| 摘要 |
According to an embodiment of the present invention, provided are a method, an apparatus, and a system for detecting a malicious process behavior. The method includes the following steps of: in which a detection device obtains behavior information with respect to a target process behavior by monitoring a process behavior of a process, and transmits the behavior information with respect to the target process behavior to a server; in which the server detects the target process behavior according based on the behavior information with respect to the target process behavior, determines whether the target process behavior is malicious, receives first operation command information, returned by the server, based on a detection result of the target process behavior, and performs according to the first operation command information. The target process behavior becomes an object for comprehensive detection by the server based on the behavior information with respect to the target process behavior rather than analysis of a specified feature unit of a single sample of the target process behavior by the detection device. Therefore, the malicious process behavior can be timely detected and security performance of the system can be improved. |
