Method and device for protecting operation system, and electronic device

Abstract

The embodiment of the invention discloses a method and device for protecting an operation system, and an electronic device. The method comprises: hooking an operation system shutdown or restart function when a hook function pre-injected into an inner nuclear layer monitors that an application layer process invokes an operation system shutdown or restart function; acquiring process path information of the application layer process invoking the operation system shutdown or restart function, and extracting an application program mapped with the process path information; and refusing a shutdown or restart request of the application program if the acquired application program is the same as any one application program in a preset application program characteristic database. By applying the method and device and the electronic device, safety protection efficiency of the operation system can be improved.

Description

technical field [0001] The invention relates to computer network security technology, in particular to a method, device and electronic equipment for protecting an operating system. Background technique [0002] With the gradual disclosure of the technical details of the kernel layer of the Windows operating system, more and more malicious applications such as Trojan horses have begun to use kernel layer drivers to protect their own processes. The processes of malicious applications protected by kernel layer drivers can be End (kill) other processes in the Windows operating system, so that the malicious application process can maliciously attack the user's process or system process according to the intention of the malicious application provider, which may cause the computer to run unstable, or even Bring very large economic losses to users, for example, maliciously shut down or restart the computer system, thereby destroying the computer user system and causing user data to ...

AI Technical Summary

Problems solved by technology

[0005] But the method for preventing the operating system from being maliciously shut down or restarted, because the function of the shutdown function ExitWindows function or ExitWindowsEx function corresponding to the kernel is NtShutdownSystem, therefore, when the application layer process calls the ExitWindows function or ExitWindowsEx function to close and restart the operating system, the ExitWindows function Or the ExitWindowsEx function needs to call the kernel NtShutdownSystem function to shut down and restart the operating system, so that the function that actually completes the shutdown and restart of the operating system is the kernel NtShutdownSystem function, so that malicious applications can directly call the kernel NtShutdownSystem function to achieve malicious operations on the operating system Shutdown or restart operation, resulting in user data not being stored in time and being damaged, cannot effectively prevent malicious shutdown or restart of the operating system, resulting in low security protection efficiency and low security of the Windows operating system

Images