| 摘要 |
<p><P>PROBLEM TO BE SOLVED: To provide a technology for reducing the occurrence of erroneous detection in detecting fraudulence processing due to computer virus. <P>SOLUTION: A computer device 300 carries out the filtering of a behavior to be inspected before the inspection of fraudulence processing to reduce erroneous detection. In the filtering, the computer device 300 acquires a return address string accumulated in a call stack, and compares the acquired return address string with a preliminarily generated return address string, and determines whether the behavior of software to be monitored is abnormal according to the result of comparison. When it is determined that the behavior is not abnormal, the computer device 300 continues the execution of the software, and when it is determined that the behavior is abnormal, analyzes a code corresponding to the acquired return address string, and detects the presence of the fraudulence processing according to the analysis results. <P>COPYRIGHT: (C)2011,JPO&INPIT</p> |
