Host protection method and system based on whitelist and file signature code in industrial environment

Abstract

The present invention provides a host protection method and system, which comprises a preliminary determination step, in which an executable program to be executed is subjected to preliminary determination to determine whether the executable program is located in a pre-created program whitelist baseline; an extraction step, in which, when the executable program is not in the program whitelist baseline, the file feature code, the hash value of the file and the original path information of the file are extracted; a comparison step, in which the file feature code is compared with the information of a pre-stored virus library; a program classification processing step, in which the executable program is classified based on the comparison result; and a user confirmation processing step, in which a user is prompted to perform confirmation processing based on the classification result, and a corresponding operation is performed based on the user's confirmation information.

Description

Technical Field

[0001] The present invention relates to the field of network security protection, and in particular to a host protection method and system. Background Art

[0002] In most current industrial field environments, there are many hosts, the operating system version is low, and it is impossible to connect to the Internet to update various security patches in a timely manner. In addition, due to hardware or software reasons, some host devices in industrial field environments cannot install general virus detection tools to perform full disk scanning and other operations, which provides many malicious virus files with opportunities to take advantage. When some malicious virus files are disguised as system files, it is difficult for operators to distinguish the legitimacy of executable files. If the operator mistakenly executes such programs, the malicious virus files may exploit certain system vulnerabilities to attack various facilities in the industrial field and cause a series of serious consequences. To this end, the following problems need to be solved: identifying malicious virus files in industrial field environments; and preventing the execution of malicious virus files on host devices.

[0003] Based on this, several technologies that can solve the above problems have been disclosed. For example, a virus detection method implants a harmless virus scanning program into a smart terminal through a security vulnerability; and uses the virus scanning program to detect whether the smart terminal has virus intrusion behavior and uploads the results to the server.

[0004] However, this virus detection method is no longer applicable when the vulnerability is repaired because it needs to rely on the security vulnerability implantation scanning program. Moreover, this virus scanning level can only detect intrusion behavior, and does not provide a method for blocking virus execution.

[0005] In addition, a virus scanning method is disclosed, which, when used on a server, includes: obtaining virus data information and updating a central virus library based on the virus data information; screening out viruses to be updated from the updated central virus library; and updating an antivirus engine virus library located on a client according to the viruses to be updated.

[0006] However, in this virus scanning method, since the antivirus engine virus library is located on the client, it needs to occupy a certain amount of resources on the client host. Moreover, the virus library is usually large in size, and the transmission of the virus library file during update requires bandwidth, which makes it unsuitable for large-scale batch update of client virus libraries in industrial field environments. Summary of the invention

[0007] In view of this, the present invention is proposed. The present invention provides a host protection method and system based on a whitelist and file feature codes of executable programs in an industrial environment. Using the host protection method and system of the present invention, when the host runs a non-whitelist program in an industrial field environment, the client extracts the file feature code of the executable program and sends it to the private cloud server end (hereinafter referred to as the server end) in the local area network for verification. The client prompts the user to confirm the processing based on the verification result returned by the server end, so that the user can choose to block or release the program execution. Thereby, virus defense and host protection are achieved by minimizing the occupation of host and bandwidth resources in the industrial field environment. At the same time, the server end of the present invention supports regular updating and maintenance of the virus library through mobile storage media to achieve the effect of preventing virus execution or spread in an industrial environment. In addition, through the deployment mode of the server client, applications can be deployed in batches at industrial sites to prevent virus spread.

[0008] In addition, in the present invention, since the user finally confirms whether to block or release the execution of the executable program, the mistaken killing or missed killing caused by the virus database can be compensated as much as possible.

[0009] In addition, in the virus defense performed by the host protection method according to the present invention, since there is no need to transmit virus files, the response speed is fast, so that in the industrial field environment, it is possible to quickly determine whether the program is executed in a timely manner, thereby improving applicability and flexibility.

[0010] In addition, in the host protection method according to the present invention, when the comparison result on the server side indicates that the executable program is a virus file to be confirmed, the client immediately transfers the source file of the executable program to the isolation sandbox, thereby preventing the execution of possible virus files at the fastest speed and preventing the spread of possible viruses, thereby improving the safety performance of use in industrial field environments.

[0011] In addition, the host protection method according to the present invention can be applied to the situation where multiple hosts (with clients installed) are deployed in batches in an industrial field environment, thereby preventing viruses from spreading among the multiple hosts.

[0012] According to a first aspect of the present invention, a host protection method is provided, characterized in that the host protection method comprises: a preliminary determination step of performing preliminary determination on an executable program to be executed to determine whether the executable program is located in a pre-created program whitelist baseline; an extraction step of extracting a file feature code, a hash value of the file and original path information of the file of the executable program when the executable program is not in the program whitelist baseline; a comparison step of comparing the file feature code with information of a pre-stored virus library; a program classification processing step of classifying the executable program based on the comparison result; and a user confirmation processing step of prompting the user to perform confirmation processing based on the classification result, and performing corresponding operations based on the user's confirmation information.

[0013] Furthermore, in the program classification processing step, when the comparison result shows that the executable program is a non-virus file, the executable program is classified as a candidate whitelist program, and the executable program is added to the whitelist baseline to-be-confirmed list; and when the comparison result shows that the executable program is a virus file, the executable program is classified as a virus program to be confirmed, and the running of the executable program is blocked, and the source file of the executable program is actively moved to an isolated sandbox.

