METHOD AND APPARATUS FOR AUTOMATICALLY PROTECTING A COMPUTER AGAINST A HARMFUL PROGRAM

• US 20100313269A1
• Filed: 10/15/2008
• Published: 12/09/2010
• Est. Priority Date: 10/15/2007
• Status: Active Grant

• Current Assignee: Beijing Rising Information Technology Co., Ltd.
• Original Assignee: Beijing Rising International Software Company Limited
• Inventors: Ye, Chao
• Granted Patent: US 8,561,192 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

The present invention discloses a method and apparatus for automatically protecting computers against harmful programs. The method comprises: restricting an object program from accessing some resources in a computer system based on predetermined resource access rules; scanning computer resources accessed by the object program to determine whether the accessed computer resources are infected by the object program; and analyzing malicious behaviors based on behavior characteristics of the object program to determine whether the object program is a harmful program.

Claims

1. A method for automatically protecting a computer, comprising:

restricting an object program from accessing some resources in a computer system based on predetermined resource access rules;

scanning computer resources accessed by the object program to determine whether the accessed computer resources are infected by the object program; and

analyzing malicious behaviors based on behavior characteristics of the object program to determine whether the object program is a harmful program.

2. The method according to claim 1, further comprising:

creating a new resource access rule based on the determination results of the step of scanning the computer resources and/or the step of analyzing the malicious behaviors; and

automatically adding the created new resource access rule into the predetermined resource access rules.

3. The method according to claim 2, wherein the step of creating the new resource access rule comprises:

when the step of scanning the computer resources determines that the accessed computer resources are infected, the created new resource access rule includes that the infected computer resources are not allowed to be accessed by any program.

4. The method according to claim 2, wherein the step of creating the new resource access rule comprises:

when the step of analyzing the malicious behaviors determines that the object program is a harmful program, the created new resource access rule includes that a program file associated with the harmful object program is not allowed to be started by any program.

5. The method according to claim 4, wherein the program file associated with the harmful object program is an executable program file.

6. The method according to any one of claims 2-5, further comprising:

a user starts manual scanning to scan and kill virus files existing in the computer system and files infected by viruses; and

the step of creating the new resource access rule further comprises creating the new resource access rule based on the result of the manual scanning.

7. The method according to claim 6, wherein the created new resource access rule comprises:

the virus files found out by the manual scanning or the files infected by viruses are not allowed to be accessed by any program.

8. The method according to claim 1, wherein the step of analyzing the malicious behaviors further comprises:

if the step of analyzing the malicious behaviors determines that the object program is a harmful program, the object program is determined again by using a virus “

DNA”

recognition technology; and

the object program is determined to be a harmful program only when the object program is determined to be a harmful program by both the malicious behavior analysis and the virus “

DNA”

recognition technology.

9. The method according to claim 1, wherein the predetermined resource access rules include at least one of file access rules, process start control rules, registry access rules and system action rules.

10. The method according to claim 9, wherein the step of restricting an object program from accessing some resources further comprises:

prompting the user to decide whether to prevent the access of the object program when it is determined that the object program have accessed the resources which are determined to be prohibited from being accessed in the resource access rules; and

proceeding to the step of analyzing the malicious behaviors after the object program is prevented according to user'"'"'s decision.

11. The method according to claim 10, further comprising:

proceeding to the step of scanning the computer resources if the user decides not to prevent the object program.

12. An apparatus for automatically protecting a computer from a harmful program comprising:

a resource access rule control module for restricting an object program from accessing some resources in a computer system based on predetermined resource access rules;

a resource access scanning module for scanning computer resources accessed by the object program to determine whether the accessed computer resources are infected by the object program; and

a malicious behavior analyzing module for analyzing malicious behaviors based on behavior characteristics of the object program to determine whether the object program is a harmful program.

13. The apparatus according to claim 12, further comprising:

an automatic updating module for creating a new resource access rule based on the determination results of the resource access scanning module and/or the malicious behavior analyzing module; and

automatically adding the created new resource access rule into the predetermined resource access rules.

14. The apparatus according to claim 13, wherein:

when the resource access scanning module determines that the accessed computer resources are infected, the new resource access rule created by the automatic updating module includes that the infected computer resources are not allowed to be accessed by any program; and

when the malicious behavior analyzing module determines that the object program is a harmful program, the new resource access rule created by the automatic updating module includes that a program file associated with the harmful object program is not allowed to be started by any program.

15. The apparatus according to claim 12-14, wherein the malicious behavior analyzing module further comprises:

a virus “

DNA”

recognition module for determining the object program again by using a virus “

DNA”

recognition technology after the object program is determined to be a harmful program by the malicious behavior analyzing module, and wherein

the object program is determined to be a harmful program only when the object program is determined to be a harmful program by both the malicious behavior analyzing module and the virus “

DNA”

recognition module.