Method for intercepting operating of suspicious programs

Abstract

The invention discloses a method for intercepting operating of suspicious programs. The method includes the steps of: (1) under the condition that a protected computer has no Trojan horse viruses and when a system is operated for the first time, recording all PE (Portable Execute) file information existing in the computer and generating a white list, (2) intercepting requests of memory application in file loading and screening out the PE files in a operating system nucleus, (3) comparing with a black list and the white list to judge whether the file is suspicious. The method for intercepting operating of suspicious programs has the advantages that the method effectively intercepts the enablement of suspicious programs and obtains Trojan horse virus samples by intercepting all the PE files loaded by an operating system and comparing with the white list to judge the PE files, intercepts known Trojan horse viruses by making the black list, provides detailed log reports to analyze and monitor running status of all processes in a current system so that the safety of the system is greatly improved, and overcomes the great defect that existing antivirus software can not intercept unknown Trojan horse viruses by using feature contrasting mode.

Description

technical field [0001] The invention relates to a method for intercepting suspicious program operation, belonging to the technical field of information security. Background technique [0002] At present, according to the network security information and dynamics released by the China National Computer Network Emergency Response Technology Coordination Center, the number of hosts infected with network viruses in China is on the rise. For example, the speed at which viruses and Trojan horses mutate and spread is overwhelming for most antivirus software manufacturers. Moreover, in the current host environment, viruses and Trojans cannot be detected and killed by antivirus software, host firewalls cannot be blocked, and anti-hidden tools cannot be found. Once the system is infected with viruses and Trojans, they will lie dormant for a long time, causing huge losses to information security. [0003] At present, in the prior art, the technologies and methods mainly used for detec...

AI Technical Summary

Problems solved by technology

For example, the active defense detection method will frequently ask the user, making the user at a loss. Although, the use of advanced kernel rootkit technology can avoid the active defense monitoring; the heuristic killing method can be bypassed by writing custom system functions, etc. However, the detection methods in the above-mentioned prior art all use the malicious behavior of virus and Trojan horses as the detection basis, therefore, under the situation of not capturing new Trojan horse samples, there is no ability to check and kill unknown new Trojan horses

Images