Active defense method of program behavior analysis on basis of cloud platform

Abstract

The invention relates to an active defense method of program behavior analysis on the basis of a cloud platform. A system comprises a cloud end and a cloud client, wherein the cloud end consists of a malicious code behavior analysis module, a program behavior monitoring module and a malicious code processing module, and the cloud client comprises a program behavior monitoring module, a malicious code behavior identification module and a malicious code processing module. The active defense method has the advantages that the cloud platform is introduced, in addition, the behavior algorithm identification program of the program behavior analysis, identification and processing is used as the basis, the security risk static defense capability of a host computer system can be intelligently improved, the security defense capability of a terminal host computer is effectively improved, the infection probability of the terminal host computer on malicious codes such as viruses, Trojan, backdoor program and the like is reduced, and the security of the host computer is ensured.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to an active defense method based on cloud platform program behavior analysis. Background technique [0002] With the development of network and information technology, the network is profoundly changing the way of human life and work. The cross-connection of various networks brings great convenience to people's life and work, and at the same time, the problem of information security has gradually become prominent. At present, with the development of computer technology, Trojan horse hacking technology and malicious attack technology are changing with each passing day. Profitability, concealment, pertinence, anti-killing. With the formation of a black industrial chain, the number of malicious codes has grown exponentially, and the threshold for malicious code manufacturing technology has been lowered, anti-virus technology is changing with each passing day, and th...

AI Technical Summary

Problems solved by technology

With the formation of a black industrial chain, the number of malicious codes has grown exponentially, and the threshold for malicious code manufacturing technology has been lowered, anti-virus technology is changing with each passing day, and the security threats faced by enterprises and institutions are increasing rapidly. Hacker attack tools, worms, Trojan backdoors, and spyware , Malicious scripts, ARP virus and other malicious codes are explosively growing, and massive attacks brought by massive malicious codes continue or periodically plague users and cause serious damage to the information systems of enterprises and institutions. Therefore, virus defense technologies are also constantly The development of the traditional virus defense technology is to extract the virus characteristic value from the virus body and form a virus characteristic library to identify malicious code. Although this method has high execution efficiency, it has considerable limitations. The response to new viruses is slow, and the update of the signature code base relies on software suppliers to collect the latest virus information and analyze and extract signatures, which leads to anti-virus technology always lagging behind the generation of viruses; and due to the rapid development of malicious codes, security threats It is no longer limited to viruses, but includes all kinds of known and unknown viruses, worms, Trojans, spyware, malicious plug-ins, rootkits, and zero-day attacks. Traditional virus defense technologies are difficult to detect such attacks

Images