Process early warning method and device, computer equipment and computer readable storage medium

Abstract

The embodiment of the invention discloses a process early warning method and a device, computer equipment and a computer readable storage medium. The method comprises the steps of obtaining process information of a to-be-detected process; judging the to-be-detected process based on a first process judgment system and the process information to obtain a first process type of the to-be-detected process in the first process judgment system; when the first process type is a preset process type, judging the to-be-detected process based on a second process judgment system to obtain a second processtype of the to-be-detected process in the second process judgment system; based on the second process type, performing risk score setting on the to-be-detected process to obtain a risk score of the to-be-detected process; and when the risk score reaches a preset risk score, performing process early warning. According to the method, the accuracy of process early warning can be improved.

Description

Technical field [0001] This application relates to the field of communication technology, and in particular to a process early warning method, device, computer equipment, and computer-readable storage medium. Background technique [0002] In recent years, with the rapid development of communication technology, more and more illegal processes have also been spawned. Correct process warning can help users manually remove viruses or Trojan horses when anti-virus software does not work. [0003] In the process of research and practice of related technologies, the inventor of this application discovered that the current general method for detecting whether the process in the industry is legal is based on known lists. Blacklists are malicious and whitelists are normal. However, there are many Vulnerability, because there are a large number of processes that cannot be judged black and white, and the unknown is a black file that cannot be judged rudely, which will cause many niche software...

AI Technical Summary

Problems solved by technology

[0003] During the research and practice of related technologies, the inventors of the present application found that the current common method for detecting whether the process is legal in the industry is to judge based on the known list. The blacklist is malicious, and the whitelist is normal. However, there are many Vulnerabilities, because there are a large number of processes that cannot be judged black and white outside the list, and it cannot be roughly determined that unknown files are black files, which will cause many niche software and user-written soft scripts to be falsely reported, and the accuracy of process warnings is low.

Images