Malicious code detection and defense method

Abstract

Different from other malicious code detection and defense methods, a malicious code detection and defense method is characterized in that a malicious code detection and defense system is built by the aid of a centerless network based on P2P (peer-to-peer). Running of an unknown program cannot be stopped, the unknown program can be monitored in the subsequent running process, mass data obtained by monitoring the program are processed to obtain some strategies, the strategies are similar to conditioned reflex and tell a defense portion how to process a certain program, a response portion tells the defense portion what to do for a certain program, and the main content includes terminating malicious processes, terminating network connection, recovering broken registry keys, recovering broken files, preventing a kernel module from loading and modifying, recovering services and recovering tampered kernel information. The malicious code detection and defense method has the advantages that autonomic update and rapid response are realized, a user and the program are transparent, and after effects are avoided.

Description

technical field [0001] The present invention is a malicious code detection and defense method, which is different from other malicious code detection and defense methods in that the present invention uses a P2P-based decentralized network to construct a malicious code detection and defense system. Background technique [0002] Malicious codes in the traditional sense can be divided into viruses, worms, Trojan horses, etc., but with the rise of computer-dependent e-commerce, viruses, worms, Trojan horses, etc. no longer have obvious boundaries. Most malicious codes are generated under the drive of profit, and are manufactured to steal various accounts and money. General malicious code detection can be divided into static detection and dynamic detection according to whether the code is executed. Static detection includes checksum comparison, characteristic string inspection, heuristic scanning, logic analysis and network sniffing, etc. Dynamic detection includes integrity de...

AI Technical Summary

Problems solved by technology

Typical security software uses several types of malicious code detection technologies, but these technologies have different degrees of defects. In order to deal with the constantly generated malicious codes, security software needs to update and upgrade the virus database frequently, and these update and upgrade data are A server is required to provide

Images