Real-time threat detection method

Abstract

The embodiment of the invention discloses a real-time threat detection method. According to the method, a chain relation graph of specific processes and executable file objects is formed by tracking an information stream on a system level, system calling monitoring is performed according to the objects involved in the relation graph, and the objects are detected. The method comprises the specificsteps that system calling in the program execution process is monitored and recorded; quick detection is performed on a program; whether program threat exceeds a stipulated value is judged, if yes, next operation is performed, and otherwise monitoring continues to be executed; deep detection is performed on the program; and the program threat is recognized, if the program process is normal, the threat is eliminated, and quick detection is continued, and otherwise threat response is performed. Through the method, security threat, such as file viruses, Trojan horses and ransomware, running in ahost can be recognized effectively and accurately; and meanwhile, damage of unknown malicious codes to a host file can be relieved, and the security and availability of a terminal host system are remarkably improved.

Description

technical field [0001] The invention relates to the technical field of system security, in particular to a method for detecting real-time threats. Background technique [0002] The key to host security protection lies in the ability to detect and prevent malicious code attacks. In terms of malicious code protection, the detection principle of domestic security vendors is basically based on signature signatures. The advantage of this detection method is that the matching speed is fast and the false positive rate is low, but the premise is that the malicious code does not change during its software life cycle. Unfortunately, most viruses and Trojan horses will produce a large number of mutations in a short period of time, and code obfuscation techniques such as deformation, encryption, and polymorphism have been widely used. At the same time, the explosive growth trend of malicious code scale also makes it more and more difficult to update and maintain the signature signatur...

AI Technical Summary

Problems solved by technology

[0004] Embodiments of the present invention provide a method for detecting real-time threats to solve the problems of high misjudgment rate and unsatisfactory effects in threat detection in the prior art

Images