[0014] Furthermore, in the user confirmation processing step, when the executable program is classified as the candidate whitelist program, the user is prompted to confirm whether to execute the executable program.

[0015] Furthermore, in the user confirmation processing step, when the executable program is classified as the virus program to be confirmed, the user is prompted to select whether to trust the executable program.

[0016] Further, when the user chooses not to trust the executable program, the source file of the executable program is directly and permanently deleted from the isolated sandbox;

[0017] When the user chooses to trust the executable program, the executable program is restored to the original path, and the user is prompted to choose whether to permanently trust or temporarily trust the executable program.

[0018] Furthermore, when the comparison result indicates that the executable program is a virus file, an alarm record is generated, and after obtaining the user's confirmation information, the alarm record is set to a processed state.

[0019] Furthermore, the host protection method also includes upgrading the virus database, wherein upgrading the virus database includes: the user selects and uploads a new virus database file through an operation interface; preliminarily verifies the legitimacy of the file name and format of the new virus database file; stops the virus scanning engine and backs up the old virus database from the executable directory to another directory; and uses the virus scanning engine to load the new virus database file uploaded by the user.

[0020] Furthermore, the new virus library file is stored in the host or in a mobile storage medium connected to the host.

[0021] According to a second aspect of the present invention, there is provided a host protection method for use on a server side, characterized in that the host protection method comprises: receiving a file feature code, a hash value and original path information of an executable program extracted and sent by a client side, wherein the executable program is not in the program whitelist baseline of the client side; comparing the file feature code with the information of the virus library stored in the server side, and sending the comparison result to the client side; and receiving confirmation information from the user of the client side.

[0022] Furthermore, when the comparison result indicates that the executable program is a virus file, the server generates an alarm record, and after receiving the confirmation information from the user, the server sets the alarm record to a processed state.

[0023] Furthermore, the host protection method also includes upgrading the virus database, wherein upgrading the virus database includes: creating an operation interface for upgrading the virus database so that the user can select and upload a new virus database file through the client; preliminarily verifying the legitimacy of the file name and format of the new virus database file; stopping the virus scanning engine and backing up the old virus database from the executable directory to another directory; and using the virus scanning engine to load the new virus database file uploaded by the client.

[0024] Furthermore, the new virus library file is stored in a host loaded with the client or in a mobile storage medium connected to the host.

[0025] According to a third aspect of the present invention, there is provided a host protection method for a client, characterized in that the host protection method comprises: performing a preliminary judgment on an executable program to be executed to determine whether the executable program is located in a pre-created program whitelist baseline; when the executable program is not in the program whitelist baseline, extracting the file feature code of the executable program, the hash value of the file and the original path information of the file and sending them to a server; receiving a comparison result of the file feature code and the virus library information stored in the server executed and sent by the server, and classifying the executable program based on the comparison result; prompting a user to perform confirmation processing based on the classification result and performing corresponding operations based on the user's confirmation information, and sending the user's confirmation information to the server.

[0026] Furthermore, when the comparison result shows that the executable program is a non-virus file, the client classifies the executable program as a candidate whitelist program and adds the executable program to the whitelist baseline to-be-confirmed list; and when the comparison result shows that the executable program is a virus file, the client classifies the executable program as a virus program to be confirmed, blocks the execution of the executable program, and actively moves the source file of the executable program to an isolated sandbox.

[0027] Further, when the executable program is classified as the candidate whitelist program, the client prompts the user to confirm whether to execute the executable program.

[0028] Furthermore, when the executable program is classified as the virus program to be confirmed, the client prompts the user to select whether to trust the executable program.

[0029] Furthermore, when the user chooses not to trust the executable program, the client directly deletes the source file of the executable program permanently from the isolated sandbox; when the user chooses to trust the executable program, the client restores the executable program to the original path and prompts the user to choose whether to permanently trust or temporarily trust the executable program.

[0030] According to a fourth aspect of the present invention, a host protection system is provided, characterized in that the host protection system comprises: a preliminary determination module, which is used to perform preliminary determination on an executable program to be executed at a client to determine whether the executable program is located in a pre-created program whitelist baseline; an extraction module, which is used to extract the file feature code, the hash value of the file and the original path information of the file of the executable program at the client and send them to a server when the executable program is not in the program whitelist baseline; a comparison module, which is used to compare the file feature code with the information of the virus library stored in the server at the server, and send the comparison result to the client; a program classification processing module, which is used to classify the executable program at the client based on the comparison result; a user confirmation processing module, which is used to prompt the user to perform confirmation processing at the client based on the classification result, and a confirmation information upload module, which is used to send the user's confirmation information at the client to the server.

[0031] According to a fifth aspect of the present invention, a server is provided, characterized in that it includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the host protection method for the server side described above.

[0032] According to a sixth aspect of the present invention, a host is provided, characterized in that it includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the host protection method for the client described above.

[0033] According to a seventh aspect of the present invention, there is provided a host protection system, characterized in that it comprises: the server and at least one of the hosts.

[0034] The technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings and preferred embodiments of the present invention, and the beneficial effects of the present invention will be further clarified. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide further understanding of the present invention and constitute a part of the present invention, but their description is only used to explain the present invention and does not constitute an improper limitation to the present invention.

