Program white list detection method and device, equipment and storage medium

Abstract

The invention discloses a program white list detection method, device and equipment and a storage medium, and the method comprises the steps: when detecting that a program file is about to be opened in an execution mode and a to-be-run program is in a high-frequency program white list, executing the program file in the high-frequency program white list; judging whether a program white list file corresponding to the to-be-run program in the high-frequency program white list is changed or not; if the to-be-run program is not changed, allowing the to-be-run program to run, otherwise, preventing the to-be-run program from running; and when the to-be-run program is not in the high-frequency program white list, calculating corresponding hash information, judging whether the hash information is in a preset program white list library or not, if so, judging that the program file is a white list file and allowing the to-be-run program to run, and otherwise, stopping the to-be-run program from running. According to the invention, the file read-write frequency of the program white list and the overhead caused by Hash calculation can be reduced, and the performance of the system and the service can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control whitelist detection, and in particular to a program whitelist detection method, device, equipment and storage medium. Background Art

[0002] With the advent of Industry 4.0 and the trend of integration of industrialization and information technology, the traditional industrial control system network security (hereinafter referred to as industrial control security) has become a severe challenge faced by enterprises and national security, and has attracted more and more attention from enterprises and governments. After a long period of closed state, industrial control systems have begun to develop. In the early days, industrial control systems usually did not upgrade patches due to concerns about system compatibility issues. Therefore, for the specific environment of industrial control, the program whitelist technology in the industrial control environment was introduced.

[0003] Generally, virus protection software based on program whitelists is installed on industrial control systems. However, after the terminal protection software in the program whitelist is installed on the operating system, the program whitelist will detect and read the complete file content of the system program and application each time the system program or application is started, and calculate the corresponding hash value. The hash value information is used to determine whether it is a whitelist file based on whether it exists in the program whitelist library. The overhead caused by frequent reading and writing of program whitelist files and hash calculations will affect the performance of the operating system and business. Summary of the invention

[0004] The present invention provides a program whitelist detection method, device, equipment and storage medium to solve the technical problem that the overhead caused by frequent program whitelist file reading and writing and hash calculation will affect the performance of the operating system and business.

[0005] In order to solve the above technical problems, an embodiment of the present invention provides a program whitelist detection method, comprising:

[0006] When it is detected that a program file is about to be opened in execution mode, it is determined whether the to-be-run program corresponding to the program file is in a preset high-frequency program whitelist;

[0007] When the program to be run is in the high-frequency program whitelist, determining whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist has changed; if no change has occurred, allowing the program to be run to run; if a change has occurred, preventing the program to be run from running;

[0008] When the program to be run is not in the high-frequency program whitelist, read the file information of the program file, and calculate the corresponding hash information according to the file information, and judge whether the hash information is in the preset program whitelist library. If so, judge that the program file is a whitelist file, and allow the program to be run to run; if not, judge that the program file is not a whitelist file, and prevent the program to be run from being executed;

[0009] The generation of the high-frequency program whitelist includes:

[0010] Obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating a program whose number of accesses is greater than a preset threshold as a high-frequency access program;

[0011] According to the program whitelist file information of the frequently accessed program, a corresponding high-frequency program whitelist list is generated.

[0012] As a preferred solution, the step of obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating a program with a number of times of access greater than a preset threshold as a high-frequency access program, includes:

[0013] Get the preset program whitelist library and the system's running program list;

[0014] According to the running program list, the number of times each program in the program whitelist library is accessed is obtained, and then the program whose number of accesses is greater than a preset threshold is regarded as a high-frequency access program.

[0015] As a preferred solution, after generating the high-frequency program whitelist, the following is also included:

[0016] The program whitelist files in the high-frequency program whitelist list are monitored, and when it is detected that the program whitelist files are modified, the modified program whitelist library files are marked as modified.

[0017] As a preferred solution, the determining whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed includes:

[0018] Detect whether there is a modification mark in the program whitelist file corresponding to the program to be run in the high-frequency program whitelist;

[0019] When there is no modification mark, it is determined that the program whitelist file has not changed; when there is a modification mark, the file information of the program file is read, and the corresponding hash information is calculated based on the file information to determine whether the hash information is in the preset program whitelist library. If so, it is determined that the program whitelist file has not changed; if not, it is determined that the program whitelist file has changed.

