Patent Document ID: 9894097
Application ID: 14700323
Patent Flag: 1

Claim One:
1. A method for identifying an abnormal application, comprising: executing, by a virtual machine, prestored abnormal applications, which are viruses or Trojan programs; obtaining dynamic behavior information of the prestored abnormal applications; inputting the dynamic behavior information of the prestored abnormal applications into a preset detection network; obtaining a behavior rule of the dynamic behavior information via the preset detection network; and identifying a detected application according to the behavior rule of the dynamic behavior information to determine whether the detected application is a virus or Trojan program; wherein inputting the dynamic behavior information of the prestored abnormal applications into the preset detection network includes converting the dynamic behavior vector; and inputting the behavior vector into the preset detection network; and wherein obtaining dynamic behavior information of the prestored abnormal applications and converting the dynamic behavior information of the prestored abnormal applications into a behavior vector includes: monitoring whether each of the abnormal applications executes at least one of operating a danger registry, operating a sensitive file, performing dangerous operation on network connection, and operating and Application Programming Interface (API); when one of the above operations is executed, one of number 0 and 1 is allocated, when one of the above operations is nor performed, the other one of number 0 and 1 is allocated; and creating a behavior vector comprising the allocated 0 and 1.