[0036] Figure 1is a schematic diagram showing a virus defense process of a host protection method according to a preferred embodiment of the present invention;

[0037] Figure 2 is a flowchart showing the steps of a virus defense process of a host protection method according to a preferred embodiment of the present invention;

[0038] Figure 3 is a flow chart of a virus defense process on a server side according to a host protection method according to a preferred embodiment of the present invention;

[0039] Figure 4 is a flow chart of a virus defense process at a client side of a host protection method according to a preferred embodiment of the present invention;

[0040] Figure 5 is a schematic diagram showing a virus database upgrade process of a host protection method according to a preferred embodiment of the present invention;

[0041] Figure 6 is a flowchart showing the steps of a virus library upgrade process of a host protection method according to a preferred embodiment of the present invention;

[0042] Figure 7 It is a flow chart of a virus database upgrade process on a server side according to a host protection method according to a preferred embodiment of the present invention;

[0043] Figure 8 It is a flowchart of a virus database upgrade process on a client side according to a host protection method according to a preferred embodiment of the present invention;

[0044] Fig. 9 is a schematic diagram of the configuration of a host protection system according to a preferred embodiment of the present invention;

[0045] Fig.10 is a schematic configuration diagram of a server in a host protection system according to a preferred embodiment of the present invention; and

[0046] Fig.11 is a schematic configuration diagram of a host in a host protection system according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0047] The technical solution of the present invention will be described clearly and completely below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the preferred embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The host protection method according to the present invention includes: a preliminary judgment step, performing a preliminary judgment on an executable program to be executed to determine whether the executable program is located in a pre-created program whitelist baseline; an extraction step, when the executable program is not in the program whitelist baseline, extracting the file feature code, the hash value of the file and the original path information of the file of the executable program; a comparison step, comparing the file feature code with the information of a pre-stored virus library; a program classification processing step, classifying the executable program based on the comparison result; and a user confirmation processing step, prompting the user to perform confirmation processing based on the classification result, and performing corresponding operations based on the user's confirmation information.

[0049] The host protection method for the server side according to the present invention includes: receiving the file feature code, hash value and original path information of the executable program extracted and sent by the client, wherein the executable program is not in the program whitelist baseline of the client; comparing the file feature code with the information of the virus library stored in the server side, and sending the comparison result to the client; and receiving confirmation information from the user of the client.

[0050] According to the present invention, the host protection method for the client includes: performing a preliminary judgment on the executable program to be executed to determine whether the executable program is located in a pre-created program whitelist baseline; when the executable program is not in the program whitelist baseline, extracting the file feature code of the executable program, the hash value of the file and the original path information of the file and sending them to the server; receiving the comparison result of the file feature code and the virus library information stored in the server executed and sent by the server, and classifying the executable program based on the comparison result; and prompting the user to perform confirmation processing based on the classification result, and sending the user's confirmation information to the server.

[0051] Specific embodiments of the host protection method according to the present invention will be described in detail below with reference to the accompanying drawings.

[0052] Figure 1 is a schematic diagram showing a virus defense process of a host protection method according to a preferred embodiment of the present invention, Figure 2 It is a flowchart showing the steps of the virus defense process of the host protection method according to a preferred embodiment of the present invention.

[0053] Please refer to the following Figure 1 and 2 The various steps of the operation of the virus defense process performed by the host protection method according to the present invention are described.

[0054] S101 is a step of establishing a connection: installing a client (for example, it may be named IEG) on a host, and registering it with a server (for example, it may be named USM), so that the client establishes a connection with the server.

[0055] S102 is a step of establishing a program whitelist baseline: the server sends the program whitelist baseline to the client; or performs a program whitelist scan on the client to add trusted programs and files to the whitelist, thereby establishing a program whitelist baseline.

[0056] S103: Preliminary determination step: When an executable program is to be run on the host, the client first performs a preliminary determination to determine whether the executable program is in the pre-created program whitelist baseline. If the executable program is in the program whitelist baseline, the program is allowed to run directly, otherwise the program is blocked from running.

[0057] S104 Extraction step: When the executable program is not in the program whitelist baseline and is blocked from running, the file signature of the executable program, the hash value of the file, and the original path information of the file are extracted on the client side and sent to the server side through an encrypted trusted transmission channel.

[0058] S105 comparison step: after receiving the above-mentioned file feature code, the hash value of the file and the original path information of the file from the client, the server compares the received file feature code with the information of the virus library stored in itself, and returns the comparison result to the client through the encrypted trusted transmission channel. During the comparison process, if the server finds that the comparison result shows that the executable program is a virus file, an alarm record of the host virus threat is generated on the server and saved to the database.

[0059] S106 Program classification processing step: After receiving the comparison result from the server, the client classifies the executable program. Specifically, if the comparison result shows that the executable program is a non-virus file, the client classifies the executable program as a candidate whitelist program and adds it to the whitelist baseline to be confirmed list to wait for user confirmation. On the other hand, if the comparison result shows that the executable program is a virus file, the client classifies the executable program as a virus program to be confirmed, blocks the program from running, and actively moves the source file of the executable program to the isolation sandbox.

