Thank you for your comments and exchanges.
HIPS is the abbreviation of "host intrusion prevention system" in English, which is usually translated as "host intrusion prevention system".
At the RSA conference held in San Francisco in 2007, experts said that "more and more complex malware is constantly multiplying, and the ability of traditional signature-based security software to intercept viruses and worms is increasingly questioned." "In 2007 alone, there were at least 200,000 new viruses and variants, and the signature technology was crumbling under the attack of cyber hackers. The virus database that security software relies on is often updated only after the virus breaks out, or once the user fails to update the virus database in time, it is likely that there is nothing to do with the new virus.
Based on the above reasons, the security software HIPS with system process as the core came into being. She can monitor the behavior generated by the process, such as starting, accessing the network, registry, files, process injection, registering drivers, calling components and so on. And remind users of dangerous actions. If the user chooses to block, the process will not be able to carry out subsequent work.
On the other hand, HIPS can also effectively protect files, registries, networks and other resources to prevent unauthorized processes from reading and writing.
Time to 20 19, such as' velvet security'. Strictly speaking, tinder is an active defense software (HIPS), which is not much different from previous software such as GSS PG ADsafe SSM EQSecure, but it is more perfect, with the help of virus database. Won the love of some users who have a certain computer foundation.
1, the system resource occupation is small. Because the basic rules and virus database are relatively small, there are relatively few system resources for temporary operation.
2. Users have a high degree of participation and can establish their own defense rules, which provides some users with computer foundation with a high sense of participation and accomplishment.
3. Compared with anti-virus software, HIPS software gives users the feeling of "light weight" because of its simple function, and gives users with strong meaning of "sovereignty" of computers a very comfortable feeling. In addition, because of its light weight, it has become a partner of some relatively bulky anti-virus software. For example, some users use digital security software and tinder security software together.
HIPS active defense technology plays an important role in ensuring the security of 0Day (independent of virus database). HISP includes AD (process protection), FD (file protection), RD (registry protection) and sandbox. By analyzing software behavior, we can decide whether to intervene.
1, HIPS software itself depends on the establishment of security rules, which is unfriendly to ordinary users without computer foundation, and will become the key target of attackers in some cases.
2, too professional, HIPS can only have the operation of "either operable or inoperable", giving you multiple inquiries at most. How does an ordinary computer user know whether to allow modification when he sees user32.dll?
This is not as good as some antivirus software that has won the hearts of Chinese people. For example, digital software integration HIPS+ traditional antivirus software engine+self-research technology, to give users more comprehensive protection. Ordinary users don't need to care too much about security issues, just focus on closing various pop-ups.
There was a "micro-point active defense software" in China before. Today, the author found that the official website could not be opened, and the related news also stayed at 18, with great emotion.
For companies that are still doing security software seriously, what we can do is to install and use it and share feedback and support.