Software-action description, fetching and controlling method with virtual address space characteristic

Abstract

Said invention discloses software behavioural abnormality detection and protecting means. It contains obtaining one software behaviour and address attribute and establishing characteristic of correspondence data integration; using said established characteristic data integration detecting and protection software abnormal behavior, wherein characteristic data integration having virtual space address attribute. Said invented method can restrict software behaviour track without error, capable of raising detecting accuracy, greatly raising identifying efficiency and convenient execution. It can independently use and conjunctively use with other data, for example short sequence, status attribute, and resource attribute. Said invention can realize real time detecting with controlling to application program behaviour, capable of being used in main unit information system safety protection and network information system invasion protection etc field.

Description

technical field [0001] The invention relates to the security protection of computers and network information systems and other fields that need to grasp the characteristics of software behavior. More specifically, the invention relates to a software behavior abnormality detection and protection method based on program behavior. Background technique [0002] From the technical aspect, the security defense means of network information system can be divided into active and passive. Passive means, or reactive means, usually refer to: After an event occurs, by collecting information such as the object of the event, the environment setting, and the result, the characteristics of the subject of the event are extracted, analyzed and analyzed. Standardization, and then use it in future security defenses. Common prevention tools include antivirus, NIDS / HIDS, etc. Although this detection method can detect known viruses and intrusion behaviors very well, it is powerless to detect new ...

AI Technical Summary

Problems solved by technology

The main problem faced by the model based on conditional probability is that it takes a lot of time to establish a normal behavior model and implement high-precision detection, and often has a high false alarm rate due to insufficient training

The rule-based behavior detection model is difficult to determine efficient and feasible rule formulation for more complex environments, and at the same time faces the possibility of missed detection and false detection

Behavior description is the core of behavior monitoring. Different behavior description methods will lead to large differences in accuracy, efficiency and usability of detection results.

Images