[0060] S107 User confirmation processing step: The client prompts the user to confirm the processing based on the classification result, and performs corresponding operations based on the user's confirmation information. The details are as follows:

[0061] i) When an executable program is classified as a candidate whitelist program and added to the whitelist baseline to be confirmed list, the user confirms according to the prompt of the client to determine whether to execute the executable program. Specifically, when the user chooses to execute the executable program, the client adds the executable program to the program whitelist baseline. On the other hand, when the user chooses not to execute the executable program, the client blocks the program from running.

[0062] ii) When the executable program is classified as a virus program to be confirmed, the user confirms according to the prompt of the client (prompting the presence of a virus) to choose whether to trust the source file of the executable program. Specifically, when the user confirms that the executable program file is a virus file (or an illegal program, etc.) (that is, the executable program file is not trusted), the client directly removes the source file of the executable program from the isolation sandbox permanently. When the user confirms that the executable program file is a non-virus file (that is, trust the executable program file), the client restores the source file of the executable program from the isolation sandbox to the original path, and prompts the user to choose whether to trust the executable program file permanently or temporarily. Specifically, if the user chooses to trust the executable program file permanently, the executable program file is added to the program whitelist baseline. On the other hand, if the user chooses to trust the executable program file temporarily, the client only releases the program execution this time.

[0063] S108 confirmation information uploading step: the client uploads the user's confirmation information in step S107 to the server, and the server sets the alarm record of the host virus threat in step S105 to a processed state.

[0064] When using the host protection method as described above to defend against viruses, it is possible to determine whether to execute the executable program through comparison of the server, classification of the client, and user confirmation processing without transmitting the virus file. Therefore, there is no need to set up an antivirus engine on the client and the host of the client is not occupied. Moreover, since there is no need to transmit files and no bandwidth is occupied, it can be applied to a large range of industrial field environments. That is, virus defense and host protection are achieved by minimizing the occupation of host and bandwidth resources in the industrial field environment.

[0065] In addition, in the present invention, since the user finally confirms whether to block or release the execution of the executable program, the mistaken killing or missed killing caused by the virus database can be compensated as much as possible.

[0066] In addition, when the host protection method according to the present invention is used for virus defense, since there is no need to transmit virus files, the response speed is fast, so that in an industrial field environment, it is possible to quickly determine whether a program is executed in a timely manner, thereby improving applicability and flexibility.

[0067] In addition, in the host protection method according to the present invention, when the comparison result on the server side indicates that the executable program is a virus file to be confirmed, the client immediately transfers the source file of the executable program to the isolation sandbox, thereby preventing the execution of possible virus files at the fastest speed and preventing the spread of possible viruses, thereby improving the safety performance of use in industrial field environments.

[0068] In addition, the host protection method according to the present invention can be applied to the situation where multiple hosts (with clients installed) are deployed in batches in an industrial field environment, thereby preventing viruses from spreading among the multiple hosts.

[0069] The advantageous effects of the host protection method of the present invention are not limited to the advantageous effects described above. As long as the technical solution of the present invention is adopted, the effects produced are also necessarily included in the scope of the present invention.

[0070] Based on the host protection method of the present invention described above, refer to Figure 3 As shown, the host protection method according to the present invention includes the following specific steps when used for virus defense on the server side (the contents repeated with those described above will not be described again):

[0071] Step S201: Establish a connection with a client installed on a host.

[0072] Step S202: receiving the file signature, hash value and original path information of the executable program extracted and sent by the client, wherein the executable program is not in the program whitelist baseline of the client.

[0073] Step S203: Compare the file signature with the information of the virus database stored in the server.

[0074] Step S204: Send the comparison result to the client, and when the comparison result shows that the executable program is a virus file, generate a host virus threat alarm record on the server side and save it to the database.

[0075] Step S205: receiving confirmation information from the user of the client, and setting the alarm record to a processed state.

[0076] Correspondingly, refer to Figure 4 As shown, the host protection method according to the present invention includes the following specific steps when used for virus defense performed by the client (the contents repeated with those described above will not be described again):

[0077] Step S301: Establish a connection with a server.

[0078] Step S302: Establishing a program whitelist baseline. Specifically, the client receives the program whitelist baseline from the server, or the client performs a program whitelist scan to add trusted programs and files to the whitelist, thereby establishing a program whitelist baseline.

[0079] Step S303: Perform a preliminary determination on the executable program. Specifically, the client first performs a preliminary determination to determine whether the executable program to be run on the host is in the created program whitelist baseline. If the executable program is in the program whitelist baseline, the program is allowed to run directly, otherwise the program is blocked from running.

[0080] Step S304: extracting file signatures and sending them to the server. Specifically, when the executable program is not in the program whitelist baseline and is blocked from running, the client extracts the file signature of the executable program, the hash value of the file, and the original path information of the file, and sends them to the server through an encrypted trusted transmission channel.

[0081] Step S305: Receive the comparison result of the file feature code with the virus library information stored on the server from the server and classify the program. Specifically, the client receives the comparison result of the file feature code with the virus library information stored on the server, which is executed and sent by the server and returned through the encrypted trusted transmission channel, and classifies the executable program based on the comparison result. If the comparison result shows that the executable program is a non-virus file, the client classifies the executable program as a candidate whitelist program, and adds it to the whitelist baseline to be confirmed list to wait for user confirmation. On the other hand, if the comparison result shows that the executable program is a virus file, the client classifies the executable program as a virus program to be confirmed, and prevents the program from running, and actively moves the source file of the executable program to the isolation sandbox.

