BEHAVIOR DISCRIMINATION METHOD, BEHAVIOR DISCRIMINATION DEVICE AND PROGRAM

摘要

To provide a low-overhead behavior discrimination method using deep machine learning.SOLUTION: The behavior discrimination method includes: step S200 for causing a program to be inspected to run in a virtual environment; step S202 for generating memory access information necessary for discrimination of a behavior of the program based on at least one of information of a first flag indicating whether or not the program has read each address in the virtual address space and information of a second flag indicating whether or not writing has been done at each address in the virtual address space, while the program is running in the virtual environment; and step S206 for estimating whether the behavior of the program is normal or abnormal based on the access information.SELECTED DRAWING: Figure 4