System, equipment and method used for identifying and intercepting bundled software

Abstract

The invention discloses a system, equipment and a method used for identifying and intercepting bundled software. The system comprises an acquirer, a first identifier, a second identifier and a third identifier, wherein the acquirer is configured to acquire an event of creating a new process by current process at a client end and obtain the related information of the new process; the first identifier is configured to match the new process with a first local feature library at least comprising the specific feature information of the known bundled software according to the related information of the new process, identify the new process as the bundled software if the matching operation is successful and input the new process to the second identifier if the matching operation is unsuccessful; the second identifier is configured to match the new process with a second local feature library comprising the common feature information of the known bundled software according to the related information of the new process, and identify the new process as suspicious bundled software if the matching operation is successful; and the third identifier is configured to query in a cloud database at a server end at least according to a process creation relation between the new process identified as the suspicious bundled software and the current process, and identify if the new process is the bundled software.

Description

technical field [0001] The invention relates to the technical field of software installation, in particular to a system and method for identifying and intercepting bundled software. Background technique [0002] At present, there are many and various types of software passively installed on the user's computer through bundled installation, which involves almost all aspects of daily use of the computer. There are also various ways of bundling, and the common ones are as follows: reminder and optional during installation, default plug-in installation, unforeseen mandatory installation, and so on. Under normal circumstances, users often click to install the software directly by default, and do not carefully read the reminder during installation, and then do not know the software bundling situation, resulting in a lot of software installed by bundling on the user's computer. However, if there are too many bundled software, it will affect the performance of the user's computer s...

AI Technical Summary

Problems solved by technology

Under normal circumstances, users often directly click to install the software by default, and do not pay attention to the reminder during installation, and then do not know the software bundling situation, resulting in a lot of software installed on the user's computer through bundling.

However, if there are too many bundled software, it will affect the performance of the user's computer system, reduce the efficiency of starting up and running, and even affect the normal use of the user.

More seriously, some bundled software may cause users to mistakenly install some malicious software or advertising harassment programs without their knowledge, which not only affects the system performance of the user's computer, but also affects the user's experience when surfing the Internet and using the software. , may also threaten the user's computer security

[0003] Moreover, in order to better hide itself, some software will be installed together by bundling other normal software, and will be mutated in various ways, so it is more difficult to identify and block

Images