[0082] Step S306: prompting the user to perform confirmation processing based on the classification result and performing corresponding operations based on the user's confirmation information.

[0083] Specifically, i) when an executable program is classified as a candidate whitelist program and added to the whitelist baseline to be confirmed list, the user is prompted whether to execute the executable program. When the user chooses to execute the executable program, the client adds the executable program to the program whitelist baseline. On the other hand, when the user chooses not to execute the executable program, the client blocks the program from running.

[0084] ii) When the executable program is classified as a virus program to be confirmed, the user is prompted whether to trust the source file of the executable program. Based on the confirmation information when the user confirms that the executable program file is a virus file (or illegal program, etc.) (i.e., the executable program file is not trusted), the client directly removes the source file of the executable program from the isolation sandbox permanently. Based on the confirmation information that the user confirms that the executable program file is a non-virus file (i.e., trusts the executable program file), the client restores the source file of the executable program from the isolation sandbox to the original path, and continues to prompt the user to choose whether to trust the executable program file permanently or temporarily. Specifically, based on the confirmation information that the user chooses to trust the executable program file permanently, the client adds the executable program file to the program whitelist baseline. On the other hand, based on the confirmation information that the user chooses to trust the executable program file temporarily, the client only releases the program execution this time.

[0085] Step S307: Upload the user's confirmation information to the server. Specifically, the client uploads the user's confirmation information in step S306 to the server.

[0086] The above describes the operation of the host protection method according to the embodiment of the present invention when it is used for virus defense on the server side and the client side respectively.

[0087] Furthermore, the host protection method according to the present invention also includes upgrading the virus database.

[0088] The following will refer to Figure 5-7 The specific steps of the virus library upgrade process of the host protection method according to the present invention are described.

[0089] Step S401: Upload step

[0090] The user enters the virus library upgrade menu through the operation interface (e.g., web page) provided by the server, selects a new virus library file in the file system and uploads it to the server. The file system can be located on the host or in a removable storage medium connected to the host.

[0091] Step S402: Preliminary verification step

[0092] The server initially verifies the file name and format of the new virus database file for legality. If the verification is passed, the upgrade process begins. Otherwise, the user is prompted to reselect the file.

[0093] Step S403: Stop the virus scanning engine and back up the process

[0094] The server stops the virus scanning engine and backs up the old virus database from the executable directory to another directory. If there is information such as the file signature code uploaded by the client at this time, the server stores this information in a temporary table in the database.

[0095] Step S404: Loading a new virus database file

[0096] The server moves the new virus database file uploaded by the user to the executable directory of the virus scanning engine, and starts the virus scanning engine to load the new virus database file.

[0097] If the loading fails, the old virus library backed up in step S403 is returned to the executable directory, and the old virus library is reloaded, and the user is prompted to automatically return if the loading fails. If the loading succeeds, the user is prompted to load successfully and the old virus library backed up in step S403 is deleted.

[0098] Step S405: Restart the virus protection step

[0099] Using the information stored in the database temporary table in step S403, virus defense is restarted, that is, steps S203 to S205 described above are executed.

[0100] refer to Figure 7 As shown, the process of upgrading the virus database of the host protection method according to the present invention includes the following specific steps when used on the server side (the contents repeated with those described above will not be described again):

[0101] Step S501: Provide an operation interface (e.g., web page) for virus database upgrade, so that the user can enter the virus database upgrade menu through the client, and select a new virus database file in the file system and upload it. The file system can be located on a host computer with the client computer installed, or in a removable storage medium connected to the host computer.

[0102] Step S502: The server initially verifies the file name and format of the new virus database file for legality. If the verification is passed, the upgrade process begins. Otherwise, the user is prompted to reselect the file.

[0103] Step S503: The server stops the virus scanning engine and backs up the old virus database from the executable directory to another directory. If there is information such as the file signature code uploaded by the client at this time, the server stores this information in a temporary table of the database.

[0104] Step S504: the server moves the new virus database file uploaded by the user to the executable directory of the virus scanning engine, and starts the virus scanning engine to load the new virus database file.

[0105] If the loading fails, the old virus library backed up in step S503 is returned to the executable directory, and the old virus library is reloaded, and the user is prompted to automatically return if the loading fails. If the loading succeeds, the user is prompted to load successfully and the old virus library backed up in step S503 is deleted.

[0106] Step S505: Restart virus defense using the information stored in the database temporary table in step S503, that is, execute steps S105 to S108 described above.

[0107] refer to Figure 8 As shown, the virus library upgrade process of the host protection method according to the present invention includes the following specific steps when used on the client (the contents repeated with those described above will not be described again):

[0108] Step S601: Displaying an operation interface (e.g., a web page) provided by the server on the client, so that the user can use the operation interface to enter the virus database upgrade menu to select a new virus database file in the file system and upload it. The file system can be located on the host or in a removable storage medium connected to the host.

[0109] Step S602: When the server verification fails, the client prompts the user to reselect a file through the operation interface.

[0110] The above reference Figure 1-8 The host protection method according to the present invention is described below with reference to Fig. 9 A host protection system 900 according to the present invention based on the above host protection method is described.

