Safety detection method and device

Abstract

The invention discloses a safety detection method and device and belongs to the technical field of computer safety. The safety detection method comprises the steps that a launching module which launches sensitive operation in a process is determined, the identity information of the launching module is acquired, and the safety of the launched sensitive operation is detected according to the acquired information and a preset database. Compared with the prior art, the safety detection method and device have the advantages that the detection granularity is fine, and the safety and the stability of a computer system can be effectively improved; due to the fact that the safety of the launched sensitive operation is detected according to the identity information of the launching module and the preset database, the problem that the situation that a launching module with a black property launches sensitive operation by hijacking the progress of a launching module with a white property can not be detected can be effectively solved, as a result, the safety detecting efficiency can be effectively improved, and the safety and the stability of the computer system are guaranteed.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a security detection method and device. Background technique [0002] With the development of science and technology, computer real-time protection technology is a necessary guarantee to ensure the safe operation of computers. [0003] In the existing real-time protection technology, by monitoring sensitive operations of the system such as driver loading, modifying key entries in the system registry, or injection, etc., when a sensitive operation of the system is captured, the initiation process of the sensitive operation and Information about the initiating process. For example, the relevant information of the initiating process exe of the sensitive operation may include at least one of md5, digital signature and file vendor information of the initiating process. Then perform security detection on the initiating process according to the relevant information of the in...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the present invention, the inventor found that the prior art has at least the following problems: the above-mentioned existing real-time protection technology only performs security verification on the initiation process of sensitive operations, but in practical applications, an initiation process may contain Multiple modules, when the initiating process is a safe (that is, white attribute) process, and the multiple modules in the initiating process include dangerous (that is, black attribute) modules, and the dangerous module is injected, dll hijacks and enters the belonging Safely initiate the process and initiate sensitive operations. According to the existing real-time protection technology mentioned above, since the initiation process is safe, the sensitive operation is directly released, and the actual initiator is a black attribute module that hijacks the initiation process and initiates it. Seriously affecting the security and stability of the system

Therefore, the security detection granularity in the existing real-time protection technology is too coarse, resulting in poor security and stability of the computer system

Images