Patent ID: 9444834
Filing Date: 2016-09-13
CPC Classification: G06F,H04L

Claim Text:
1. A method for detecting behavior of remotely intruding into a computer comprising: monitoring, by at least one processor, a process creating event in a system; when a request for creating a process is monitored, intercepting, by the at least one processor, the process creating request; determining, by the at least one processor, whether the process creating request is normal by analyzing the process, an ancestor process of the process, and a currently opened port, the determining whether the process creating request is normal comprising determining whether a process frequently utilized for a remote intrusion when the port is opened exists in the ancestor process of the process, determining whether the process is a process frequently utilized for a remote intrusion when the port is opened, and determining the process creating request to be abnormal when the process frequently utilized for the remote intrusion when the port is opened exists in the ancestor process of the process and when the process is frequently utilized for the remote intrusion when the port is opened; and determining, by the at least one processor, the process creating request to be a behavior of remotely intruding into the computer, if the process creating request is abnormal.