[0111] The host protection system 900 according to the present invention includes: a connection establishment module 901, a program whitelist baseline establishment module 902, a preliminary determination module 903, an extraction module 904, a comparison module 905, a program classification processing module 906, a user confirmation processing module 907 and a confirmation information upload module 908.

[0112] The various modules of the host protection system 900 will be described in detail below.

[0113] The connection establishment module 901 is used to install a client (for example, it may be named IEG) on a host and register with a server (for example, it may be named USM), so that the client establishes a connection with the server.

[0114] Establishing program whitelist baseline module 902: used to enable the server to send the program whitelist baseline to the client; or used to perform program whitelist scanning on the client to add trusted programs and files to the whitelist, thereby establishing a program whitelist baseline.

[0115] Preliminary determination module 903: When an executable program is to be run on the host, the preliminary determination module 903 first performs a preliminary determination on the client to determine whether the executable program is in the pre-created program whitelist baseline. If the executable program is in the program whitelist baseline, the preliminary determination module 903 allows the program to run directly, otherwise it blocks the program from running.

[0116] Extraction module 904: When the executable program is not in the program whitelist baseline and is blocked from running, the extraction module 904 extracts the file signature, the hash value of the file, and the original path information of the file of the executable program on the client, and sends them to the server through an encrypted trusted transmission channel.

[0117] Comparison module 905: is used to receive the above-mentioned file feature code, file hash value and original path information of the file from the client on the server side, and then compare the received file feature code with the information of the virus database stored on the server side, and return the comparison result to the client through an encrypted trusted transmission channel.

[0118] Program classification processing module 906: used to receive the comparison result from the server on the client side, and then classify the executable program. Specifically, if the comparison result shows that the executable program is a non-virus file, the program classification processing module 906 classifies the executable program as a candidate whitelist program, and adds it to the whitelist baseline to be confirmed list, waiting for user confirmation. On the other hand, if the comparison result shows that the executable program is a virus file, the program classification processing module 906 classifies the executable program as a virus program to be confirmed, and prevents the program from running. At the same time, the source file of the executable program is actively moved to the isolation sandbox, prompting the user that a virus has appeared, and waiting for user confirmation.

[0119] User confirmation processing module 907: It is used to prompt the user to perform confirmation processing based on the classification result on the client side, and perform corresponding operations based on the user's confirmation information, as follows:

[0120] i) When the executable program is classified as a candidate whitelist program and added to the whitelist baseline to be confirmed list, the user confirmation processing module 907 is used to allow the user to confirm according to the prompt of the client to determine whether to execute the executable program. Specifically, when the user chooses to execute the executable program, the user confirmation processing module 907 adds the executable program to the program whitelist baseline on the client. On the other hand, when the user chooses not to execute the executable program, the program is prevented from running.

[0121] ii) When the executable program is classified as a virus program to be confirmed, the user confirmation processing module 907 is used to make the user confirm according to the prompt of the client (prompting the presence of a virus) to confirm whether to trust the source file of the executable program. Specifically, when the user confirms that the executable program file is a virus file (or an illegal program, etc.) (that is, the executable program file is not trusted), the user confirmation processing module 907 directly removes the source file of the executable program from the isolation sandbox permanently at the client. When the user confirms that the executable program file is a non-virus file (that is, trust the executable program file), the user confirmation processing module 907 restores the source file of the executable program from the isolation sandbox to the original path at the client, and prompts the user to choose whether to trust the executable program file permanently or temporarily. Specifically, if the user chooses to trust the executable program file permanently, the user confirmation processing module 907 adds the executable program file to the program whitelist baseline. On the other hand, if the user chooses to trust the executable program file temporarily, the user confirmation processing module 907 only releases the program execution this time.

[0122] The confirmation information uploading module 908 is used to upload the user confirmation information obtained by the user confirmation processing module 907 to the server at the client.

[0123] In addition, the host protection system 900 also includes a virus library upgrade module 909, which specifically includes an upload unit 9091, a preliminary verification unit 9092, a stop virus scanning and backup unit 9093, a new virus library file loading unit 9094 and a restart virus defense unit 9095.

[0124] Specifically, the upload unit 9091 is used to allow the user to enter the virus database upgrade menu through the operation interface (e.g., web page) provided by the server, select a new virus database file in the file system and upload it to the server. The file system can be located on the host or in a removable storage medium connected to the host.

[0125] The preliminary verification unit 9092 is used to preliminarily verify the file name and format of the new virus database file on the server side. If the verification is passed, the upgrade process will begin, otherwise the user will be prompted to reselect the file.

[0126] Stop virus scanning and backup unit 9093 is used to stop virus scanning engine at server end, and back up old virus library in another directory.If there is information such as file signature code uploaded by client at this moment, then stop virus scanning and backup unit 9093 stores these information in database temporary table at server end.

[0127] The new virus library file loading unit 9094 is used to move the new virus library file uploaded by the user to the executable directory of the virus scanning engine on the server side, and start the virus scanning engine to load the new virus library file. In addition, if the loading fails, the new virus library file loading unit 9094 returns the old virus library backed up by the virus scanning and backup unit 9093 to the executable directory, reloads the old virus library, and prompts the user to automatically return if the loading fails. If the loading is successful, the user is prompted to load successfully and the old virus library backed up by the virus scanning and backup unit 9093 is deleted.

[0128] The restart virus defense unit 9095 is used to restart virus defense using the information stored in the temporary table of the database.

