Computer protecting method based on programm behaviour analysis

Abstract

A computer protection method based on program behavior analysis includes monitoring its actuation behavior and comparing it with its legal actuation behavior stored in program behavior knowledge bank then judging whether known program is attacked illegally or not for known program; monitoring its actuation behavior and comparing it with attack identification rule stored in attack identification rule bank then judging whether it is harmful program or not for unknown program.

Description

technical field

[0001] The invention relates to a computer protection method, which is different from the prior art in that it does not use virus feature codes for comparison, but uses program action behavior as a feature, and is a computer protection method based on program behavior analysis. Background technique

[0002] For a long time, the struggle against computer virus invasion and anti-invasion has been going on fiercely. With the use of computers more and more widely, the intensity of this struggle has also risen to a new height. After long-term struggle and practice, people have summed up many specific methods to prevent the invasion of computer viruses, and developed many corresponding prevention products. These products can be roughly divided into two categories. One is to isolate intruding viruses, such as firewalls, which prevent the entry of intruding viruses by restricting communication ports and protocols; the other is to isolate virus-infected files that may...

Images