Network virus activity detecting system, method, and program, and storage medium storing said program

摘要

In this system, a monitor unit monitors outbound communications through a network interface. A process designation unit designates a process 2 X which has generated communications. A process tree obtaining unit obtains and outputs process tree information for designation of an upper process to the process 2 X. A discrimination unit refers to an illegal rule file for definition of an illegal process by a combination of a process and an upper process which have generated communications, and determines whether or not a process 2 X is illegal according to communications information, process information, and process tree information. A process stop unit stops a process 2 X determined to be illegal. A notification unit notifies a user of the stop of the process 2 X.