[0020] On the basis of the above-mentioned embodiment, another embodiment of the present invention provides a program whitelist detection device, including: a program file detection module, a high-frequency program whitelist detection module and a program whitelist detection module;

[0021] The program file detection module is used to determine whether the to-be-run program corresponding to the program file is in a preset high-frequency program whitelist when it is detected that a program file is about to be opened in execution mode;

[0022] The high-frequency program whitelist detection module is used to determine whether the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list has changed when the program to be run is in the high-frequency program whitelist list; if no change occurs, the program to be run is allowed to run; if a change occurs, the program to be run is prevented from running; wherein, the generation of the high-frequency program whitelist list includes: obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating the program with a number of accesses greater than a preset threshold as a high-frequency access program; generating a corresponding high-frequency program whitelist list according to the program whitelist file information of the high-frequency access program;

[0023] The program whitelist detection module is used to read the file information of the program file when the program to be run is not in the high-frequency program whitelist list, and calculate the corresponding hash information based on the file information to determine whether the hash information is in a preset program whitelist library. If so, it is determined that the program file is a whitelist file and the program to be run is allowed to run; if not, it is determined that the program file is not a whitelist file and the program to be run is prevented from executing.

[0024] As a preferred solution, a preset program whitelist library and the number of times each program in the program whitelist library is accessed are obtained, and programs with a number of accesses greater than a preset threshold are regarded as high-frequency access programs, including:

[0025] Get the preset program whitelist library and the system's running program list;

[0026] According to the program whitelist library, the running programs identical to the programs in the program whitelist library are searched in the running program list, and the number of accesses to the running programs is counted, and then the running programs whose number of accesses is greater than a preset threshold are regarded as high-frequency access programs.

[0027] As a preferred solution, after generating the high-frequency program whitelist, the following is also included:

[0028] The program whitelist files in the high-frequency program whitelist list are monitored, and when it is detected that the program whitelist files are modified, the modified program whitelist library files are marked as modified.

[0029] As a preferred solution, the determining whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed includes:

[0030] Detect whether there is a modification mark in the program whitelist file corresponding to the program to be run in the high-frequency program whitelist;

[0031] When there is no modification mark, it is determined that the program whitelist file has not changed; when there is a modification mark, the file information of the program file is read, and the corresponding hash information is calculated based on the file information to determine whether the hash information is in the preset program whitelist library. If so, it is determined that the program whitelist file has not changed; if not, it is determined that the program whitelist file has changed.

[0032] Based on the above embodiments, another embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the program whitelist detection method described in the above invention embodiments is implemented.

[0033] Based on the above embodiments, another embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the program whitelist detection method described in the above invention embodiment.

[0034] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0035] The present invention provides a program whitelist detection method. Before performing whitelist detection, a preset program whitelist library and the number of times each program in the program whitelist library has been accessed are first obtained, and programs with a number of accesses greater than a preset threshold are regarded as high-frequency access programs; according to the program whitelist file information of the high-frequency access programs, a corresponding high-frequency program whitelist list is generated.

[0036] When performing program whitelist detection, when it is detected that a program file is about to be opened in execution mode, it is determined whether the program to be run corresponding to the program file is in the preset high-frequency program whitelist list. For the program to be run in the high-frequency program whitelist list, it is determined whether the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list has changed; if no change has occurred, the program to be run is allowed to run, otherwise the program to be run is blocked. For the program to be run that is not in the high-frequency program whitelist list, the file information of the program file is read to calculate the corresponding hash information, and then it is determined whether the hash information is in the preset program whitelist library, so as to determine that the program file is a whitelist file. If so, the program to be run is allowed to run, otherwise the program to be run is blocked. The present invention generates a high-frequency program whitelist list. When performing whitelist detection, if the program to be run is in the high-frequency program whitelist list, it only needs to determine whether the corresponding program whitelist file has changed to determine whether the program to be run is allowed to run, and the high-frequency program whitelist list can cover most of the programs, which can reduce the number of file reads and writes of the program whitelist and the overhead caused by hash calculation, and improve the performance of the system and business. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flowchart of a program whitelist detection method provided by an embodiment of the present invention;

