Method and device for monitoring executable program

Abstract

The invention discloses a method and device for monitoring an executable program. The method includes the steps that the executable program to be monitored is determined; feature information of the executable program to be monitored and a file, installed on a client side, of the executable program to be monitored are acquired; according to the matching result of the file and the feature information, whether the executable program to be monitored is an incredible program or not is determined, and when the executable program to be monitored is the incredible program, the executable program to be monitored is intercepted. The feature information of the executable program to be monitored and the file, installed on the client side, of the executable program to be monitored are acquired, according to the matching result of the file and the feature information, it is determined that the executable program to be monitored is the incredible program, and then the executable program to be monitored is intercepted, dependence on malicious code features is removed, the incredible program can be searched for, killed and intercepted, and security of user information is effectively guaranteed.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and device for monitoring an executable program. Background technique [0002] In recent years, makers of viruses and malicious codes have begun to evade detection by existing security software by exploiting a loophole in legitimate software. The specific principle is as follows: a software is generally composed of an executable program body (exe file) and a dependent file (dll file). The exe file will dynamically load the dll file after startup, and execute the functions exported in the dll. Due to the lack of security awareness and some inherent technical defects, program designers generally do not verify whether the loaded dll has been tampered with or replaced. The creators of viruses and malicious codes can change the names of the exe files of the software to confusing names such as game accelerators, modifiers, gadgets, etc., and then package them tog...

AI Technical Summary

Problems solved by technology

[0004] However, in the process of realizing the present invention, the inventors found that the prior art has at least the following problems: the above-mentioned method mainly relies on the characteristics of the obtained malicious code, so there is a hysteresis, and the malicious code cannot be detected and intercepted in time

Images