Detection system, detection method, and update verification method performed using the detection method

Abstract

A detection system, a detection method and an update verification method using the detection method are used to determine whether an update of at least one application program installed on at least one white-list host is legal. The system includes an update management server and a plurality of update detection machines. Each update detection machine has the at least one application program installed. During a process in which software automatic update occurs on each update detection machine and an update installation package is executed to perform an update action of the at least one application program, at least one update program is generated for each application program after the update installation package is executed. Each update detection machine verifies a download source and transmits a return message to the update management server. The return message includes information of the at least one update program and sampled execution file information. The update management server obtains a number of updated detection machines that perform the update action of each application program by the update installation package according to the return message of each update detection machine. When the number is greater than or equal to a threshold value, the update is determined to be legal.

Description

TECHNICAL FIELD

[0001] The present application relates to a detection system, a detection method, and an update verification method performed by using the detection method. BACKGROUND

[0002] With the upgrade of hacking methods, malware is also rapidly increasing. The current protection concept proposes to control with application whitelisting, to ensure that only the software positively listed in the application whitelist can be executed, and other unknown programs are blocked and cannot be executed. The whitelist is a default deny mechanism, and necessary executable files must be in the list. Although the application whitelist is well-intentioned, it may cause problems when automatic update occurs. Because the new executable file is not in the application whitelist, the updated application will be blocked and cannot be executed.

[0003] For example, the application is upgraded from version 2 to version 3, and the executable file of the application of version 3 does not exist in the application whitelist, so that the originally operable application becomes inoperable. At this time, the executable file of the new application of version 3 needs to be added to the application whitelist by a proper method, so that the upgraded application can be executed. However, unconditionally accepting new executable files is very dangerous, because the new executable file may be malware. How to solve the problem that the application whitelist causes the application to be unable to update and operate when the application is upgraded is one of the directions that the industry strives for. SUMMARY

[0004] According to an embodiment of the present application, a detection system is provided for determining whether an update of at least one application program installed on at least one whitelisted host is legitimate. The system includes an update management server and a plurality of update detectors. Each update detector has at least one application program installed thereon. During an automatic update of the software and execution of an update package for performing an update action of the at least one application program on each update detector, at least one update program is generated after execution of the update package. Each update detector verifies a download source and transmits a feedback message to the update management server. The feedback message includes information of the at least one update program and sampled execution file information. The update management server obtains a number of the update detectors that have performed the update action of the at least one application program according to the feedback messages of the update detectors. When the number of the updated detectors is greater than or equal to a threshold value, the update management server determines that the update is legitimate.

[0005] According to an embodiment of the present application, a detection method is provided for determining whether an update of at least one application program installed on at least one whitelisted host is legitimate. The method includes the following steps. First, an update management server and a plurality of update detectors are provided. Each update detector has at least one application program installed thereon. During an automatic update of the software and execution of an update package for performing an update action of the at least one application program on each update detector, at least one update program is generated after execution of the update package. Each update detector verifies a download source and transmits a feedback message to the update management server. The feedback message includes information of the at least one update program and sampled execution file information. Then, the update management server obtains a number of the update detectors that have performed the update action of the at least one application program according to the feedback messages of the update detectors. When the number of the updated detectors is greater than or equal to a threshold value, the update management server determines that the update is legitimate.

[0006] According to an embodiment of the present application, an update verification method performed by using a detection method is provided. The update verification method is performed by a predetermined white list host of at least one white list host. The update verification method includes the following steps. First, the predetermined white list host receives an update program list, and enters a verification procedure after a period of file activity is static. In the verification procedure, the predetermined white list host checks an execution log to determine whether all candidate update programs in the update program list have been tracked, and if not, determines that the update is incomplete. In the verification procedure, the predetermined white list host checks an application white list of the predetermined white list host to determine whether all sample executable files have been in the application white list of the predetermined white list host, and if not, determines that the update is incomplete. Then, when the predetermined white list host determines that the update is incomplete, the predetermined white list host actively downloads an update installation package from an update management server and executes the update installation package to restart the update procedure to collect new executable files.

[0007] For better understanding of the above objects and other objects of the present application, references are made to the following embodiments in detail and in conjunction with the accompanying drawings: BRIEF DESCRIPTION OF DRAWINGS

[0008] Figure 1 A schematic diagram of a detection system according to an embodiment of the present application is shown.

[0009] Figure 2 An example of update programs generated after an update installation package is executed is shown.

