A process detection method and system for application programs

Abstract

Embodiments of the present invention provide a process detection method and system for application programs, the method comprising: obtaining an observable behavior vector corresponding to a process according to the content of a security log; converting the observable behavior vector into a process behavior characteristic map; Based on the trained convolutional neural network model, the process behavior feature map is detected to obtain the detection result of the process; the trained convolutional neural network model is a sample process behavior feature marked with a normal process label graph and process behavior feature graphs labeled with malicious process labels are trained. The embodiments of the present invention can effectively identify abnormal processes, make up for the low accuracy of identifying abnormal processes through manual techniques, and have good adaptability and high robustness to different types of malicious processes.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a process detection method and system for application programs. Background technique [0002] In recent years, the number of malicious programs has grown exponentially, and has become one of the key factors threatening Internet security. How to effectively detect and kill malicious programs has also become one of the most important issues for enterprises and network security personnel. With the continuous development and improvement of artificial intelligence technology, how to apply artificial intelligence technology to malicious program detection and realize self-inspection in unsupervised or semi-supervised mode of the system has become one of the needs of current enterprises. [0003] For the detection and killing of malicious programs, most current technologies analyze the source code of malicious programs, extract corresponding features, and then scan and kill malicious ...

AI Technical Summary

Problems solved by technology

Among them, there are a large number of variants of some malicious programs and malicious program source codes, and the existing malicious program source code detection technology cannot effectively detect them.

Images