1. A method for obtaining at least one virus signature, the method comprising: obtaining at least one text string of characters sequence contained in program code lines of virus samples of a virus sample set; selecting a virus signatures candidate from the at least one text string of characters sequence according to a first frequency at which each of the at least one text string of characters sequence occurs in program code lines of non-virus samples of a non-virus sample set, and a second frequency at which each of the at least one text string of characters sequence occurs in the program code lines of virus samples of the virus sample set; calculating an information entropy of the virus signatures candidate, the information entropy consisting of a value calculated according to: a number of virus samples among the virus sample set containing the virus signatures candidate, a number of virus samples among the virus sample set not containing the virus signatures candidate, a number of non-virus samples among the non-virus sample set containing the virus signatures candidate, and a number of non-virus samples among the non-virus sample set not containing the virus signatures candidate; and determining whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy.
1. A method for obtaining at least one virus signature, the method comprising: obtaining at least one text string of characters sequence contained in program code lines of virus samples of a virus sample set; selecting a virus signatures candidate from the at least one text string of characters sequence according to a first frequency at which each of the at least one text string of characters sequence occurs in program code lines of non-virus samples of a non-virus sample set, and a second frequency at which each of the at least one text string of characters sequence occurs in the program code lines of virus samples of the virus sample set; calculating an information entropy of the virus signatures candidate, the information entropy consisting of a value calculated according to: a number of virus samples among the virus sample set containing the virus signatures candidate, a number of virus samples among the virus sample set not containing the virus signatures candidate, a number of non-virus samples among the non-virus sample set containing the virus signatures candidate, and a number of non-virus samples among the non-virus sample set not containing the virus signatures candidate; and determining whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy. 7. The method according to claim 1 , wherein determining whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy comprises: calculating an additional set of information entropies for another set of virus signatures candidates obtained according to claim 1 ; choosing a preset number of virus signatures candidates having smallest information entropies from the selected virus signature candidate and the another set of virus signatures candidates as a set of a set of virus signatures; and determining that the selected virus signatures candidate as one of the set of virus signatures when the selected virus signatures candidate is among the chosen set of virus signatures candidates.