second security file that does not carry viruses, and if so, repair the target file to the second security file , otherwise, delete the target file or store the target file in the virus quarantine area in the second storage medium

In a second aspect, an embodiment of the present invention also provides a device for storing files, including:

a first storage module, configured to obtain a target storage space value that needs to be occupied to store a target file, and if the target storage space value is less than the first storage space value, store the target file in the first storage medium;

a scanning module, configured to perform virus killing scanning on the target file to obtain a first scanning result;

a second storage module, configured to store the target file in a second storage medium if the first scan result is that the target file does not carry a virus;

Wherein, the reading speed of the file in the first storage medium is greater than the reading speed of the file in the second storage medium.

Optionally, the scanning module is further configured to, if the target storage space value is greater than the second storage space value, perform virus scanning and killing scanning on the target file through cloud scanning and killing to obtain the first scanning result; The target storage space value is less than or equal to the second storage space value and greater than the third storage space value, then the target file is scanned for viruses through local anti-virus to obtain the first scan result; If the target storage space value is less than or equal to the third storage space value, the target file is scanned for viruses through local scanning or cloud scanning to obtain the first scanning result; wherein, the local scanning Kill is heuristic killing or QEX script killing.

Optionally, the second storage module is further configured to determine whether the target file can be repaired as a first security file that does not carry a virus if the first scan result is that the target file carries a virus; If the target file can be repaired as the first security file, then the target file is repaired as the first security file, and the first security file is stored in the second storage medium; if the target file cannot be repaired as the first security file the first security file, delete the target file or store the target file in the virus isolation area in the second storage medium.

Optionally, the first storage module is further configured to store the target file in the second storage medium if the target storage space value is greater than or equal to the first storage space value, and store the target file in the second storage medium. The file is scanned for virus killing, and a second scan result is obtained; if the second scan result is that the target file carries a virus, it is determined whether the target file can be repaired as a second security file that does not carry a virus, and if so, then Repair the target file as the second security file, otherwise, delete the target file or store the target file in the virus isolation area of the second storage medium.

In a third aspect, an embodiment of the present invention also provides an electronic device, including:

at least one processor, at least one memory, a communication interface, and a bus; wherein,

The processor, the memory, and the communication interface communicate with each other through the bus;

The communication interface is used for information transmission between the electronic device and the communication device of the server or the communication device of the terminal;

The memory stores program instructions executable by the processor, and the processor invokes the program instructions to perform any of the methods described above.

In a fourth aspect, embodiments of the present invention further provide a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute any of the above the method described

Embodiments of the present invention provide a method and device for storing a file. After receiving the target file, the method obtains the target storage space value of the target file, and if the target storage space value is small, the target file is stored Go to the first storage medium with a faster file reading speed, perform virus detection and killing scanning on the target file on the first storage medium, and store the target file that does not carry viruses to the first storage medium with a slower file reading speed but larger storage capacity. 2. Storage medium. The method takes into account the nature of the storage medium, so that the target file with a smaller target storage space value is scanned for viruses in the first storage medium with a faster file reading speed, which improves the speed of virus detection and scanning and avoids the need for It solves the problem of excessive consumption of IO overhead caused by virus killing and scanning in the second storage medium with a slow file reading speed.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a schematic flowchart of a method for storing a file provided by an embodiment of the present invention;

2 is a schematic diagram of a process of upgrading a virus database and a file scanning engine that are locally checked and killed in a proxy server provided by another embodiment of the present invention;

3 is a structural block diagram of a device for storing files provided by another embodiment of the present invention;

FIG. 4 is a structural block diagram of an electronic device provided by another embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is a schematic flowchart of a method for storing a file provided in this embodiment. Referring to FIG. 1 , the method includes:

101: Obtain a target storage space value that needs to be occupied to store a target file, and if the target storage space value is less than a first storage space value, store the target file in a first storage medium;

102: Perform virus killing scanning on the target file to obtain a first scanning result;

103: If the first scan result is that the target file does not carry a virus, store the target file in a second storage medium;

Wherein, the file reading speed of the first storage medium is greater than the file reading speed of the second storage medium; the first storage space value is less than or equal to the available storage space value of the first storage medium.

