Detection device and method of unknown application bug threat

摘要: The invention relates to the technical field of computer communication, in particular a detection device and method unknown application bug threat. comprises sample acquisition device, preprocessing filter an analog behavior monitoring comparison analysis wherein is used for collecting transmitted document attachment from flow network inlet; collected filtering known accessories which contain bugs obviously do not bugs; carrying out simulation execution on filtered accessories; process monitored recorded by find suspicious acts exhibit security threats process. An expert system knowledge base adopted carry result judgment detected can intelligently judge whether be taken advantage are presence or along with situation that constantly enriched, problem false alarm effectively solved.