Patent ID: 8898775
Filing Date: 2014-11-25
Classification: G06F

Abstract:
1. A method performed by a computer device for detecting malicious behavior of a computer program, comprising: monitoring an action executed by the computer program running on the computer device; searching for a monitored process set associated with the monitored action within a library of monitored process sets, wherein the monitored process set includes information of at least two suspicious processes correlated with each other in creating relationships and logically embodies a common behavior of the two or more suspicious correlated processes contained therein, wherein the monitored process set includes process identifiers of the at least two suspicious processes, program files corresponding to the at least two suspicious processes, actions performed by the at least two suspicious processes, and historical records of data generated by the actions; and if the monitored process set associated with the monitored action is found, judging whether the monitored action belongs to malicious behavior by correlation analysis based on information recorded in the monitored process set found, wherein the monitored process set found, which is associated with the monitored action, includes information of a process initiating the monitored action, wherein the judging step comprises: