【摘要】 现主流的恶意代码检测软件使用的大多是特征码扫描来检测已知恶意代码,而恶意程序的搜集很困难,特征码的提取需要专业人士人工完成,效率低,并处于被动状态。针对特征码扫描方法的不足,提出了一种基于行为分析方法的主动防御系统,该系统采用进程评分和综合行为两种机制判断执行程序是否为恶意代码,对进程、文件和注册表等评分,对进程行为和系统关键资源进行监控、自动分析、诊断,有效地抵制了未知病毒和未知攻击的侵入,保障终端系统的安全性。更多还原

【Abstract】 The methods of signature scanning are often used by current main malicious code detection software to detect known malicious codes. But it is difficult to collect malicious software, and efficiency is low and mode is passive since the extraction of signature often only can be completed by professional. Concerned on the deficiency of malicious code detection methods, the paper presents the active defense system based on behavior analysis method which uses mechanisms of process grading and composite behaviors to decide if the executing program is malicious. By scoring to processes, files and registry value, monitoring, analyzing automatically and diagnosing to process behaviors and key resources of system, the active defense system can defense intrusion of unknown virus and attacks effectively, which leads a secure terminal system.更多还原