[0129] In addition, an embodiment of the present invention further provides a server, which includes one or more processors 1001 and a memory 1002. Fig.10 A processor 1001 is taken as an example.

[0130] The server may further include: an input device 1003 and an output device 1004 .

[0131] The processor 1001, the memory 1002, the input device 1003 and the output device 1004 may be connected via a bus or other means. Fig.10 The example of connecting through bus is taken in the following.

[0132] The processor 1001 may be a central processing unit (CPU). The processor 101 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. A general-purpose processor may be a microprocessor or the processor may be any conventional processor.

[0133] The memory 1002 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the host protection method in the embodiment of the present application. The processor 1001 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 1002, that is, the host protection method of the above method embodiment is implemented.

[0134] The memory 1002 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of a processing device operated by a user terminal, etc. In addition, the memory 1002 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1002 may optionally include a memory remotely arranged relative to the processor 1001, and these remote memories may be connected to the image detection and processing device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0135] The input device 1003 can receive input digital or character information, and generate key signal input related to user settings and function control of the client's processing device. The output device 1004 can include display devices such as display screens.

[0136] One or more modules are stored in the memory 1002, and when executed by one or more processors 1001, the execution is as follows: Figure 3 and 7 The method shown.

[0137] The embodiment of the present invention further provides a host, which includes one or more processors 1101 and a memory 1102. Fig.11 A processor 1101 is taken as an example.

[0138] The host may further include: an input device 1103 and an output device 1104 .

[0139] The processor 1101, the memory 1102, the input device 1103 and the output device 1104 may be connected via a bus or other means. Fig.11 The example of connecting through bus is taken in the following.

[0140] The processor 1101 may be a central processing unit (CPU). The processor 1101 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. A general-purpose processor may be a microprocessor or the processor may be any conventional processor.

[0141] The memory 1102 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the host protection method in the embodiment of the present application. The processor 1101 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions and modules stored in the memory 1102, that is, the host protection method of the above method embodiment is implemented.

[0142] The memory 1102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the use of a processing device operated by a user terminal, etc. In addition, the memory 1102 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1102 may optionally include a memory remotely arranged relative to the processor 1101, and these remote memories may be connected to the image detection and processing device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0143] The input device 1103 can receive input digital or character information, and generate key signal input related to user settings and function control of the client's processing device. The output device 1104 can include display devices such as a display screen.

[0144] One or more modules are stored in the memory 1102, and when executed by one or more processors 1101, the execution is as follows: Figure 4 and 8 The method shown.

[0145] The embodiment of the present invention further provides an industrial control system, comprising: a server as described in any of the above embodiments; and at least one host as described in any of the above embodiments, wherein the server and the at least one host perform processing by interaction as described in Figure 2 and 6 The steps in the host protection method are described in detail.

[0146] By using the host protection method and system described above, it is possible to determine whether to execute the executable program through server comparison, client classification and user confirmation processing without transmitting virus files. Therefore, there is no need to set up an antivirus engine on the client and the client host is not occupied. Moreover, since there is no need to transmit files and occupy bandwidth during virus defense, it can be applied to a large range of industrial field environments. That is, virus defense and host protection are achieved by minimizing the occupation of host and bandwidth resources in the industrial field environment.

[0147] In addition, in the present invention, since the user finally confirms whether to block or release the execution of the executable program, the mistaken killing or missed killing caused by the virus database can be compensated as much as possible.

[0148] In addition, in the host protection method and system according to the present invention, since there is no need to transmit virus files during virus defense, the response speed is fast, so that it is possible to quickly determine whether a program is executed in an industrial field environment, thereby improving applicability and flexibility.

[0149] In addition, in the host protection method and system according to the present invention, when the comparison result on the server side indicates that the executable program is a virus file to be confirmed, the client immediately transfers the source file of the executable program to an isolated sandbox, thereby preventing the execution of possible virus files at the fastest speed and preventing the spread of possible viruses, thereby improving the safety performance of use in industrial field environments.

[0150] In addition, the host protection method and system according to the present invention can be applied to the situation where multiple hosts (with clients installed) are deployed in batches in an industrial field environment, thereby preventing viruses from spreading among the multiple hosts.

[0151] The above description is only an embodiment of the present application and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention shall be included in the scope of the claims of the present invention.

Claims

1. A host protection method, characterized in that: The host protection method comprises: A preliminary determination step of performing a preliminary determination on the executable program to be executed to determine whether the executable program is in a pre-created program whitelist baseline; An extraction step, when the executable program is not in the program whitelist baseline, extracting the file signature code of the executable program, the hash value of the file and the original path information of the file; A comparison step, comparing the file feature code with information in a pre-stored virus database; a program classification processing step of classifying the executable program based on the comparison result; and A user confirmation processing step is to prompt the user to perform confirmation processing based on the classification result, and perform corresponding operations based on the user's confirmation information. The host protection method further comprises the step of upgrading the virus database, wherein the step of upgrading the virus database comprises: The user selects a new virus database file and uploads it through the operation interface; Preliminarily verify the legality of the file name and format of the new virus database file; Stop the virus scanning engine, back up the old virus database from the executable directory to another directory, and store the file signature, hash value and original path information of the executable program extracted at this time in a temporary table of the database; Using the virus scanning engine to load the new virus library file uploaded by the user; and Using the information stored in the temporary table of the database to defend against viruses, In the program classification processing step, when the comparison result shows that the executable program is a non-virus file, the executable program is classified as a candidate whitelist program, and the executable program is added to the whitelist baseline to be confirmed list. In the user confirmation processing step, when the executable program is classified as the candidate whitelist program, the user is prompted to confirm whether to execute the executable program. When the user chooses to execute the executable program, the executable program is added to the program whitelist baseline.

