Wukong Security employs behavior-based detection, monitoring window creation events in the Windows message queue in real time, identifying parent processes, trigger timing, and window styles, and combining large model semantic understanding to analyze pop-up text.