A SYSTEM FOR DETECTING HARMFUL PROGRAMS BASED ON MONITORING ABNORMAL BEHAVIORS AND THE DETECTION METHOD USED THEREFOR

摘要

A system and a method for detecting harmful programs based on abnormal behaviors are provided to offer wide security for various unknown harmful programs by enabling a user to easily set combination of the abnormal behaviors of the harmful programs and a generation type of each abnormal behavior as a blocking condition, and detecting/blocking the harmful programs based on the blocking condition. A blocking condition managing module(21) establishes the blocking condition by providing a menu for selecting the abnormal behaviors and the abnormal behavior generation type to the user, and manages the blocking condition and a harmful program list. An abnormal behavior detecting module(11) detects the abnormal behavior of execution programs. A harmful program diagnosing module(12) diagnoses the unknown harmful program by determining whether the detected abnormal behavior satisfies the block condition. A harmful program blocking module(13) blocks the harmful program according to the harmful program list and a diagnosis result of the harmful program diagnosing module. A database stores the blocking condition information, abnormal behavior generation information, and the harmful program list.