White list self-adapting program management method and system, terminal and storage medium

Abstract

The invention provides a white list self-adapting program management method and system, a terminal and a storage medium. The method comprises the following steps: scanning program information of a target server; uploading the program information to a program centralized management center in the form of a list for permission identification, identifying white list programs and black list programs on the list, and dividing unidentified programs into a grey list; monitoring operation behaviors of the grey list programs in an observation period according to a built-in malicious behavior rule base, and generating credit scores of the grey list programs according to monitoring results; and adjusting operation permissions of the grey list programs according to the credit scores of the grey list programs, and performing list division on programs according to the credit scores of the grey list programs after the observation period ends. According to the invention, the program list of all executable programs on a host is managed, so that attacks of unknown malicious software are effectively prevented, and continuity and safety of services are guaranteed to the maximum extent; and meanwhile, the operation and maintenance efficiency of safety operation and maintenance personnel is improved, and the operation and maintenance cost is reduced.

Description

technical field [0001] The invention relates to the technical field of server security management, in particular to a whitelist self-adaptive program management method, system, terminal and storage medium. Background technique [0002] With the ever-changing attack methods, traditional blacklist defense software can only identify known malware and attacks. For the mixed threats and APT advanced threats constituted by current viruses, worms, Trojan horses and other threats, blacklists can no longer effectively deal with them. , for which whitelist-based security software is increasingly prevalent. [0003] If a white list is set up, users (or IP addresses, IP packets, emails, etc.) in the white list will pass through first, and will not be rejected as spam, and the security and speed are greatly improved. Extending its meaning one step further, any application with a blacklist function will have a whitelist function corresponding to it. By identifying whether processes or f...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the technical problem in the prior art that business continuity cannot be guaranteed, the present invention provides a whitelist adaptive program management method, system, terminal and storage medium to solve the above technical problem

Images