[0010] Figure 3 An example of an update program list generated by an update management server is shown.

[0011] Figure 4 An example of detailed configurations of an update management server, an update detection machine, and a white list host is shown.

[0012] Figure 5 An example of a sequence diagram for the update management server to identify a legal update is shown.

[0013] Figure 6 An example of a sequence diagram for the white list host to execute an update program is shown.

[0014] Figure 7 An example of a sequence diagram for the white list host to verify an update is shown.

[0015] Figure 8 An example of a sequence diagram for the white list host to repair an update is shown.

[0016] SYMBOL DESCRIPTION

[0017] 100: detection system

[0018] 102(1) - 102(3): whitelisted host

[0019] 104: update management server

[0020] 106(1) - 106(5): update detector

[0021] 202: update installation package

[0022] 402: filter

[0023] 404: recognizer

[0024] 406: query service unit

[0025] 408: database

[0026] 410: automatic trigger module

[0027] 412: security check module

[0028] 414: update collection module

[0029] 416: update executor

[0030] 418: update verifier

[0031] 420: program processor

[0032] 422: repair engine

[0033] 424: database DETAILED DESCRIPTION

[0034] Please refer to Figure 1 , which illustrates a schematic diagram of a detection system 100 according to an embodiment of the present application. The detection system 100 is used to determine whether an update of at least one application program installed on at least one whitelisted host 102 is legitimate. The detection system 100 comprises an update management server 104 and a plurality of update detectors 106. Each update detector 106 has the at least one application program installed thereon. During an automatic update and execution of an update installation package to perform an update action of the at least one application program on each update detector 106, at least one update program is generated after the update installation package is executed. Each update detector 106 verifies a download source and is used to transmit a return information to the update management server 104. The return information comprises information of the at least one update program and sampled executable file information.

[0035] The update management server 104 obtains the number of updated detectors that have performed update actions on at least one application program by using update installation packages based on the return information from the detectors 106. For example, the number of updated detectors corresponds to the same time point or the same time zone. When the number of updated detectors is greater than or equal to a threshold value, the update management server 104 determines that the update is legal.

[0036] When at least one white-listed host 102 wants to perform an update action on at least one application program, the update management server 104 receives a query from the at least one white-listed host 102. The update management server 104 returns a list of legal update programs to the at least one white-listed host 102 based on the collected list of legal update programs.

[0037] Thus, after the update management server 104 determines the list of legal update programs, if the at least one application program of the at least one white-listed host 102 is automatically updated and downloads an update installation package to perform an update action on the at least one application program, the new process is compared with the list of legal update programs. If the new process is legal, the new process is traced and a new executable file is generated. The new executable file is written into the white list. Thus, the at least one white-listed host 102 can avoid performing an update action on the at least one application program by using an illegal update installation package.

[0038] In Figure 1 In the embodiment, the at least one white-listed host 102 includes white-listed hosts 102(1) to 102(3), and the plurality of update detectors 106 includes update detectors 106(1) to 106(5). However, the embodiment is not limited thereto. The at least one white-listed host 102 can include white-listed hosts of other numbers, and the plurality of update detectors 106 can include update detectors of other numbers. The white-listed host 102 is a general name of the white-listed hosts 102(1) to 102(3) and refers to any one of the white-listed hosts 102(1) to 102(3). The update detector 106 is a general name of the update detectors 106(1) to 106(5) and refers to any one of the update detectors 106(1) to 106(5).

[0039] Further, the update management server 104 can generate an update program list based on the return information from the plurality of update detectors 106. The update program list includes at least one candidate update program and sampled executable file information. The at least one candidate update program is at least one update program that appears in the return information from the update detectors 106 that have transmitted the return information to the update management server 104.

[0040] When at least one application program of at least one white list host 102 is updated, the update management server 104 receives an inquiry from at least one white list host 102, and provides an update program list to at least one white list host 102. At least one white list host 102 updates an application program white list of at least one white list host 102 according to the update program list.

[0041] The application program installed in each update detection machine 106 is the same version as the application program installed in at least one white list host 102, and the operating system installed in each update detection machine 106 is the same version as the operating system installed in at least one white list host 102. After the update installation package is executed, it is decompressed or unpacked, and at least one update program is generated. The at least one update program generates a new executable file. By establishing the same software environment (same operating system version, same application program version, and same program execution) in each update detection machine 106 as in at least one white list host 102, the state of whether the update installation package is executed in each update detection machine 106 is observed, and the safety of the source of the update installation package is checked before the delivery information is provided, so that the update management server 104 can determine whether the update is legal according to the time state of the execution of the update installation package in each update detection machine 106.