It should be noted that, the method provided in this embodiment is executed by a server or a terminal (for example, a mobile phone or a computer), for example, by a proxy server (such as Nginx). The target file is a file to be stored in the server or terminal. The target file may be a received file sent by other devices (server or terminal), or a file uploaded through a data line, which is not specifically limited in this embodiment.

After receiving the target file, the target storage space value may be obtained through attribute information carried by the target file, or the target storage space value of the target file may be detected by software, which is not specifically limited in this embodiment. For example, the target storage space value of the target file is 78M. The first storage space value is generally determined according to the available storage space value of the first storage medium, wherein the first storage space value is less than or equal to the available storage space value (remaining storage space value) of the first storage medium. For example, if the available storage space value of the first storage medium is 150M, the first storage space value is set to 100M. Usually, the storage capacity (maximum storage space value) of the first storage medium is smaller than the storage capacity (maximum storage space value) of the second storage medium, but the file reading speed corresponding to the first storage medium is greater than that of the second storage medium File read speed. For example, the first storage medium is a memory, and the second storage medium is a magnetic disk.

Scanning the target file for viruses can only scan the target file through the local anti-virus in the server or terminal, or scan the target file only through the cloud anti-virus, or use both local anti-virus and cloud anti-virus scanning. Scan the target file, which is not specifically limited in this embodiment.

An embodiment of the present invention provides a method for storing a file. After receiving the target file, the method obtains the target storage space value of the target file, and if the target storage space value is small, the target file is stored in the file The first storage medium with a faster reading speed, the target file is scanned for viruses in the first storage medium, and the target file that does not carry viruses is stored in the second storage medium with a slower file reading speed but a larger storage capacity. storage medium. The method takes into account the nature of the storage medium, so that the target file with a smaller target storage space value is scanned for viruses in the first storage medium with a faster file reading speed, which improves the speed of virus detection and scanning and avoids the need for It solves the problem of excessive consumption of IO overhead caused by virus killing and scanning in the second storage medium with a slow file reading speed.

Further, on the basis of the above embodiment, the virus detection and killing scan is performed on the target file to obtain a first scan result, including:

If the target storage space value is greater than the second storage space value, perform virus scanning and killing scanning on the target file through cloud scanning and killing to obtain the first scanning result;

If the target storage space value is less than or equal to the second storage space value and greater than the third storage space value, perform virus detection and killing scanning on the target file through local killing to obtain the first scan result;

If the target storage space value is less than or equal to the third storage space value, perform virus detection and killing scanning on the target file through local scanning or cloud scanning to obtain the first scanning result;

Wherein, the local killing is heuristic killing or QEX script killing.

It should be noted that local inspection and killing of target files with large target storage space values takes longer than cloud inspection and killing, and local inspection and killing of target files with small target storage space values is longer than cloud inspection and killing. Killing time is shorter. Therefore, in order to improve the speed of virus detection and killing scanning on the target file, this embodiment provides determining which detection and killing method is used to perform virus detection and killing scanning on the target file according to the size of the target storage space value.

The second storage space value and the third storage space value are both values set according to the relationship between the local and cloud scanning time and the storage space occupied by the file. For example, the second storage space value is 100M, and the third storage space value is 100M. The storage space value is 10M, which is not specifically limited in this embodiment. The first scan result is a result obtained by scanning the target file whether the target file carries a virus.

The embodiment of the present invention provides a method for storing files. In the process of performing virus detection and killing scanning on a stored target file, the method selects a corresponding virus detection and killing method according to the target storage space value of the target file, and fully The time-consuming feature of various virus checking and killing methods is utilized, the time for virus checking and killing on the target is shortened, and the storage efficiency for storing the target file is provided.

Further, on the basis of the above embodiments, it also includes:

If the first scan result is that the target file carries a virus, then determine whether the target file can be repaired as a first security file that does not carry a virus;

If the target file can be repaired into the first security file, repairing the target file into the first security file, and storing the first security file in the second storage medium;

If the target file cannot be restored to the first security file, the target file is deleted or the target file is stored in the virus isolation area of the second storage medium.

