Detection of malicious behavior of applet

A non-transitory computer-readable storage medium comprising instructions stored therein that, when executed by a processor of a computing device, cause the processor to:

• obtain at least two behavior records that are generated through triggering during running of the applet;
• extract a behavior feature of each behavior record;
• form at least one feature combination by using at least two behavior features of at least two successively generated behavior records, wherein each feature combination comprises at least two behavior features, and a sequence of the at least two behavior features in the feature combination is the same as a time sequence of generating behavior records corresponding to the at least two behavior features;
• determine whether there is a feature combination that comprises a predetermined feature combination of a malicious behavior record;
• and
• if there is a feature combination that comprises the predetermined feature combination of a malicious behavior record, determine that the applet conducts a malicious behavior.

A computing device, comprising a memory and a processor, wherein the memory stores executable instructions that, in response to execution by the processor, cause processor to:

• obtain at least two behavior records that are generated through triggering during running of the applet;
• extract a behavior feature of each behavior record;
• form at least one feature combination by using at least two behavior features of at least two successively generated behavior records, wherein each feature combination comprises at least two behavior features, and a sequence of the at least two behavior features in the feature combination is the same as a time sequence of generating behavior records corresponding to the at least two behavior features;
• determine whether there is a feature combination that comprises a predetermined feature combination of a malicious behavior record;
• and
• if there is a feature combination that comprises the predetermined feature combination of a malicious behavior record, determine that the applet conducts a malicious behavior.