Detecting method and architecture thereof for malicious codes

摘要: A detecting method and architecture thereof for malicious codes is provided, which applicable to a computer system having at least host. Each host executes process. The implemented with call interposition module an analysis codes. intercepts all calls of process related arguments the calls. analyzes input data pre-determined calls, suspicious Once same behaviors between are found, system-intrusion warning immediately triggered. not required maintain huge signature databases, can detect unknown attack-skills in manner high correct rate low incorrect ruling.