Threat tracing method and device of malware

Abstract

The invention provides a threat tracing method and a threat tracing device for malware. The method comprises the following steps of building an association relation between nodes according to a bottom-layer event when the bottom-layer event of software is monitored, wherein each node is corresponding to a progress or a file of the bottom layer event; and when the progress of the malware is detected, searching and recording all dangerous progress and files related to the detected progress according o the built association relation. An association relation network between the nodes is built and updated in real time, so that a threat can be quickly traced based on the association relation network; compared with a big data analysis network tracing mode, the threat tracing method is reduced in consumption of network resources and even does not consume the network resources, and processing efficiency is high.

Description

technical field [0001] The present application relates to the technical field of software security, and in particular to a threat source tracing method and device for malicious software. Background technique [0002] Traditional anti-malware tools analyze and update the signature database by continuously responding to malware; and then use the signature matching in the signature database to deal with newly generated malware. This method has a certain lag and cannot accurately defend against unknown malware. [0003] The rise of active defense has solved this problem to a certain extent, by analyzing whether a process is a malicious process through behavioral judgment, and then allowing or blocking it. However, some well-designed malicious software often has complex links, and the detection of active defense is generally the last link. Even if the process is blocked or the malicious program is deleted, the entrance (or source) of the attack has not been found. There is stil...

AI Technical Summary

Problems solved by technology

[0008] The purpose of this application is to provide a threat source method and device for malicious software, to achieve the purpose of real-time threat source tracking, to solve the problem that active defense cannot be used for threat source tracking, and to use big data analysis to perform threat source source consuming network resources and lag. The problem

Images