[0038] Figure 2 It is a structural diagram of a program whitelist detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0041] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0042] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0043] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0044] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0045] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0046] Embodiment 1

[0047] Please refer to Figure 1 , is a flow chart of a program whitelist detection method provided by an embodiment of the present invention, comprising the following specific steps:

[0048] S1. When it is detected that a program file is about to be opened in execution mode, it is determined whether the program to be run corresponding to the program file is in a preset high-frequency program whitelist;

[0049] The generation of the high-frequency program whitelist includes:

[0050] Obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating a program whose number of accesses is greater than a preset threshold as a high-frequency access program;

[0051] Generate a corresponding high-frequency program whitelist list according to the program whitelist file information of the high-frequency access program;

[0052] Preferably, the method of obtaining a preset program whitelist library, and the number of times each program in the program whitelist library has been accessed, and treating a program with a number of accesses greater than a preset threshold as a high-frequency access program, includes: obtaining a preset program whitelist library, and a list of running programs of the system; according to the program whitelist library, searching the list of running programs for running programs that are identical to each program in the program whitelist library, and counting the number of times the running programs have been accessed, and then treating the running programs with a number of accesses greater than the preset threshold as high-frequency access programs.

[0053] Preferably, after generating the high-frequency program whitelist list, the method further includes: monitoring the program whitelist files in the high-frequency program whitelist list, and when it is detected that the program whitelist files are modified, marking the modified program whitelist library files as modified.

[0054] Specifically, the present invention provides a program whitelist self-learning and efficient detection method. Based on this method, in order to ensure the safe operation of the industrial control network, it is necessary to deploy terminal security protection software to implement the program whitelist to meet the basic requirements of virus protection in the industrial control site.

[0055] The terminal security protection software based on efficient detection of program whitelists includes several core modules: program whitelist management module, program whitelist control module, and program whitelist self-learning module. The program whitelist management module maintains the program whitelist library and the list of frequently accessed program whitelist libraries; the program whitelist control module implements the detection of the program whitelist during the program startup process and controls it according to the detection results; the program whitelist self-learning module detects in real time whether the executable file has been modified and updates the modification mark of the high-frequency program whitelist list.

[0056] The efficient detection mechanism of program whitelist is completed by three modules. After the driver submodule of the program whitelist management module is started, it automatically starts the program whitelist change detection and loads the program whitelist library and the high-frequency program whitelist list; the application layer of the program whitelist management module re-establishes the program whitelist library and the high-frequency program whitelist list and notifies the driver module; the driver layer of the program whitelist management module reads the program whitelist library and the high-frequency program whitelist list into the memory, and then checks the system source file information of the high-frequency program whitelist list and updates the "modification mark" of the file. The program whitelist self-learning module monitors the changes of the file in real time. If it is a high-frequency program whitelist, the "modification mark" of the file is refreshed and updated. The program whitelist control module monitors the startup of the executable program in real time. If it is a high-frequency program whitelist, the length and modification time of the executable program are preliminarily detected. If the length and modification time of the executable program have not changed, the hash value of the executable program is calculated, and the "modification mark" of the executable program is updated according to the comparison result between the file hash value and the hash value in the program whitelist library.

[0057] Based on the program whitelist efficient detection mechanism, the specific detection steps are as follows:

[0058] Step 1: Generate high-frequency program whitelist information:

[0059] 1. After the antivirus software has been used to detect and kill viruses on the industrial computer, a safe operating system running environment is generated.

[0060] 2. The program whitelist management module scans and generates the latest program whitelist library, as shown in Table 1 below. The program whitelist library records the file path and hash information of the whitelist file and notifies the kernel to use it.

[0061]

[0062] Table 1 Program whitelist library

[0063] 3. The program whitelist management module obtains the high-frequency program list through the operating system running module. Windows can also further obtain the application-level high-frequency program list through pf. The specific operations are as follows:

[0064] (1) The operating system running module obtains the list of modules currently running in the operating system through the operating system enumeration process list system call interface and the driver list enumeration system call interface, and generates a high-frequency system-level program whitelist library list. The high-frequency program list information includes the program whitelist path name and the number of accesses.

