Web page wooden horse detecting method based on behavior characteristic

Abstract

This invention uses browser to check Troy virus wed belonging to computer safety field, which realizes rapid and accurate checking on web Troy web through system process adjusting and memory change. This invention basic principle must generate one new process browser when checking hidden Troy virus through rapid checking on the web through system monitoring to solve the virus web to provide user with safe net environment.

Description

Technical field

[0001] The patent of the invention belongs to the field of computer security. It mainly uses a browser to browse webpages containing Trojan horse programs, and through behaviors such as system process scheduling and memory changes, it can quickly and accurately detect whether a webpage contains Trojan horses, thereby solving the problem of fast speed of harmful webpages in the network. Detection, to provide a safe network environment for Internet users. Background technique

[0002] Computer viruses, Trojan horses, spyware and malicious codes are the most important security threats to computer networks in recent years. In addition to spam emails, there is another important way of spreading computer viruses, Trojans, spyware and malicious codes, which is to use specially constructed webpages to spread viruses and Trojans to the computers of users who visit the webpages. This kind of webpage mainly uses various loopholes in the operating system, browser, plug-...

Examples

Embodiment Construction

[0023] The overall process of the web page Trojan detection method based on behavioral features proposed by the present invention is shown in FIG. 1 . Firstly, a browser program needs to be used to browse the webpage to be detected, that is, the browser program is used to run the code of the webpage to be detected. A Trojan horse program is also a kind of virus, so a Trojan horse program must also be a program that can run, and the Trojan horse program hidden in the web page code can only be activated and run after the web page is run with a browser. Only when the Trojan horse program hidden in the web page code is run, can the process change be observed by the process monitoring program.

[0024] After using the browser program to open the webpage to be detected, immediately run the process monitoring program to monitor the changes of the process, and observe whether there is a new process in the process list. Whether there is a new process can be notified by passing a messa...

Technical field

[0001] The patent of the invention belongs to the field of computer security. It mainly uses a browser to browse webpages containing Trojan horse programs, and through behaviors such as system process scheduling and memory changes, it can quickly and accurately detect whether a webpage contains Trojan horses, thereby solving the problem of fast speed of harmful webpages in the network. Detection, to provide a safe network environment for Internet users. Background technique

[0002] Computer viruses, Trojan horses, spyware and malicious codes are the most important security threats to computer networks in recent years. In addition to spam emails, there is another important way of spreading computer viruses, Trojans, spyware and malicious codes, which is to use specially constructed webpages to spread viruses and Trojans to the computers of users who visit the webpages. This kind of webpage mainly uses various loopholes in the operating system, browser, plug-...

Examples

Embodiment Construction

[0023] The overall process of the web page Trojan detection method based on behavioral features proposed by the present invention is shown in FIG. 1 . Firstly, a browser program needs to be used to browse the webpage to be detected, that is, the browser program is used to run the code of the webpage to be detected. A Trojan horse program is also a kind of virus, so a Trojan horse program must also be a program that can run, and the Trojan horse program hidden in the web page code can only be activated and run after the web page is run with a browser. Only when the Trojan horse program hidden in the web page code is run, can the process change be observed by the process monitoring program.

[0024] After using the browser program to open the webpage to be detected, immediately run the process monitoring program to monitor the changes of the process, and observe whether there is a new process in the process list. Whether there is a new process can be notified by passing a messa...

Images