Patent ID: 9177141
Filing Date: 2015-11-03
Classification: G06F,H04L

Abstract:
1. An active defense method based on cloud security, comprising: recording a black/white list in a database, which black/white list including different program features and corresponding program behaviors; receiving at least one program behavior and a program feature of a program from a client; comparing the received program feature/program behavior with the recorded program feature/program behavior in the database, and making a determination on the program based on the comparison result; feeding back the determination result to the client; wherein, said method further comprising based on the program features and the corresponding program behaviors thereof in the black/white list, performing an analysis of unknown program features and program behaviors of a first program and a second program to update the black/white list comprising establishing an associated relationship between the first program and the second program based on their program features and their program behaviors; when a program behavior of the first program is included into the black/white list, updating the black/white list by: when a program feature of the first program is included into the black/white list, updating the black/white list by: