Method and device for preventing and removing mining viruses under Linux platform and storage equipment

Abstract

The embodiment of the invention discloses a method and device for preventing and removing mining viruses under a Linux platform and storage equipment, relates to the technical field of network security, and provides a method for preventing and removing general mining viruses under a Linux system. The method comprises the following steps: extracting universal behavior characteristics of mining viruses to form a basic characteristic library, and extracting special behaviors of the mining viruses to form an enhanced characteristic library; forming a mining virus detection knowledge base accordingto the basic feature library and the enhanced characteristic library; monitoring a program which is being started and parent and child processes thereof, extracting behavior information, and comparing the behavior information with characteristic s in the mining virus detection knowledge base; carrying out mining virus threat judgment through a basic characteristic scoring and enhanced characteristic scoring mixed scoring mechanism; and intercepting the process which is judged to be the mining virus, and carrying out relevance clearing on the started mining virus process.

Description

technical field [0001] The invention relates to the technical field of network transmission security, in particular to a mining virus protection and removal method, device and storage device under a Linux platform. Background technique [0002] The huge profits in the virtual currency market have attracted more and more attackers to use various malicious codes to attack the computers of ordinary users. There are not many popular types of attacks under the Linux platform, and mining incidents have accounted for a relatively high proportion in recent years. , the attacker hangs malicious scripts on their own or intruded websites. As long as ordinary users click to visit these websites with malicious scripts, they will become virtual currency miners such as Romoncoin. The attackers will directly use the malicious code implanted The user's computer resources are used for mining. [0003] The current mining removal methods are based on the analysis of known events, and special k...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the embodiment of the present invention provides a mining virus protection and removal method, device and storage device under the Linux platform, through mining feature extraction, behavior information comparison, threat determination, process association removal, to solve the current problems Mining removal methods are based on the analysis of known events and special killings are carried out through corresponding mining behaviors. There is no mature mechanism for the protection of known mining events and unknown mining viruses, and it is difficult to achieve common use under Linux systems. Types of Mining for Defense Issues

Images