A method and system for discovering malicious code bypassing active defense

Abstract

The invention provides a discovery method and system for bypassing active defense by a malicious code. The method comprises: active defense is turned on and a system key position is scanned simultaneously; a content and a key value of the system key position before suspicious code operation are recorded; the suspicious code is operated to obtain a monitoring result of the active defense; the system key position is scanned again and a content and a key value of the system key position after suspicious code operation are recorded; changing information of the contents and key values of the system key position before and after suspicious code operation is compared to obtain a newly added threat; a detection result of the active defense and the newly added threat are compared and whether detection result of the active defense and the newly added threat are the same is determined; and if so, no newly added suspicious code bypassing the active defense exists; and otherwise, a newly added suspicious code bypassing the active defense is discovered automatically. Therefore, automatic detection of a situation, only discovered manually previous, of bypassing active defense can be realized.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a method and system for discovering malicious code bypassing active defense. Background technique [0002] Active defense is a real-time protection technology based on independent analysis and judgment of program behavior, which solves the problem that traditional security software cannot defend against unknown malicious code. Today, most antivirus software has the function of active defense. For unknown malicious code to run on the user's machine, it must bypass the active defense of the antivirus software. Since the active defense technology judges whether the unknown program behavior is malicious or not based on the discovered malicious code behavior. Therefore, new types of malicious code can use unrecognized malicious program behaviors to bypass active defenses and achieve their own malicious purposes. [0003] The current detection method has certain dr...

AI Technical Summary

Problems solved by technology

[0003] The current detection method has certain drawbacks. Nowadays, for the behavior of malicious code bypassing the active defense, it is mainly found by manual reverse analysis. This method has low output efficiency and is not timely discovered.

Images