Malicious program detection method and device, electronic equipment and storage medium

Abstract

The invention provides a malicious program detection method and device, electronic equipment and a storage medium, and the method comprises the steps of obtaining a process identifier corresponding to a process creation event when the process creation event is monitored; searching an application program corresponding to the process identifier, and extracting feature information of the application program, wherein the feature information comprises an encryption value or an absolute path of the program file; and verifying the feature information by using a preset feature library, and determining that the application program is a malicious program when verification succeeds. According to the invention, the process creation event can be obtained by utilizing the process monitoring service provided by the operating system, the running application program is determined by utilizing the event, and then whether the program is a malicious program or not is determined by utilizing the file characteristics of the application program without using an interception driver, so that the adaptation work caused by the interception driver can be effectively avoided; and the malicious program can be detected in an efficient, simple and convenient manner, so that the flexibility and reliability of detecting the malicious program by the Internet of Things equipment are improved.

Description

technical field [0001] The present invention relates to the field of Internet of Things equipment, in particular to a malicious program detection method, device, electronic equipment and storage medium. Background technique [0002] With the continuous development and popularization of the Internet of Things, the number of Internet of Things devices is gradually increasing, which also puts forward new requirements for the security protection capabilities of Internet of Things devices. In related technologies, Linux IoT devices usually intercept malicious programs by system call table (sys_call_table) or LMD (Linux Module Debugger) kernel module. Devices will use different kernel versions, which requires interception drivers to be adjusted according to different kernel versions, which brings a lot of extra adaptation work for developers. Contents of the invention [0003] The purpose of the present invention is to provide a malicious program detection method, device, elect...

AI Technical Summary

Problems solved by technology

In related technologies, Linux IoT devices usually intercept malicious programs by system call table (sys_call_table) or LMD (Linux Module Debugger) kernel module. Devices will use different kernel versions, which leads to the need to adjust the interception driver according to the different kernel versions, which brings a lot of extra adaptation work for developers

Images