Initiative intercept method and initiative intercept device for malicious program and client end equipment

Abstract

The invention discloses an initiative intercept method and an initiative intercept device for a malicious program and client end equipment. The initiative intercept device for the malicious program comprises an intercept object selection unit, an intercept information setting unit, an intercept point monitoring unit and an intercept execution unit, wherein the intercept object selection unit is suitable for selecting an intercept object needs to be intercepted according to an access mode of a client end to key input data; the intercept information setting unit is suitable for arranging intercept execution information aiming at the intercept object in an application layer and / or a drive layer; the intercept point monitoring unit is suitable for acquiring information of a key input data accessing program when the key input data is monitored; the intercept execution unit is suitable for judging whether the program is safe according to the information of the program, if so, the program is allowed to call the key input data, if not, the program is intercepted, wherein the intercept point monitoring unit is suitable for judging whether the monitored key input data is data needs to be protected before the information of the key input data assessing program is acquired, if so, the information of the key data assessing program is acquired, and if not, the operation is finished.

Description

technical field [0001] The invention relates to the technical field of computer applications, in particular to a malicious program active interception method and device and client equipment. Background technique [0002] A malicious program generally refers to any software program intentionally created to perform unauthorized and often harmful acts. Computer viruses, backdoor programs, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses (such as batch, windows shell, java, etc.), Trojan horses, crimeware, spyware and adware, etc. , are examples of what could be called malicious programs. [0003] Traditional anti-malware programs mainly rely on the signature database mode. The signature library is composed of the signature codes of malicious program samples collected by the manufacturer, and the signature code is the difference between the malicious program and the legitimate software that the analysis engineer finds, and interc...

AI Technical Summary

Problems solved by technology

[0006] 1. Since the Windows global hooks are effective for most of the process programs in the system once they are registered, the existing solutions cannot separately protect different programs that steal keys, which is easy to cause manslaughter;

[0007] 2. Because the existing solution adopts the method of interception during registration, the operation of the program is usually not fully developed during the registration phase. For example, the game has not yet entered the full-screen state of the game when registering the RawInput device through the interface DirectX, which often causes problems for the judgment of the program type. Difficult, the accuracy of killing is low

Images