Method for monitoring and eliminating generalized unknown virus

Abstract

The invention relates to a method to monitor and eliminate general unknown viruses, which comprises: inducing virus basic behaviors composted of a plurality of behavior factors through analysis and research on large amount of computer virus, determining specificity of each behavior factor and each basic virus behavior and forming a specificity-adjusting virus behaviors database which is used to judge whether a program belongs to a virus; simultaneously forming an adjustable normal program false-virus behaviors database according to false-virus behaviors generated on normal programs, wherein the database is used to judge whether a program belongs to a normal program; sorting and processing the viruses which are detected by the above method. The invention can improve the specificity of unknown virus and reduce the error report rate of behavior analysis, ensures the adjusting properties of virus behaviors specificity, increases quantity and range of unknown viruses detecting, and has distinctive advantages compared with prior computer virus monitor technique.

Description

technical field [0001] The invention relates to a method for monitoring and eliminating generalized unknown viruses. Compared with the existing anti-computer virus technology, the invention not only can monitor and eliminate known viruses, but also can highly specifically monitor and eliminate unknown viruses in a broad sense. Background technique [0002] In today's rapid development of information technology, although many anti-computer virus products have appeared, they have indeed played a certain role in the prevention and treatment of known computer viruses, but they cannot effectively fight against unknown viruses. major threat to security. [0003] Existing anti-computer virus monitoring technologies mainly include feature code comparison monitoring detection technology and HIPS active defense technology. [0004] (1) Signature code comparison monitoring and detection technology: By monitoring whether a certain virus signature string in the virus database exists in...

AI Technical Summary

Problems solved by technology

[0006] Although the patented invention 200510007682.X has provided a method of judging whether it is a virus through program behavior analysis, it has defended against unknown viruses to a certain extent, but virus behavior is relative, and a small number of normal programs will also occur, and one-way analysis Judgment is difficult to avoid a certain false positive rate

Moreover, in order to reduce the false alarm rate, the critical conditions for virus behavior must be narrowed, resulting in a decrease in the range and number of unknown viruses that can be identified

Images