It should be noted that, judging whether a target file carrying a virus can be repaired into a first security file that does not carry a virus, and repairing the target file into a first security file can be implemented by corresponding software, which is not the case in this embodiment. make specific restrictions. For example, the software checks the location of the virus in the target file, and if the file header of the target file is implanted by a virus, it is determined that the target file cannot be repaired. If the virus is implanted in the target file, and the target file is deleted without affecting the operation of the target file, it is determined that the target file can be repaired. If it is determined that the target file can be repaired, the target file is repaired to obtain a first security file that does not carry viruses.

If the target file cannot be restored to the first security file, this embodiment provides two processing methods, one is to directly delete the target file from the first storage medium, and the other is to store the target file in the first storage medium. 2. The virus isolation area in the storage medium can be used as a virus sample. In order to eliminate the potential safety hazard brought by the target file carrying the virus, the method provided in this embodiment stores the target file in the virus isolation area of the second storage medium. Among them, the virus isolation area is a safe and isolated special folder suitable for storing some special files. The virus isolation area is completely isolated from the operating system. Other processes cannot operate the files in the virus isolation area, and the files in the virus isolation area cannot be run.

It is understandable that, in order to release the space of the first storage medium and ensure the normal operation of the server or terminal, further, after storing the target file in the virus isolation area in the second storage medium, the method further includes:

The target file is deleted from the first storage medium.

Further, if the target file can be repaired as the security file, the target file is repaired as a security file, and after the security file is stored in the second storage medium, the method further includes:

Send out the first prompt message that the target file carrying the virus has been repaired.

Deleting the target file or storing the target file in the virus isolation area of the second storage medium if the target file cannot be repaired to the safe file, further comprising:

A second prompt message is sent out that the target file carries a virus and that the executable file of the target file fails to be stored.

An embodiment of the present invention provides a method for storing a file. The method further determines whether the target file can be repaired as a safe file if the first scan result is that the target file carries a virus. Repair, to ensure the normal operation of the storage process, if not, delete the target file or store the target file in the virus isolation area of the second storage medium, eliminating the security risks brought by the virus-carrying target file.

Further, on the basis of the above embodiments, it also includes:

If the target storage space value is greater than or equal to the first storage space value, the target file is stored in the second storage medium, and the target file is scanned for virus killing to obtain a second scan result;

If the second scan result is that the target file carries a virus, then determine whether the target file can be repaired to a second security file that does not carry viruses, and if so, repair the target file to the second security file , otherwise, delete the target file or store the target file in the virus quarantine area in the second storage medium.

For the target file whose target storage space value is greater than or equal to the first storage space value, limited by the storage capacity of the first storage medium, the target file is directly stored in the second storage space value, then the second storage space value is equal to The target file is scanned for virus killing. It is understandable that, if the second scan result is that the target file does not carry a virus, no processing is performed.

An embodiment of the present invention provides a method for storing a file. The method limits the situation that the target storage space value of the target file is greater than or equal to the first storage space value. When the target storage space value is greater than or equal to the first storage space value When the space value is set, the target file is directly scanned for viruses in the second storage space value, which improves the storage method of the file.

It is understandable that, as a virus database and a file scanning engine for local scanning and killing of target files, this embodiment takes a proxy server as an example to provide a process of upgrading the local scanning and killing virus database and file scanning engine in the proxy server. FIG. 2 is a schematic diagram of a process of upgrading a virus database and a file scanning engine in a proxy server provided by this embodiment. Referring to FIG. 2 , the proxy server includes a file scanning engine, a virus database, and an engine update engine. For example, after the proxy server downloads the upgrade file from the cloud server, it compares the local virus database file with the upgrade file to determine whether the local virus database file needs to be updated, and scans the target file through the file scanning engine to determine whether the target file is in the target file. whether the virus is carried.

The virus database and the engine update engine are used to update the virus database and the scan engine according to the update rules. The user update module can set the time or trigger conditions for the virus database and engine update engine to acquire new virus database or engine. The engine and virus database update service is used to provide new engines or viruses to the virus database and engine update engine, so that the virus database and engine update engine can update the virus database and engine of the proxy server after acquiring the new engine or virus.

