Unknown virus retrieval method

Abstract

An unknown virus retrieval method includes the steps of comparison library configuration, behavior extraction and behavior analysis. The behavior analysis comprises Trojan recognition and suspicious behavior recognition. A comparison library is set in advance so as to divide basic behaviors into at least three levels, namely Trojan behaviors, suspicious behaviors and correctable behaviors according to danger levels. The behavior analysis includes Trojan recognition and suspicious behavior recognition and further comprises a suspicious behavior correction step and a filter step, wherein the suspicious behaviors are corrected in the mode that the suspicious behaviors are recognized and classified to be the correctable behaviors according to correctable comparison files in the comparison library set in advance. According to the unknown virus retrieval method and device, users can configure behaviors corresponding to the danger levels by themselves, different requirements of the different users can be met, configuration of the suspicious behaviors or the Trojan behaviors is reduced, and accordingly the unnecessary analysis process is reduced, and the virus searching efficiency is improved.

Description

technical field [0001] The invention belongs to the field of computer applications, and relates to identification and prevention of computer viruses, in particular to an unknown virus retrieval method and device. Background technique [0002] A computer virus refers to a set of computer instructions or program codes that are inserted into a computer program by the compiler to destroy computer functions or data, affect computer use, and are capable of self-replication. A computer virus lurks in the computer's storage medium (or program) through some means, and is activated when a certain condition is met, and puts its exact copy or possibly evolved form into other programs by modifying other programs. thereby infecting other programs. [0003] Computer virus is a major threat to computer security. The ability of computer virus to mutate is increasing day by day, and the speed of new virus generation is accelerating. At present, most anti-virus software still use the virus f...

AI Technical Summary

Problems solved by technology

[0004] Although there are many behavior-based detection methods for unknown viruses, due to the diversity of virus behaviors, it is easy to misreport, especially the one-by-one comparative analysis of all operation behaviors, occupying computer operating resources, and increasing the time for virus detection and antivirus At the same time, users rely on the online upgrade package provided by anti-virus software developers to passively update the virus database, and users cannot adjust the virus database according to their own needs, resulting in some non-malicious operations of users that contain similar virus-like operations as viruses. false alarm

Images