知搜-全球专利检索

  1. 登录
  2. 注册
发明公开
CN103955645A 恶意进程行为的检测方法、装置及系统 有权

恶意进程行为的检测方法、装置及系统
摘要：
本发明实施例提供一种恶意进程行为的检测方法、装置及系统。本发明实施例通过检测装置监控进程的进程行为，以获得目标进程行为的行为信息，进而将目标进程行为的行为信息发送给服务器，由服务器根据目标进程行为的行为信息，对目标进程行为进行检测，以确定目标进程行为是否为恶意进程行为，使得检测装置能够接收服务器根据目标进程行为的检测结果所返回的第一操作指示信息，进而根据第一操作指示信息，对目标进程行为执行操作，由于不再依赖于检测装置对目标进程行为进行单个样本的指定特征分析，而是由服务器根据目标进程行为的行为信息，对目标进程行为进行综合检测，能够及时检测到恶意进程行为，从而提高了系统的安全性能。
摘要（英）：

The embodiment of the invention provides a method, a device and a system for detecting a malicious process behavior. The detection device is used for monitoring a process behavior of a process so as to acquire behavior information of a target process behavior, and sending the behavior information of the target process behavior to a server; the server detects the target process behavior according to the behavior information of the target process behavior to determine whether the target process behavior is a malicious process behavior, so that the detection device can receive first operation indicating information returned by the server according to a detection result of the target process behavior, and operate the target process behavior according to the first operation indicating information. The target process behavior is subjected to comprehensive detection by the server according to the behavior information of the target process behavior instead of appointed feature analysis on a single sample by the detection device, so that the malicious process behavior can be detected in time, and the safety of the system is improved.

公开/授权文献
0/0