Patent Document ID: 9842208
Application ID: 14585080
Patent Status: 1

Claim One:
1. A method for detecting a malicious process behavior, comprising: monitoring one or more process behaviors of a process by a detection apparatus to obtain behavior information about a target process behavior selected from the one or more process behaviors; sending the behavior information about the target process behavior to a server from the detection apparatus; carrying out, by the server, clustering analysis of behavior information about a plurality of malicious process behaviors that have been determined by clustering the behavior information about the plurality of malicious process behaviors into a cluster according to the behavior information about the target process behavior including: a first object identifier that the target process behavior is exerted on; data information generated by the target process behavior; and an identifier of the target process behavior, to obtain a second object identifier for initiating one or more malicious process behaviors of the plurality of malicious process behaviors in the cluster, the second object identifier being different from the first object identifier; determining whether the target process behavior is the malicious process behavior based upon the second object identifier; receiving first operation indication information returned by the server according to a detection result of the target process behavior; and performing an operation on the target process behavior according to the first operation indication information.