Cloud platform malicious behavior detecting system and method

Abstract

The invention discloses a cloud platform malicious behavior detecting system and method, and relates to the field of malicious behavior detection. The cloud platform malicious behavior detecting system comprises a cloud end (10) and a target client (20); the cloud end (10) comprises a first behavior detector (11), a first network detector (12), a scanner (13), a mode sieving device (14), a first malicious program library (15), a first trusted program library (16) and a first network attack mode library (17); the target client (20) comprises a second behavior detector (21), a second network detector (22), a behavior probe (23), a network probe (24), a second malicious program library (25), a second trusted program library (26) and a second network attack mode library (27). The cloud platform malicious behavior detecting system and method has advantages of high efficiency, accuracy, rapidity, expandability and wide adaptability.

Description

technical field [0001] The invention relates to the field of malicious behavior detection, in particular to a cloud platform malicious behavior detection system and method thereof, which have the advantages of high efficiency and scalability. Background technique [0002] Malicious behavior refers to the behavior that the hardware, software and data in the computer system are damaged, changed and leaked by malicious code attacks. With the rapid development of the Internet, various computer malicious programs are constantly appearing while facilitating the society. Various malicious network attacks such as Trojan horses, worms, server vulnerability attacks, remote overflow and Web vulnerability attacks continue to emerge, posing a great threat to users. How to detect these malicious behaviors is a major issue in information security and has very important significance. [0003] Traditional malicious behavior detection technology is based on malicious code features, that is,...

AI Technical Summary

Problems solved by technology

First of all, the computing power and storage capacity of the client system are limited, which limits the ability to identify malicious behaviors to a certain extent; moreover, due to the complexity and diversity of malicious behaviors, a single detection system or method is prone to errors. In addition, the update frequency of the malicious code signature database cannot be guaranteed

Images