APPARATUS AND METHOD FOR DETECTING ABNORMAL BEHAVIOR

摘要

Provided are abnormal behavior detecting apparatus and method and the abnormal behavior detecting apparatus, includes: a behavior analyzing unit which analyzes a behavior which occurs for resources of a system based on data collected from a process while the process is executed on the system; a behavior modeling unit which models a behavior analysis result for the resources of the system on a coordinate which is generated based on the behavior for the resources of the system to create a process behavior model corresponding to the resources of the system; a suspicious behavior determining unit which determines a suspicious behavior of the process in accordance with the type of the process behavior model which is implemented on the coordinate; and a process detecting unit which detects a process in which the suspicious behavior occurs as an abnormal behavior process.

主权项

1. An abnormal behavior detecting apparatus, comprising:
a behavior analyzing unit which analyzes a behavior which occurs for resources of a system based on data collected from a process while the process is executed on the system; a behavior modeling unit which models a behavior analysis result for each resource of the system on a coordinate which is generated based on the behavior for the each resource of the system to create a process behavior model corresponding to the each resource of the system; a suspicious behavior determining unit which determines a suspicious behavior of the process in accordance with the type of process behavior model which is implemented on the coordinate which is generated based on the behavior for the each resource of the system; and a process detecting unit which detects a process in which the suspicious behavior occurs as an abnormal behavior process in accordance with the determining result of the suspicious behavior determining unit.