| 摘要 |
An approach is provided for providing an offline malware detection, and in addition a real-time malware detection. The offline malware detection may comprise: detecting at least one of function calling map of the application offline, wherein a function calling map records relationships of callings among functions called by the application; extracting patterns of the function callings of the application from the at least one function calling map; and comparing the extracted pattern with at least one basic pattern of normal applications. The real-time malware detection may comprises: running an application in a real environment; recording behaviors of the application at runtime of the application; extracting behavior patterns from the recorded behaviors; and comparing the extracted behavior patterns with at least one of basic patterns of normal applications or patterns previously recorded for the application. |
