Abstract: A method, system and device for monitoring data. A server receives service running data of a service transmitted from a client. The server acquires a first abnormal strategy corresponding to the service and provides an alarm for the service when the first abnormal strategy is matched according to the service running data. The server can determine for which service running on the client the abnormality occurs and an alarm is provided.

Abstract: A method performed by a computer system determines propagation relationships of Trojan horse files. A current Trojan horse file is stored into a corresponding current level of a propagation relationship tree. A condition of the current Trojan horse file or of the propagation relationship tree is assessed. The following steps are repeated until the condition is satisfied: search Trojan horse files for a parent, child or sibling relative to the current Trojan horse file, identify one of the Trojan horse files as the current Trojan horse file, and store the current Trojan horse file into a corresponding current level of the propagation relationship tree. When the condition is satisfied, the propagation relationship tree is displayed. The storing of the current Trojan horse file may include storing an identifier of the current Trojan horse file, which may include data abstraction output, and/or a downloading address of the current Trojan horse file.

Abstract: A method, system and device for monitoring data. A server receives service running data of a service transmitted from a client. The server acquires a first abnormal strategy corresponding to the service and provides an alarm for the service when the first abnormal strategy is matched according to the service running data. The server can determine for which service running on the client the abnormality occurs and an alarm is provided.

Abstract: A method performed by a computer system determines propagation relationships of Trojan horse files. A current Trojan horse file is stored into a corresponding current level of a propagation relationship tree. A condition of the current Trojan horse file or of the propagation relationship tree is assessed. The following steps are repeated until the condition is satisfied: search Trojan horse files for a parent, child or sibling relative to the current Trojan horse file, identify one of the Trojan horse files as the current Trojan horse file, and store the current Trojan horse file into a corresponding current level of the propagation relationship tree. When the condition is satisfied, the propagation relationship tree is displayed. The storing of the current Trojan horse file may include storing an identifier of the current Trojan horse file, which may include data abstraction output, and/or a downloading address of the current Trojan horse file.