FIG. 3 shows a structural block diagram of an apparatus for storing files provided by an embodiment of the present invention. Referring to FIG. 3 , the apparatus for storing files provided in this embodiment includes a first storage module 301 and a scanning module 302 and the second storage module 303, wherein,

The first storage module 301 is configured to obtain the target storage space value that needs to be occupied to store the target file, and if the target storage space value is smaller than the first storage space value, store the target file in the first storage medium;

a scanning module 302, configured to perform virus killing scanning on the target file to obtain a first scanning result;

A second storage module 303, configured to store the target file in a second storage medium if the first scan result is that the target file does not carry a virus;

Wherein, the file reading speed of the first storage medium is greater than the file reading speed of the second storage medium; the first storage space value is less than or equal to the available storage space value of the first storage medium.

The device for storing a file provided in this embodiment is applicable to the method for storing a file provided in the foregoing embodiment, and details are not described herein again.

This embodiment provides a device for storing files. After receiving the target file, the device obtains the target storage space value of the target file. If the target storage space value is small, the device stores the target file in the file read. The faster first storage medium performs virus detection and killing scanning on the target file on the first storage medium, and stores the target file without virus in the second storage medium with slower file reading speed but larger storage capacity. The device considers the nature of the storage medium, so that the target file with a smaller target storage space value is scanned for viruses in the first storage medium with a faster file reading speed, which improves the speed of the virus detection and scanning and avoids the need for It solves the problem of excessive consumption of IO overhead caused by virus killing and scanning in the second storage medium with a slow file reading speed.

In a third aspect, FIG. 4 is a block diagram showing the structure of the electronic device provided in this embodiment.

4 , the electronic device includes: a processor (processor) 401, a memory (memory) 402, a communications interface (Communications Interface) 403 and a bus 404;

in,

The processor 401, the memory 402, and the communication interface 403 communicate with each other through the bus 404;

The communication interface 403 is used for information transmission between the electronic device and the communication device of the server or the communication device of the terminal;

The processor 401 is configured to call the program instructions in the memory 402 to execute the methods provided by the above method embodiments, for example, including: obtaining the target storage space value that needs to be occupied to store the target file, if the target storage space If the value is less than the first storage space value, the target file is stored in the first storage medium; the target file is scanned for virus killing to obtain a first scan result; if the first scan result is the target file If no virus is carried, the target file is stored in the second storage medium; wherein, the file reading speed of the first storage medium is greater than the file reading speed of the second storage medium; the first storage space value less than or equal to the available storage space value of the first storage medium.

In a fourth aspect, this embodiment provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided by the above method embodiments. The method, for example, includes: obtaining a target storage space value that needs to be occupied to store a target file, and if the target storage space value is less than a first storage space value, storing the target file in a first storage medium; Virus killing scan, to obtain a first scan result; if the first scan result is that the target file does not carry a virus, the target file is stored in the second storage medium; wherein, the file of the first storage medium The reading speed is greater than the file reading speed of the second storage medium; the first storage space value is less than or equal to the available storage space value of the first storage medium.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer program The methods provided by the above method embodiments can be executed, for example, including: obtaining the target storage space value that needs to be occupied by storing the target file, and if the target storage space value is less than the first storage space value, storing the target file in the target file. a first storage medium; perform virus killing scanning on the target file to obtain a first scan result; if the first scan result is that the target file does not carry a virus, store the target file in a second storage medium ; wherein, the file reading speed of the first storage medium is greater than the file reading speed of the second storage medium; and the first storage space value is less than or equal to the available storage space value of the first storage medium.

Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by program instructions related to hardware, the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, execute It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

The above-described electronic equipment and other embodiments are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, It can be located in one place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, but not to limit them; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, ordinary The skilled person should understand that it is still possible to modify the technical solutions described in the foregoing embodiments, or to perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the present invention. The scope of the technical solutions of the embodiments of each embodiment.