2. The host protection method according to claim 1, wherein When the comparison result indicates that the executable program is a virus file, the executable program is classified as a virus program to be confirmed, and the execution of the executable program is blocked, and the source file of the executable program is actively moved to an isolated sandbox.

3. The host protection method according to claim 2, wherein: In the user confirmation processing step, when the executable program is classified as the virus program to be confirmed, the user is prompted to select whether to trust the executable program.

4. The host protection method according to claim 3, wherein: When the user chooses not to trust the executable program, the source file of the executable program is directly and permanently deleted from the isolated sandbox; and When the user chooses to trust the executable program, the executable program is restored to the original path, and the user is prompted to choose whether to trust the executable program permanently or temporarily.

5. The host protection method according to any one of claims 1 to 4, wherein: When the comparison result indicates that the executable program is a virus file, an alarm record is generated, and After obtaining the user's confirmation information, the alarm record is set to a processed state.

6. The host protection method according to claim 1, wherein: The new virus library file is stored in the host or in a mobile storage medium connected to the host.

7. A host protection method, used on a server, characterized in that: The host protection method comprises: Receiving a file signature, a hash value, and original path information of an executable program extracted and sent by a client, wherein the executable program is not in a program whitelist baseline of the client; Comparing the file signature with the information of the virus database stored in the server, and sending the comparison result to the client; and receiving a confirmation message from a user of the client, The host protection method further comprises the step of upgrading the virus database, wherein the step of upgrading the virus database comprises: Creating an operation interface for upgrading the virus database so that a user can select and upload a new virus database file through the client; Preliminarily verify the legality of the file name and format of the new virus database file; Stop the virus scanning engine, back up the old virus database from the executable directory to another directory, and store the file signature, hash value and original path information of the executable program sent to the server in a temporary table of the database; Using the virus scanning engine to load the new virus library file uploaded by the client; and Using the information stored in the temporary table of the database to defend against viruses, When the comparison result shows that the executable program is a non-virus file, the executable program is classified as a candidate whitelist program, and the executable program is added to the whitelist baseline to be confirmed list, In the user confirmation processing step, when the executable program is classified as the candidate whitelist program, the user is prompted to confirm whether to execute the executable program. When the user chooses to execute the executable program, the executable program is added to the program whitelist baseline.

8. The host protection method according to claim 7, wherein When the comparison result indicates that the executable program is a virus file, the server generates an alarm record, and After the server receives the confirmation information from the user, it sets the alarm record to a processed state.

9. The host protection method according to claim 7 or 8, wherein: The host protection method further includes upgrading the virus library, wherein upgrading the virus library includes: Creating an operation interface for upgrading the virus database so that a user can select and upload a new virus database file through the client; Preliminarily verify the legality of the file name and format of the new virus database file; Stop the virus scanning engine and back up the old virus database from the executable directory to another directory; and The new virus library file uploaded by the client is loaded using the virus scanning engine.

10. The host protection method according to claim 9, wherein: The new virus library file is stored in a host loaded with the client or in a mobile storage medium connected to the host.

11. A host protection system, characterized in that: The host protection system comprises: A preliminary determination module, the preliminary determination module is used to perform a preliminary determination on the executable program to be executed to determine whether the executable program is located in a pre-created program whitelist baseline; An extraction module, the extraction module being used to extract a file signature code of the executable program, a hash value of the file, and original path information of the file when the executable program is not in the program whitelist baseline; A comparison module, the comparison module is used to compare the file feature code with the information of the pre-stored virus library; A program classification processing module, the program classification module is used to classify the executable program based on the comparison result; A user confirmation processing module, the user confirmation processing module is used to prompt the user to perform confirmation processing based on the classification result, and perform corresponding operations based on the user's confirmation information; and The virus database upgrade module includes: An uploading unit, wherein the uploading unit is used to allow a user to select a new virus library file through an operation interface and upload it; A preliminary verification unit, the preliminary verification unit is used to preliminarily verify the legality of the file name and format of the new virus library file; A virus scanning and backup stopping unit is used to stop the virus scanning engine, back up the old virus database from the executable directory to another directory, and store the file signature code, hash value and original path information of the executable program extracted at this time in a temporary table of the database; A new virus library file loading unit, wherein the new virus library file loading unit is used to use the virus scanning engine to load the new virus library file uploaded by the user; and Restarting the virus defense unit, the restarting virus defense unit uses the information stored in the temporary table of the database to perform virus defense, In the program classification processing step, when the comparison result shows that the executable program is a non-virus file, the executable program is classified as a candidate whitelist program, and the executable program is added to the whitelist baseline to be confirmed list. In the user confirmation processing step, when the executable program is classified as the candidate whitelist program, the user is prompted to confirm whether to execute the executable program. When the user chooses to execute the executable program, the executable program is added to the program whitelist baseline.

12. A server, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; in The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the host protection method according to any one of claims 7 to 10.

Images