Abstract: A processing unit determines a first mapping relationship and a second mapping relationship, where the first mapping relationship indicates that an access rule of a first physical address is access forbidden, and the second mapping relationship indicates that an access rule of the first physical address is access allowed. The processing unit determines that a target mapping relationship is the first mapping relationship, sends a first access request to a memory control unit. The processing unit receives first exception information sent by the memory control unit, where the first exception information is sent when the memory control unit determines that the access rule of the first physical address in the target mapping relationship is access forbidden. The processing unit monitors a process based on the first exception information, switches the target mapping relationship; and re-sends the first access request to the memory control unit.

Abstract: A method, an apparatus, and a system for detecting a terminal security status are provided. The method includes: receiving a file, and running the file, to generate a dynamic behavior result. The dynamic behavior result includes a behavior sequence that is generated according to a chronological order of occurrence of behaviors. When the file includes an APT, the security protection device obtains a stable behavior feature in the dynamic behavior result, generates a corresponding IOC according to the stable behavior feature, and sends the generated IOC to a terminal. The stable behavior feature is a behavior always existing in a behavior sequence that is generated each time after the file is run.

Abstract: A method, an apparatus, and a system for detecting a terminal security status are provided. The method includes: receiving a file, and running the file, to generate a dynamic behavior result. The dynamic behavior result includes a behavior sequence that is generated according to a chronological order of occurrence of behaviors. When the file includes an APT, the security protection device obtains a stable behavior feature in the dynamic behavior result, generates a corresponding IOC according to the stable behavior feature, and sends the generated IOC to a terminal. The stable behavior feature is a behavior always existing in a behavior sequence that is generated each time after the file is run.

Abstract: A method, an apparatus, and a system for detecting a terminal security status are provided. The method includes: receiving a file, and running the file, to generate a dynamic behavior result. The dynamic behavior result includes a behavior sequence that is generated according to a chronological order of occurrence of behaviors. When the file includes an APT, the security protection device obtains a stable behavior feature in the dynamic behavior result, generates a corresponding IOC according to the stable behavior feature, and sends the generated IOC to a terminal. The stable behavior feature is a behavior always existing in a behavior sequence that is generated each time after the file is run.

Abstract: A processing unit determines a first mapping relationship and a second mapping relationship, where the first mapping relationship indicates that an access rule of a first physical address is access forbidden, and the second mapping relationship indicates that an access rule of the first physical address is access allowed. The processing unit determines that a target mapping relationship is the first mapping relationship, sends a first access request to a memory control unit. The processing unit receives first exception information sent by the memory control unit, where the first exception information is sent when the memory control unit determines that the access rule of the first physical address in the target mapping relationship is access forbidden. The processing unit monitors a process based on the first exception information, switches the target mapping relationship; and re-sends the first access request to the memory control unit.

Abstract: A method, an apparatus, and a system for detecting a terminal security status are provided. The method includes: receiving a file, and running the file, to generate a dynamic behavior result. The dynamic behavior result includes a behavior sequence that is generated according to a chronological order of occurrence of behaviors. When the file includes an APT, the security protection device obtains a stable behavior feature in the dynamic behavior result, generates a corresponding IOC according to the stable behavior feature, and sends the generated IOC to a terminal. The stable behavior feature is a behavior always existing in a behavior sequence that is generated each time after the file is run.