Safety protection method and device

Abstract

The invention provides a safety protection method and device. The safety protection device comprises a matching unit, a sending unit and an intercepting unit, wherein the matching unit is used for matching description information of an application program and description information of a DLL file with a preset trigger strategy before the DLL file is loaded by the application program, the sending unit is used for sending the description information of the DLL file loaded by the application program to a server side after matching is successful so that the result of judging whether intercepting is carried out or not can be returned by the server side, and the intercepting unit is used for intercepting the DLL file loaded by the application program after receiving the judging result of conducting intercepting. In this way, by means of the safety protection method and device, the harmful function, caused by loading of the DLL file, of the application program can be effectively separated, the application program with normal use influenced by the third-party DLL file can further return to be normal under appropriate setting, safety management of the DLL file loaded by the application program is achieved, and user experiences are greatly improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a safety protection method and device. Background technique [0002] The interception of malicious programs by existing security protection software usually stops at the interception of the startup process and the interception of the process behavior. For example, when an application program starts a process with a function of pushing advertisements, the start of the process is intercepted; another example, when a process downloads an installation file for a promotional application, the download behavior of the process is intercepted. Therefore, although the security protection software can intercept risky behaviors, it will also invalidate functions required by some users of the application program. [0003] For example, a browser itself can normally provide users with web browsing functions, but after the browser loads a dynamic link library (DynamicLinkLibrary, DLL) file, t...

AI Technical Summary

Problems solved by technology

In this scenario, since the advertisement push behavior of the browser process cannot be effectively distinguished from the normal push message behavior, the security protection software can only block the startup process to prevent the browser from pushing advertisements

However, once the startup of the browser process is blocked, other functions of the process will also be invalidated, so that the user cannot normally use the browser to browse the web.

[0004] It can be seen that the existing security protection software cannot effectively separate the harmful functions of the application program due to the loading of the DLL file, so that the user can only choose between being unable to use normal functions and using normal functions with malicious programs. make a choice

Images