Method and device for protecting driving program, and electronic device

Abstract

The embodiment of the invention discloses a method and device for protecting a driving program, and an electronic device. The method comprises: hooking a driving program loading function when a hook function pre-injected into an inner nuclear layer function monitors that an application layer process invokes the preset driving program loading function; extracting a file path information of the application layer process invoking the driving program loading function and acquiring a driving program mapped with the file path information; and refusing a driving program loading request of the application layer process if the acquired driving program is the same as any one driving program in a preset driving program characteristic database. By applying the method, device and the electronic device, safety protection efficiency of an operation system can be improved.

Description

technical field [0001] The invention relates to computer network communication security technology, in particular to a method, device and electronic equipment for protecting a driver program. Background technique [0002] With the gradual disclosure of the technical details of the kernel layer of the Windows operating system, more and more malicious applications such as Trojan horses have begun to use kernel layer drivers to protect their own processes. The processes of malicious applications protected by kernel layer drivers can be End (kill) other processes in the Windows operating system, so that the malicious application process can maliciously attack the user's process or system process according to the intention of the malicious application provider, which may cause the computer to run unstable, or even Very large economic losses are brought to the user, for example, a driver corresponding to a malicious application is loaded, so that the malicious application can atta...

AI Technical Summary

Problems solved by technology

[0004] But the method for protecting the driver is to intercept the loading of the malicious driver through the Hook kernel NtLoadDriver function, but in the Windows operating system, there is another hidden method of loading the driver through statistical analysis, so that the malicious application can Through this concealed method of loading the driver, the malicious driver is loaded, thereby attacking the Windows operating system, resulting in low security protection efficiency and low security of the Windows operating system

Images