Patent Document ID: 7870612
Application ID: 11518221

Base Claim:
1. An antivirus protection system for computers, comprising: a Process Behavior-Evaluating Unit for identifying programs existing in a user's computer and classifying the programs as normal programs or suspect programs; a Program-Monitoring Unit for monitoring and recording actions and/or behaviors of the programs; a Correlation-Analyzing Unit for creating correlative trees and analyzing correlations of actions and/or behaviors of programs, the correlative trees comprising a process tree and a file tree, wherein each node in said process tree represents a process, and stores action and/or behavior information of the respective process during running and index information of the process in the file tree, and further each node has a parent node corresponding to the parent process of the process corresponding the node, and wherein, in the file tree, each node represents a program, and stores information when the program file is created and index information in the process tree, and further each node has a parent node corresponding to the parent process of the process corresponding the node; a Virus-Identifying Knowledge Base, comprising a Program-Behavior Knowledge Base and a Database of Attack-Identifying Rules, wherein the Program-Behavior Knowledge Base stores correlation behaviors of the normal programs and the Database of Attack-Identifying Rules stores correlation behaviors of the suspect programs; and a Virus-Identifying Unit for receiving program actions and/or behaviors captured by the Program-Monitoring Unit, when the program actions and/or behaviors are dangerous actions, calling the correlation-Analyzing Unit to create correlation behavior according to the process tree and the file tree, if the program is a normal program according to the Process Behavior-Evaluating Unit, comparing the captured actions and/or behaviors to information stored in the Program-Behavior Knowledge Base, and if the program is a suspect program, comparing the captured actions and/or behaviors to information stored in the Database of Attack-Identifying Rules to determine whether the program is a virus in dependence on the comparison.

---

Claim 15:
15. A method of using the antivirus protection system of claim 1 , the method comprising: 15.1) hooking system API function calls of a program by the Program-Monitoring Unit after the program is running; 15.2) monitoring actions of the program, and recording the actions of the program in a process tree by the Program-Monitoring Unit; 15.3) determining whether the action is a program creation action by the Virus-Identifying Unit; 15.4) if the program performs a program creation action, adding program creation information associated with the program creation action into a file tree by the Program-Monitoring Unit, and determining whether the created program is a normal program or suspect program, and recording the result of the determination by the Process Behavior-Evaluating Unit; or if the program does not perform a program creation action, determining whether the action is a dangerous action; 15.5) if the action is not a dangerous action, returning to step 15.2), and if the program actions and/or behaviors are dangerous actions according to the Process Behavior-Evaluating Unit, calling the Correlation-Analyzing Unit to create correlation behavior according to the process tree and the file tree, if the program is a normal program according to the Process Behavior-Evaluating Unit, comparing the captured actions and/or behaviors to information stored in the Program-Behavior Knowledge Base, and if the program is a suspect program, comparing the captured actions and/or behaviors to information stored in or the Database of Attack-Identifying Rules, in combination with information stored in the Process Behavior-Evaluating Unit, and calling the Correlation-Analyzing Unit to determine whether the program is a virus in dependence on the comparison.