Malicious program detection method and device

Abstract

The invention discloses a malicious program detection method and device, and belongs to the technical field of computers. The method comprises the following steps that: utilizing an ARM (Advanced RISC Machines) instruction translator to execute an ARM instruction of a current row in a program; detecting whether the ARM instruction comprises a first calling function or not; when a detection result shows that the ARM instruction comprises the first calling function, obtaining a first parameter called by the first calling function from the program; detecting whether a behavior indicated by the first calling function and the first parameter is a malicious behavior or not; and when the behavior indicated by the first calling function and the first parameter is the malicious behavior, determining that the program is the malicious program. By use of the method, the problem that identification which needs to be matched with the terminal is gradually increased since the storage space, which is occupied by the identification of the malicious program, of the terminal is gradually enlarged because the terminal needs to increase the identification of the malicious program along with the increasing of the malicious program when the terminal detects whether the program is the malicious program or not according to the identification of the program is solved, and effects of saving the storage space of the terminal and improving detection efficiency are achieved.

Description

technical field [0001] The invention relates to the field of computers, in particular to a malicious program detection method and device. Background technique [0002] Malicious programs can steal or destroy data stored in the terminal. Therefore, in order to improve data security, the terminal needs to detect malicious programs. [0003] At present, for malicious programs including Advanced RISC Machines (ARM) instructions, the terminal can collect the identification of each malicious program, obtain the identification of the program to be detected, and detect whether the identification of the program to be detected is a malicious program. An identification, when the identification of the program to be detected is an identification of a malicious program, it is determined that the program to be detected is a malicious program. Wherein, the identifier is a feature code or a hash value. [0004] Since different malicious programs have different identifiers, as the number of...

AI Technical Summary

Problems solved by technology

[0004] Since different malicious programs have different identifiers, as the number of malicious programs increases, the number of identifiers that the terminal needs to obtain increases, and the occupied storage space increases accordingly

Images