Novel defending method and device for unknown malicious software

Abstract

The invention provides a novel defending method and device for unknown malicious software, and belongs to the field of network safety. The method comprises the steps: obtaining malicious software at the phase of exploitation of vulnerability through employing the technology of virtual recognition, generating first alarm information, adding first alarm information to the record of a credibility library, carrying out the intercepting of a downloading behavior of the malicious software and the behavior of the communication of a controller server based on the record stored in the credibility library, generating second alarm information, and carrying out the clearing of existed malicious software according to the first and second alarm information. The method can confirm the existing of the malicious software through employing the technology of virtual recognition and the credibility library during the exploitation of vulnerability, and tracks the subsequent activity of the malicious software. Compared with the prior art, the method can recognize the malicious software in a novel attack mode, gets rid of detection hysteresis caused by a signature mode, improves the defense capability of the malicious software, and reduces the loss caused by the malicious software.

Description

technical field [0001] The invention belongs to the field of network security, in particular to a defense method and equipment for novel unknown malicious software. Background technique [0002] With the rapid development of science and technology, the Internet has penetrated into all walks of life, providing various conveniences for people's lives in all aspects. [0003] But there are a small number of people with high technical level, for the purpose of gaining profits, make and use a variety of malicious software to obtain other people's important and private information, such as worms, Trojan horses, distributed denial of service (Distributed Denial of Service, DDoS), etc. Viruses or attack tools. With the advancement of technology, the above-mentioned viruses or attack tools have been focused on prevention, such as zero-day threats, advanced evasion techniques such as deformation and polymorphism, multi-stage attacks, APT attacks and other new attack methods have appe...

AI Technical Summary

Problems solved by technology

With the advancement of technology, the above-mentioned viruses or attack tools have been focused on prevention, such as zero-day threats, advanced evasion techniques such as deformation and polymorphism, multi-stage attacks, APT attacks and other new attack methods have appeared. More modern attack methods, the traditional security mechanism is still unable to carry out effective detection and defense, thus causing huge losses

[0004] In the existing technology, the traditional method of signature detection is often used for viruses or malicious attacks, and it has been unable to effectively defend against viruses or malicious attacks with non-traditional attack types

Images