[0065] (2) If the operating system is Windows, you can also obtain a list of historically frequently running programs through a pf file. This is done by reading the pf file generated by the superfetch function of the operating system, obtaining the pf file in the "C:\Windows\Prefetch" directory, and obtaining the access frequency of the program from the pf file content, as shown in Table 2 below. This is the access frequency of the program. Program files with access times greater than a certain threshold (generally greater than 3) are automatically placed in the high-frequency program list.

[0066]

[0067] Table 2 Frequency of program access

[0068] 4. The program whitelist management module traverses the file list information to read the basic information of the relevant files, as shown in Table 3 below, including the file size, modification time, and disk information where the file is stored, and generates a high-frequency program list.

[0069]

[0070] Table 3 Program whitelist file information

[0071] Step 2: Load the program whitelist library and high-frequency program whitelist:

[0072] After the program whitelist management completes the program whitelist library and the high-frequency program list, it notifies the driver to load the program whitelist library and the high-frequency program list and starts the program whitelist change detection module. In order to prevent program changes after scanning, it is necessary to re-determine whether the high-frequency list has been modified. After the high-frequency list is loaded, the file in the high-frequency program list is hashed. If the hash of the file is different from the hash in the program whitelist library, it is refreshed to "Modification Mark" 2, as shown in Table 4 below, indicating that the program has been modified.

[0073]

[0074] Table 4 Modification mark information of program whitelist file

[0075] Step 3: Self-learning of high-frequency program list:

[0076] The program whitelist change detection module monitors file changes through the operating system file driver interface. When a change in a high-frequency program whitelist file is detected, the "modification mark" of the high-frequency program whitelist library list is modified to 1, indicating that the file may be modified. After the program whitelist detection, the hash calculation is performed and the "modification mark" is updated again, as shown in Table 5 below.

[0077]

[0078]

[0079] Table 5 Modification mark update information of program whitelist file

[0080] Step 4: Detection of self-learning program whitelist:

[0081] 1. Monitor the startup of system programs or applications through the operating system file driver interface.

[0082] 2. The program whitelist detection module detects that the program file is opened in execution mode and searches whether the program file is in the high-frequency program list.

[0083] S2. When the program to be run is in the high-frequency program whitelist, determine whether the program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed; if no change occurs, allow the program to be run to run; if a change occurs, prevent the program to be run from running;

[0084] Preferably, the determination of whether the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list has changed includes: detecting whether there is a modification mark in the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list; when there is no modification mark, determining that the program whitelist file has not changed; when there is a modification mark, reading the file information of the program file, and calculating the corresponding hash information based on the file information, and determining whether the hash information is in a preset program whitelist library; if so, determining that the program whitelist file has not changed; if not, determining that the program whitelist file has changed.

[0085] 3. If the startup program is in the high-frequency program list, the access count is updated and the modification mark of the program is read. First, the actual length of the file is checked to see if it is consistent with the file length of the high-frequency program file list. Then, the program whitelist is checked based on the modification mark. The specific operations are as follows:

[0086] (1) If the program has not been modified, there is no need to recalculate the hash value of the program and directly determine that the program is on the whitelist, allowing the program to run normally. This can save computing resources for high-frequency programs in more than 99% of scenarios;

[0087] (2) If the program has been marked as modified, the program file is reread and the hash information is calculated, and then compared with the program whitelist library. If there is actually no change, the "modification mark" is cleared (i.e., set to 0). If inconsistency is detected, it means that the file has been changed and the "modification mark" is set to 2, as shown in Table 6 below. This means that the file has been modified, so the program is not allowed to execute and an alarm is generated. It is necessary to manually perform virus detection based on the alarm to determine whether to add the program to the whitelist.

[0088]

[0089] Table 6 Program whitelist file change judgment

[0090] S3. When the program to be run is not in the high-frequency program whitelist, read the file information of the program file, and calculate the corresponding hash information based on the file information to determine whether the hash information is in the preset program whitelist library. If so, determine that the program file is a whitelist file and allow the program to be run to run. If not, determine that the program file is not a whitelist file and prevent the program to be run from executing.

