Method and device for actively defending rogue program

Abstract

The invention relates to the field of computer network safety and discloses a method and a device for actively defending a rogue program. The method comprises the following steps of: when to-be-protected equipment creates a process, judging whether a created process has risk or not according to process files related to the created process, if yes, intercepting an operation of loading DLL (Dynamic Link Library) files of the process by the created process, and recording the DLL files into the process information of an internal memory; and after the to-be-protected equipment starts the process, if the operated executed by the process is a dangerous operation, detecting whether the recorded DLL files of the process are safe or not, if the recorded DLL files are unsafe, preventing the to-be-protected equipment from executing the operation of the process. The method and the device can be used for solving the technical problem that the rogue program packs rogue DLL files and trusty white programs together, when the white programs are executed, the rogue DLL files are loaded, and thus the active defense is broken through.

Description

Technical field [0001] The invention relates to the field of computer network security, in particular to a method and device for actively defending malicious programs. Background technique [0002] Malicious program is a general term that refers to any program deliberately created to perform unauthorized and usually harmful behavior. Malicious programs can include viruses, Trojan horses, malicious scripts, malicious plug-ins, malicious review software, or malware. Computer viruses, backdoor programs, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses, Trojan horses, criminal programs, spyware, and advertising programs are all examples of malicious programs. [0003] In the prior art, the anti-kill of malicious programs mainly relies on the feature library mode. The signature database is composed of signature codes of malicious program samples collected by anti-virus product providers, and the signature is the difference between the le...

AI Technical Summary

Problems solved by technology

However, the number of malicious programs in the world is growing geometrically. Based on this explosive growth rate, the generation and update of signature databases usually lag behind the generation of viruses, resulting in the failure of anti-killing methods to prevent unknown malicious programs that are constantly generated.

Images