Malicious event positioning method and system, storage medium and terminal

Abstract

The invention provides a malicious event positioning method. The method comprises the following steps: confirming a malicious event detection point; respectively performing upward backtracking and downward backtracking on the malicious event detection point in a database, and determining a target original event associated with the malicious event detection point; constructing a malicious behavior logic relationship according to the execution sequence of the target original event; determining a malicious attack process corresponding to the malicious event detection point according to the logical relationship, wherein the malicious attack process is used for positioning all malicious events associated with the malicious event detection point. According to the method and the device, the malicious event can be thoroughly resisted and handled, the malicious event is prevented from relapsing due to incomplete handling, and the protection effect when the equipment is attacked by malicious software is effectively improved. The invention also provides a malicious event positioning system, a computer readable storage medium and a terminal, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of network security, in particular to a method for locating malicious events, a locating system, a computer-readable storage medium, and a terminal. Background technique [0002] At present, the malware detection process only analyzes and detects the detected point. The detected point is a single point detected in the malware detection process, generally referring to a file or a process. Since the analysis and detection are only performed on the detected point, the user cannot know the malware execution process; secondly, the prevention and disposal of malicious behaviors or malicious events become single-point prevention and single-point disposal, and the malware cannot be completely blocked and disposed of. It may run again, causing malicious effects. [0003] Therefore, how to effectively deal with malicious software is a technical problem urgently needed to be solved by those skilled in the art. Conte...

AI Technical Summary

Problems solved by technology

Since the analysis and detection are only performed on the detected point, the user cannot know the malware execution process; secondly, the prevention and disposal of malicious behaviors or malicious events become single-point prevention and single-point disposal, and the malware cannot be completely blocked and disposed of. It may run again, causing malicious effects

Images