Patent ID: 7752668
Filing Date: 2010-07-06
Classification: G06F,H04L

Abstract:
1. A network virus activity detecting system for detecting activities of a network virus in a computer connected to a network, comprising: a discrimination rule storage unit that stores discrimination rule information in which behavior common to fraudulent processes performed by activities of a virus is defined using a hierarchical relationship between processes; an information storage unit that stores management information of processes being operated in the computer and history information including behavior that the processes have performed; a processor configured as a communications monitor unit that monitors communications of the computer, outputs communications information based on a result of the monitoring, and defines a process that has generated new communications as a process to be discriminated; a processor configured as a process designation unit that designates a process to be discriminated and one or more upper processes thereof to the process to be discriminated according to the management information, and creates tree information indicating a relationship between the process to be discriminated and the upper process; and a processor configured as a discrimination unit that determines that the process to be discriminated is a fraudulent process when a behavior performed in a communications process by an upper process corresponds to a behavior defined in the discrimination rule information according to the process tree information, the history information, and the discrimination rule information.