Independent of the signature , based on system behavior , and malware detection

摘要

SolutionsThe method of detecting maruuea on the basis of system behavior, it is the system, and computer program product. One which is estimated that with present operational mode of the processing system which has the resource of one or more it becomes active process it specifies at least. With estimate activity level of the resource of one or more of the processing system is calculated at least one which is estimated that present operational mode and it becomes active, process on the basis of. Actual activity level of the plural resources is decided. When deviation is detected with estimate activity level and actual activity level, it specifies the source of the activity which is not estimated as the cause of latency of deviation. Using the policy guideline, it decides whether the activity which is not estimated is legitimate. When the activity which is not estimated is not legitimate, it classifies the source of the activity which is not estimated as maruuea. Selective figure Figure 1