关键词: 恶意程序, 差量对比, 检测模型, API函数

Abstract: To detect malicious program, the disadvantages of current detection mechanism were analyzed. The extension of process behavior concept was redefined. A detection model of difference comparison and process dynamic behavior analysis was proposed. The critical technology and realization were given. The experimental results indicate that the detection model excels traditional detection method in versatility and effectiveness.

Key words: vicious procedure, difference comparison, detection model, API function