Method and device for detecting suspicious progresses

Abstract

The invention provides a method and a device for detecting suspicious progresses. The method includes acquiring first characteristic data of the progresses of a browser; matching the first characteristic data in a preset first white list data base; and judging one progress to be a suspicious progress if the first characteristic data of the progress are not in the preset first white list data base, wherein the first characteristic data include Hash values and digital signatures of executable files of the progresses, and the preset first white list data base includes the credible file Hash values and the credible file digital signatures. According to the method and the device for detecting the suspicious progresses, the suspicious progresses can be fully, effectively and accurately distinguished, and safety for users to surf the internet is improved.

Description

technical field [0001] The present application relates to the technical field of information security, in particular to a suspicious process detection method and a suspicious process detection device. Background technique [0002] A computer virus refers to a set of computer instructions or program codes that are inserted into a computer program by the compiler to destroy computer functions or data, affect computer use, and are capable of self-replication. Once a computer is infected with a virus, it usually shows that its files are added, deleted, changed names or attributes, and moved to other directories. These operations of viruses on computer files may cause normal programs to fail to run, computer operating systems to crash, and computers to A series of problems such as remote control and user information being stolen. [0003] At present, the computer viruses that Internet users are more likely to be infected with are "trojan horses". A Trojan horse refers to a prog...

AI Technical Summary

Problems solved by technology

However, because the virus database is not updated in real time, the user triggers virus detection is also lagging behind, and the use of this existing technology is prone to virus false positives and false negatives and problems

For example, if a user visits a website with a Trojan horse through a browser (horse-mounted website), the browser process will download the Trojan horse program and execute it without the user's knowledge. At this time, it will inevitably cause the Trojan horse program to run in the user's device, stealing the user's account password and other information, thereby causing losses to the user.

Especially for new viruses, even if the user triggers the Trojan horse detection process after visiting the Trojan horse website, the Trojan horse cannot be detected because it is not included in the virus database

Images