Detection device and method of unknown application bug threat

Abstract

The invention relates to the technical field of computer communication, in particular to a detection device and method of unknown application bug threat. The detection device comprises a sample acquisition device, a preprocessing filter device, an analog behavior monitoring device and a behavior comparison and analysis device, wherein the sample acquisition device is used for collecting a transmitted application document attachment sample from the flow of a network inlet; the preprocessing filter device is used for preprocessing the collected document attachment sample and filtering known sample accessories which contain application bugs and the sample accessories which obviously do not contain the application bugs; the analog behavior monitoring device is used for carrying out simulation execution detection on the filtered sample accessories; and the behavior comparison and analysis device is used for carrying out comparison and analysis on a behavior process which is monitored and recorded by analog execution to find suspicious acts which exhibit security threats in the behavior process. An expert system knowledge base is adopted to carry out result analysis and judgment on the detected suspicious acts and can intelligently judge whether the bug threats which can be taken advantage are in the presence in the detected suspicious acts or not along with a situation that the knowledge base is constantly enriched, and a problem of false alarm can be effectively solved.

Description

technical field [0001] The invention relates to the technical field of computer communication, in particular to a device and method for detecting unknown application vulnerability threats. Background technique [0002] In recent years, the issue of network security has become one of the key issues of global concern. With the disclosure of the "Snowden" incident, the issue of network privacy and individual users' online security has once again become the focus of public attention. With the continuous development of network attack technology, especially the increasing proliferation of APT advanced persistent threat attacks, although major security vendors are constantly launching various security products using new technologies, the security problem is still serious. [0003] With the improvement of public security awareness, traditional executable file-based Trojan horse attacks have fallen behind, and everyone has realized that unknown executable files are suspicious and un...

AI Technical Summary

Problems solved by technology

This method has a certain ability to detect unknown Trojan horses, but in essence it is still a detection method based on Trojan horse signatures, and the detection false positive rate for new Trojan horses is relatively high

Images