Cloud checking and killing method, device and system for combating anti-antivirus test

A cloud checking and killing device for combating an anti-antivirus test, wherein the anti-antivirus test refers to utilizing, by the development team of a virus, antivirus software to test the virus to determine whether it being prompted as a virus, a cloud checking and killing system comprises a cloud server and a client, the device being located at the cloud server and comprising one or more non-transitory computer readable medium configured to store computer-executable instruction;

• at least one processor to execute a plurality of software modules configured to execute the computer-executable instruction to cause:
• receiving, by the cloud sever, cloud checking and killing request sent by the client for performing virus checking and killing on a sample;
• analyzing, by the cloud server, the cloud checking and killing request, and determining whether the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test;
• if the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test, returning, by the cloud server, to the client a cloud checking and killing result that the sample does not carry a virus;
• if the cloud checking and killing request is not a cloud checking and killing request of an anti-antivirus test, comparing the sample with a virus library of the cloud server to determine whether the sample carries a virus and performing corresponding virus checking and killing,
• wherein the determining whether the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test comprises:
• recording a unique identification characteristic of the sample,
• monitoring a cloud checking and killing request sent for the unique identification characteristic, and counting the number and distribution of IPs of the cloud checking and killing request sent for the unique identification characteristic, and
• determining that the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test, if a counting result of the number and distribution of IPs falls within a preset condition.

A cloud checking and killing system for combating an anti-antivirus test, comprising a cloud server and a client, the anti-antivirus test refers to utilizing, by the development team of a virus, antivirus software to test the virus to determine whether it being prompted as a virus, wherein the cloud server comprises one or more non-transitory computer readable medium configured to store computer-executable instruction;

• at least one processor to execute a plurality of software modules configured to execute the computer-executable instruction to cause:
• receiving, by the cloud sever, cloud checking and killing request sent by the client for performing virus checking and killing on a sample;
• analyzing, by the cloud server, the cloud checking and killing request, and determining whether the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test;
• if the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test, returning, by the cloud server, to the client a cloud checking and killing result that the sample does not carry a virus;
• if the cloud checking and killing request is not a cloud checking and killing request of an anti-antivirus test, comparing the sample with a virus library of the cloud server to determine whether the sample carries a virus and performing corresponding virus checking and killing,
• wherein the determining whether the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test comprises:
• recording a unique identification characteristic of the sample,
• monitoring a cloud checking and killing request sent for the unique identification characteristic, and counting the number and distribution of IPs of the cloud checking and killing request sent for the unique identification characteristic, and
• determining that the cloud checking and killing request is a cloud checking and killing request of an anti-antivirus test, if a counting result of the number and distribution of IPs falls within a preset condition.