Method, apparatus and system for detecting malicious process behavior

A method for detecting a malicious process behavior, comprising:

• monitoring a process behavior of a process to obtain behavior information about a target process behavior;
• sending the behavior information to a server;
• receiving first operation indication information returned by the server according to a detection result of the target process behavior;
• and
• performing an operation on the target process behavior according to the first operation indication information.

An apparatus for detecting a malicious process behavior, comprising:

• a monitoring unit for monitoring a process behavior of a process to obtain behavior information about a target process behavior;
• a sending unit for sending the behavior information about the target process behavior to a server, so that the server detects the target process behavior according to the behavior information about the target process behavior to determine whether the target process behavior is a malicious process behavior;
• a receiving unit for receiving first operation indication information returned by the server according to the detection result of the target process behavior;
• and
• an operation unit for performing an operation on the target process behavior according to the first operation indication information.

A non-volatile computer storage medium including at least one program for detecting a malicious process behavior when implemented by a processor, comprising:

• instruction for monitoring a process behavior of a process to obtain behavior information about a target process behavior;
• instruction for sending the behavior information to a server;
• instruction for receiving first operation indication information returned by the server according to a detection result of the target process behavior;
• and
• instruction for performing an operation on the target process behavior according to the first operation indication information.