Source tracing method during modification of software file, monitoring method and restoration method and system

Abstract

The invention discloses a source tracing method during modification of a software file, a monitoring method and a restoration method and system. The source tracing method comprises the steps of S101, when an operation system kernel is about to perform write on a hard disk, intercepting a write function of the operation system kernel to the hard disk; S102, obtaining a process ID number of a process according to a parameter transmitted when the write function is called by the operation system; S103, obtaining a corresponding process object through the process ID; S104, reading a return address of the write function through a process stack, and performing recursive analysis on original request function call of the process object; S105, obtaining an operator ID and message data submitted by the operator through an original call function so as to obtain a modification source of the modified software file; S106, packaging the operator ID and the message data submitted by the operator by a client computer to form a data package, and uploading the data package to a server; and S107, receiving the data package and sending caution information to a corresponding administrator of the client computer by the server.

Description

technical field [0001] The invention relates to the field of computer software safety monitoring, in particular to a source tracing method, a monitoring method, a restoring method and a system when a software file is modified. Background technique [0002] After personal computers, servers and other computers are invaded, the software files in the computer will be modified, resulting in problems such as Trojan horse files and original files being tampered with in the computer. To find viruses and protect computers, many users install anti-virus software, protective wall software, etc. on their computers to protect the software files in the computers. The current intrusion prevention software is based on the front-end protection software in the form of a firewall, using rules and strategies for protection, because of its own design flaws and its own security flaws make it easy for intruders to bypass the defense, or the software itself cannot handle high concurrency and large...

AI Technical Summary

Problems solved by technology

The current intrusion prevention software is based on the front-end protection software in the form of a firewall, using rules and strategies for protection, because of its own design flaws and its own security flaws make it easy for intruders to bypass the defense, or the software itself cannot handle high concurrency and large traffic Causes the default policy to be enabled to release all requests, resulting in the failure of the defense function, which is easy for hackers to bypass the policy, or bypass the firewall to conduct the next penetration test on the target without any unsafe notification on the firewall, leaving a series of hackers after hacking the system Untraceable records and changes, these untraceable records and changes make it impossible for managers to quickly find the root cause of the intrusion and make it impossible for administrators to quickly troubleshoot

Images