[0091] 4. If it is not in the high-frequency program list, it is necessary to read the content of the file and calculate its hash information and determine whether it is a whitelist file by whether the hash information exists in the program whitelist library. If so, the program file is determined to be a whitelist file and the program to be run is allowed to run. If not, the program file is determined not to be a whitelist file and the program to be run is prevented from executing.

[0092] Embodiment 2

[0093] Please refer to Figure 2 , is a schematic diagram of the structure of a program whitelist detection device provided by an embodiment of the present invention, the device comprising: a program file detection module, a high-frequency program whitelist detection module and a program whitelist detection module;

[0094] The program file detection module is used to determine whether the to-be-run program corresponding to the program file is in a preset high-frequency program whitelist when it is detected that a program file is about to be opened in execution mode;

[0095] The high-frequency program whitelist detection module is used to determine whether the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list has changed when the program to be run is in the high-frequency program whitelist list; if no change occurs, the program to be run is allowed to run; if a change occurs, the program to be run is prevented from running; wherein, the generation of the high-frequency program whitelist list includes: obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating the program with a number of accesses greater than a preset threshold as a high-frequency access program; generating a corresponding high-frequency program whitelist list according to the program whitelist file information of the high-frequency access program;

[0096] The program whitelist detection module is used to read the file information of the program file when the program to be run is not in the high-frequency program whitelist list, and calculate the corresponding hash information based on the file information to determine whether the hash information is in a preset program whitelist library. If so, it is determined that the program file is a whitelist file and the program to be run is allowed to run; if not, it is determined that the program file is not a whitelist file and the program to be run is prevented from executing.

[0097] Preferably, a preset program whitelist library and the number of times each program in the program whitelist library has been accessed are obtained, and programs whose access times are greater than a preset threshold are regarded as high-frequency access programs, including: obtaining a preset program whitelist library and a list of running programs of the system; according to the list of running programs, obtaining the number of times each program in the program whitelist library has been accessed, and then treating programs whose access times are greater than the preset threshold as high-frequency access programs.

[0098] Preferably, after generating the high-frequency program whitelist list, the method further includes: monitoring the program whitelist files in the high-frequency program whitelist list, and when it is detected that the program whitelist files are modified, marking the modified program whitelist library files as modified.

[0099] Preferably, the determination of whether the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list has changed includes: detecting whether there is a modification mark in the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list; when there is no modification mark, determining that the program whitelist file has not changed; when there is a modification mark, reading the file information of the program file, and calculating the corresponding hash information based on the file information, and determining whether the hash information is in a preset program whitelist library; if so, determining that the program whitelist file has not changed; if not, determining that the program whitelist file has changed.

[0100] Based on the above embodiments, another embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the program whitelist detection method described in the above invention embodiments is implemented.

[0101] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0102] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0103] Embodiment 3

[0104] Accordingly, an embodiment of the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the program whitelist detection method described in the above-mentioned embodiment of the invention when executing the computer program.

[0105] The electronic device may be a computing device such as a desktop computer, a notebook, a palmtop computer, a cloud server, etc. The device may include, but is not limited to, a processor and a memory.

[0106] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the device, and various interfaces and lines are used to connect various parts of the entire device.

[0107] Embodiment 4

[0108] Accordingly, an embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the program whitelist detection method described in the above-mentioned embodiment of the invention.

[0109] The memory can be used to store the computer program, and the processor realizes various functions of the device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0110] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each method embodiment described above can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0111] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A program whitelist detection method, characterized in that: include: When it is detected that a program file is about to be opened in execution mode, it is determined whether the to-be-run program corresponding to the program file is in a preset high-frequency program whitelist; When the program to be run is in the high-frequency program whitelist, determining whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed; If no change occurs, the program to be run is allowed to run; If a change occurs, the program to be run is prevented from running; When the program to be run is not in the high-frequency program whitelist, read the file information of the program file, and calculate the corresponding hash information according to the file information, and judge whether the hash information is in the preset program whitelist library. If so, judge that the program file is a whitelist file, and allow the program to be run to run; if not, judge that the program file is not a whitelist file, and prevent the program to be run from being executed; The generation of the high-frequency program whitelist includes: Obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating a program whose number of accesses is greater than a preset threshold as a high-frequency access program; According to the program whitelist file information of the frequently accessed program, a corresponding high-frequency program whitelist list is generated.

