Threat traceability method and device for malicious software

Abstract

The present application provides a threat source tracing method and device for malicious software. The method comprises the following steps: when detecting the underlying event of the software, creating an association relationship between nodes according to the underlying event, each node corresponding to a process or file of the underlying event; when detecting a malicious software process, according to the established Correlation finds and logs all dangerous processes and files related to the detected process. Since the association relationship network between nodes is created and updated in real time, the threat source can be quickly traced based on the association relationship network. Compared with the network traceability method of big data analysis, it reduces or even does not need to consume network resources, and the processing efficiency is high.

Description

Technical field[0001]The present application relates to software security technology, and in particular, there is a threat tracing method and device for malware.Background technique[0002]Traditional malware killing tools are analyzed by constant response to malware, thereby updating the feature library; use the feature code match in the feature library to deal with new malware. This approach has a certain lag, and cannot accurately defense unknown malware.[0003]The rise of active defense solves this problem to a certain extent, and analyzes whether a process is malicious process through behavior, thereby performing or blocking. However, some well-designed malware tend to have a complex link. Active defense is generally the last loop, even if the process is blocked or the malicious program is deleted, the entrance to the attack (or source) is not discovered, There is still possible possibilities that are subject to secondary attacks.[0004]For example, the user doubles the browser to ...

AI Technical Summary

Problems solved by technology

[0008] The purpose of this application is to provide a threat source method and device for malicious software, to achieve the purpose of real-time threat source tracking, to solve the problem that active defense cannot be used for threat source tracking, and to use big data analysis to perform threat source source consuming network resources and lag. The problem

Images