Importance

Loading Importance Indicators...

Abstract

Disclosed are methods and devices for detecting a suspicious process. Test values of data flow direction characteristics of a to-be-detected host and sample values of the data flow direction characteristics corresponding to the to-be-detected host in a data flow direction library are acquired, wherein the data flow direction characteristics comprise at least one of a process list and a network egress characteristic, and a data source characteristic. It is then determined that a suspicious process is detected when a test value of the process list is different from a sample value of the process list and/or a test value of the network egress characteristic is different from a sample value of the network egress characteristic in the case that a test value of the data source characteristic is the same as a sample value of the data source characteristic. It can be seen that the disclosed methods and devices for detecting a suspicious process according detect a suspicious process based on the data flow direction characteristics rather than the attack behaviors of applications. Moreover, because data flow direction characteristics change whenever data theft occurs, the methods and devices can accurately detect a suspicious process in which data might be stolen.

Loading the Abstract Image...

First Claim