2. The program whitelist detection method according to claim 1, characterized in that: The step of obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating a program with a number of times of access greater than a preset threshold as a high-frequency access program, includes: Get the preset program whitelist library and the system's running program list; According to the program whitelist library, the running programs identical to the programs in the program whitelist library are searched in the running program list, and the number of accesses to the running programs is counted, and then the running programs whose number of accesses is greater than a preset threshold are regarded as high-frequency access programs.

3. The program whitelist detection method according to claim 2, characterized in that: After generating a whitelist of high-frequency programs, it also includes: The program whitelist files in the high-frequency program whitelist list are monitored, and when it is detected that the program whitelist files are modified, the modified program whitelist library files are marked as modified.

4. The program whitelist detection method according to claim 3, characterized in that: The determining whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed includes: Detect whether there is a modification mark in the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list; When there is no modification mark, it is determined that the program whitelist file has not changed; when there is a modification mark, the file information of the program file is read, and the corresponding hash information is calculated based on the file information to determine whether the hash information is in the preset program whitelist library. If so, it is determined that the program whitelist file has not changed; if not, it is determined that the program whitelist file has changed.

5. A program whitelist detection device, characterized in that: include: Program file detection module, high-frequency program whitelist detection module and program whitelist detection module; The program file detection module is used to determine whether the to-be-run program corresponding to the program file is in a preset high-frequency program whitelist when it is detected that a program file is about to be opened in execution mode; The high-frequency program whitelist detection module is used to determine whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed when the program to be run is in the high-frequency program whitelist; If no change occurs, the program to be run is allowed to run; If a change occurs, the program to be run is prevented from running; wherein the generation of the high-frequency program whitelist includes: obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating the program with a number of accesses greater than a preset threshold as a high-frequency access program; generating a corresponding high-frequency program whitelist according to the program whitelist file information of the high-frequency access program; The program whitelist detection module is used to read the file information of the program file when the program to be run is not in the high-frequency program whitelist list, and calculate the corresponding hash information based on the file information to determine whether the hash information is in a preset program whitelist library. If so, it is determined that the program file is a whitelist file and the program to be run is allowed to run; if not, it is determined that the program file is not a whitelist file and the program to be run is prevented from executing.

6. The program whitelist detection device according to claim 5, characterized in that: The step of obtaining a preset program whitelist library and the number of times each program in the program whitelist library has been accessed, and treating a program with a number of times of access greater than a preset threshold as a high-frequency access program, includes: Get the preset program whitelist library and the system's running program list; According to the running program list, the number of times each program in the program whitelist library is accessed is obtained, and then the program whose number of accesses is greater than a preset threshold is regarded as a high-frequency access program.

7. The program whitelist detection device according to claim 6, characterized in that: After generating a whitelist of high-frequency programs, it also includes: The program whitelist files in the high-frequency program whitelist list are monitored, and when it is detected that the program whitelist files are modified, the modified program whitelist library files are marked as modified.

8. The program whitelist detection device according to claim 7, characterized in that: The determining whether a program whitelist file corresponding to the program to be run in the high-frequency program whitelist is changed includes: Detect whether there is a modification mark in the program whitelist file corresponding to the program to be run in the high-frequency program whitelist list; When there is no modification mark, it is determined that the program whitelist file has not changed; when there is a modification mark, the file information of the program file is read, and the corresponding hash information is calculated based on the file information to determine whether the hash information is in the preset program whitelist library. If so, it is determined that the program whitelist file has not changed; if not, it is determined that the program whitelist file has changed.

9. An electronic device, characterized in that: The invention comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the program whitelist detection method according to any one of claims 1 to 4 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the program whitelist detection method according to any one of claims 1 to 4.

Images