8. A host computing device for obtaining at least one virus signature, the host computing device comprising: a plurality of computer files stored in one or more memory locations of the host computing device; and at least a processor with circuitry operating in conjunction with a memory storing codes of an anti-virus program, wherein the processor, when executing the code, is configured to: obtain at least one text string of characters sequence contained in program code lines of virus samples of a virus sample set; select a virus signatures candidate from the at least one text string of characters sequence according to a first frequency at which each of the at least one text string of characters sequence occurs in program code lines of non-virus samples of a non-virus sample set, and a second frequency at which each of the at least one text string of characters sequence occurs in the program code lines of virus samples of the virus sample set; calculate an information entropy of the virus signatures candidate, the information entropy consisting of a value calculated according to: a number of virus samples among the virus sample set containing the virus signatures candidate, a number of virus samples among the virus sample set not containing the virus signatures candidate, a number of non-virus samples among the non-virus sample set containing the virus signatures candidate, and a number of non-virus samples among the non-virus sample set not containing the virus signatures candidate; and determine whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy.
8. A host computing device for obtaining at least one virus signature, the host computing device comprising: a plurality of computer files stored in one or more memory locations of the host computing device; and at least a processor with circuitry operating in conjunction with a memory storing codes of an anti-virus program, wherein the processor, when executing the code, is configured to: obtain at least one text string of characters sequence contained in program code lines of virus samples of a virus sample set; select a virus signatures candidate from the at least one text string of characters sequence according to a first frequency at which each of the at least one text string of characters sequence occurs in program code lines of non-virus samples of a non-virus sample set, and a second frequency at which each of the at least one text string of characters sequence occurs in the program code lines of virus samples of the virus sample set; calculate an information entropy of the virus signatures candidate, the information entropy consisting of a value calculated according to: a number of virus samples among the virus sample set containing the virus signatures candidate, a number of virus samples among the virus sample set not containing the virus signatures candidate, a number of non-virus samples among the non-virus sample set containing the virus signatures candidate, and a number of non-virus samples among the non-virus sample set not containing the virus signatures candidate; and determine whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy. 12. The host computing device according to claim 8 , wherein the processor, when executing the codes to calculate the information entropy of the virus signatures candidate according to the number of virus samples containing the virus signatures candidate and the number of non-virus samples containing the virus signatures candidate, is configured to: calculate a number of virus samples among the virus sample set not containing the virus signatures candidate according to the number of virus samples containing the virus signatures candidate; calculate the number of non-virus samples among the non-virus sample set not containing the virus signatures candidate according to the number of non-virus samples containing the virus signatures candidate; and calculate the information entropy of the virus signatures candidate according to the number of virus samples containing the virus signatures candidate, the number of virus samples not containing the virus signatures candidate, the number of non-virus samples containing the virus signatures candidate, and the number of non-virus samples not containing the virus signatures candidate.