Claims (10)

1. a method for storing a file, is characterized in that, comprising: Obtaining the target storage space value that needs to be occupied to store the target file, and if the target storage space value is less than the first storage space value, then storing the target file in the first storage medium; Perform virus killing scanning on the target file to obtain a first scanning result; If the first scan result is that the target file does not carry a virus, storing the target file in a second storage medium; Wherein, the file reading speed of the first storage medium is greater than the file reading speed of the second storage medium; the first storage space value is less than or equal to the available storage space value of the first storage medium. 2 . The method according to claim 1 , wherein the virus detection and killing scan is performed on the target file to obtain a first scan result, comprising: 2 . If the target storage space value is greater than the second storage space value, perform virus scanning and killing scanning on the target file through cloud scanning and killing to obtain the first scanning result; If the target storage space value is less than or equal to the second storage space value and greater than the third storage space value, perform virus detection and killing scanning on the target file through local killing to obtain the first scan result; If the target storage space value is less than or equal to the third storage space value, perform virus detection and killing scanning on the target file through local scanning or cloud scanning to obtain the first scanning result; Wherein, the local checking is heuristic checking or QEX script checking; the second storage space value and the third storage space value are based on the relationship between the time used for local checking and cloud checking and the storage space occupied by files and set value. 3. The method of claim 1, further comprising: If the first scan result is that the target file carries a virus, then determine whether the target file can be repaired as a first security file that does not carry a virus; If the target file can be repaired into the first security file, repairing the target file into the first security file, and storing the first security file in the second storage medium; If the target file cannot be restored to the first security file, the target file is deleted or the target file is stored in the virus isolation area of the second storage medium. 4. The method of claim 1, further comprising: If the target storage space value is greater than or equal to the first storage space value, the target file is stored in the second storage medium, and the target file is scanned for virus killing to obtain a second scan result; If the second scan result is that the target file carries a virus, then determine whether the target file can be repaired to a second security file that does not carry viruses, and if so, repair the target file to the second security file , otherwise, delete the target file or store the target file in the virus quarantine area in the second storage medium. 5. A device for storing files, comprising: a first storage module, configured to obtain a target storage space value that needs to be occupied to store a target file, and if the target storage space value is less than the first storage space value, store the target file in the first storage medium; a scanning module, configured to perform virus killing scanning on the target file to obtain a first scanning result; a second storage module, configured to store the target file in a second storage medium if the first scan result is that the target file does not carry a virus; Wherein, the file reading speed of the first storage medium is greater than the file reading speed of the second storage medium; the first storage space value is less than or equal to the available storage space value of the first storage medium. 6 . The device according to claim 5 , wherein the scanning module is further configured to perform virus checking and killing on the target file through cloud checking and killing if the target storage space value is greater than the second storage space value. 7 . Scan to obtain the first scan result; if the target storage space value is less than or equal to the second storage space value and greater than the third storage space value, then perform virus inspection and killing scanning on the target file through local inspection and killing , to obtain the first scan result; if the target storage space value is less than or equal to the third storage space value, perform virus scanning and killing scanning on the target file through local or cloud scanning to obtain the the first scan result; Wherein, the local checking is heuristic checking or QEX script checking; the second storage space value and the third storage space value are based on the relationship between the time used for local checking and cloud checking and the storage space occupied by files and set value. 7 . The device according to claim 5 , wherein the second storage module is further configured to determine whether the target file can be repaired as a non-recoverable file if the first scan result is that the target file carries a virus. 8 . The first security file that carries the virus; if the target file can be repaired as the first security file, then the target file is repaired as the first security file, and the first security file is stored in the second storage medium; if the target file cannot be repaired as the first security file, delete the target file or store the target file in the virus isolation area in the second storage medium. 8. The apparatus according to claim 5, wherein the first storage module is further configured to store the target file in the target storage space if the target storage space value is greater than or equal to the first storage space value The second storage medium performs virus detection and killing scanning on the target file, and obtains a second scan result; if the second scan result is that the target file carries a virus, it is judged whether the target file can be repaired or not. The second security file carrying a virus, if so, repair the target file to the second security file, otherwise, delete the target file or store the target file in the virus isolation area of the second storage medium . 9. An electronic device, characterized in that, comprising: at least one processor, at least one memory, a communication interface, and a bus; wherein, The processor, the memory, and the communication interface communicate with each other through the bus; The communication interface is used for information transmission between the electronic device and the communication device of the server or the communication device of the terminal; The memory stores program instructions executable by the processor, the processor invoking the program instructions to be able to perform the method as claimed in any one of claims 1 to 4. 10. A non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores computer instructions, the computer instructions cause the computer to execute the computer described in any one of claims 1 to 4 Methods.

Images