知搜-全球专利检索

  1. 登录
  2. 注册
发明授权
CN106022113B 经由沙盒检测恶意文件感染 有权

经由沙盒检测恶意文件感染
摘要：
一种设备可以接收触发以确定恶意文件是否正在客户端设备上进行操作。该设备可以基于接收该触发以确定恶意文件是否正在客户端设备上进行操作、来确定与恶意文件相关联的网络活动简档。网络活动简档可以包括如下的信息，该信息与当恶意文件在测试环境中被执行时关联于恶意文件的网络活动有关。该设备可以监测与客户端设备相关联的网络活动。该设备可以基于监测与客户端设备相关联的网络活动，来确定与客户端设备相关联的网络活动匹配与恶意文件相关联的网络活动简档。该设备可以提供指示与客户端设备相关联的网络活动匹配与恶意文件相关联的网络活动简档的信息。
摘要（英）：

A device may receive a trigger to determine whether a malicious file is operating on a client device. The device may determine a network activity profile associated with the malicious file based on receiving the trigger to determine whether the malicious file is operating on the client device. The network activity profile may include information regarding network activity associated with the malicious file when the malicious file is executed in a testing environment. The device may monitor network activity associated with the client device. The device may determine that the network activity associated with the client device matches the network activity profile associated with the malicious file based on monitoring the network activity associated with the client device. The device may provide information indicating that the network activity associated with the client device matches the network activity profile associated with the malicious file.

公开/授权文献
0/0