[0042] For example, please refer to Figure 2Fig. 1 illustrates an example of the update programs generated after the update installation package is executed. When the update detector 106 installs at least one application program and learns that at least one updated version of the application program is released, the update detector 106(1) to 106(5) automatically downloads the update installation package 202 from the network, and each update detector 106 executes the update installation package to perform the update operation of the at least one application program. The executed update installation package generates at least one update program correspondingly. In detail, after the update detector 106(1) to 106(5) executes the update installation package 202, the update installation package 202 is decompressed or unpacked to generate a file Upd1. After the update installation package 202 is decompressed or unpacked, an update package Upck1 can also be generated simultaneously. Alternatively, the update package Upck1 can also be downloaded from the network by the update detector 106. After the file Upd1 is executed with the update package Upck1, a file Upd2 and a file Upd3 are generated. The file Upd2 and the file Upd3 are, for example, generated by decompressing or unpacking the file Upd1 with the update package Upck1. After the file Upck1 is executed, an update package Upck3 can also be generated simultaneously. Alternatively, the update package Upck3 can also be downloaded from the network by the update detector 106. After the file Upd2 is executed, a file Upd4 and a file Upd5 are generated. After the file Upd3 is executed with the update package Upck3, a file Upd6 is generated. After the file Upd4 is executed, a file Upd7 is generated. After the file Upd7 is executed, a plurality of executable files Exc1 are generated. After the file Upd5 is executed, a plurality of executable files Exc2 are generated. After the file Upd6 is executed, a plurality of executable files Exc3 are generated. The plurality of executable files Exc1, Exc2, and Exc3 can include, for example, executable files with file names "exe", "dll", and "sys" respectively. The above files Upd1 to Upd7 are executed or executed with the update package in the manner of, for example, decompression or unpacking.

[0043] When the update installation package 202 is an executable file (for example, with a file name "exe") and the files Upd1 to Upd7 generated after the update installation package 202 is executed are also executable files (for example, with a file name "exe"), the files Upd1 to Upd7 can be regarded as update programs. The following description will be given by taking the files Upd1 to Upd7 as examples of the update programs Upd1 to Upd7.

[0044] Please refer to Figure 3Fig. 6 is a diagram illustrating an example of a list of update programs generated by the update management server. After each update detector 106 executes the update installation package to perform the update action of at least one application, each update detector 106 transmits return information including information of at least one update program to the update management server 104. For example, the update detector 106(1) transmits return information RP1 to the update management server 104, and the update detectors 106(2) to 106(4) respectively transmit return information RP2 to RP4 to the update management server 104. The return information RP1 records, for example, update programs Updl to Upd7 generated after the update detector 106(1) executes the update installation package, and records the update package Upckl with which the file Updl is associated and the update package Upck3 with which the file Upd3 is associated. Similarly, the return information RP2 to RP4 records update programs Updl to Upd7 generated after the update detectors 106(2) to 106(4) execute the update installation package, and records the update package Upckl with which the file Updl is associated and the update package Upck3 with which the file Upd3 is associated. However, the return information RP2 further includes the program MLW.

[0045] After the update management server 104 receives the return information RP1 to RP4 of the update detectors 106(1) to 106(4), the number of updated detectors, for example, 4, which have performed the update action of at least one application by the update installation package can be obtained. Assuming that the threshold value is 4, since the number of updated detectors 4 is greater than or equal to the threshold value 4, the update management server 104 determines that the update installation package 202 is legal at this time.

[0046] In one embodiment, the number of updated detectors corresponds to the number of update detectors which have performed the update action of at least one application by the update installation package within a time period associated with a current time point. For example, the time period is one week or one month from the current time point. That is, the number of updated detectors corresponds to the number of update detectors which have performed the update action of at least one application by the update installation package within the last one week or one month. In another embodiment, the number of updated detectors corresponds to the same time as the current time point.

[0047] The reason for judging as legitimate is that if the update installation package is indeed a program officially released by the software publisher to update at least one application program, then in a recent period of time, many hosts or computers should have downloaded the update installation package to upgrade or update the specific application software. By using a plurality of clean update detectors to simulate the operation of the host or computer, if a certain number of update detectors have downloaded the update installation package, it means that the update installation package is indeed likely to be a legitimate program officially released by the specific application software for upgrading or updating. By observing that the number of update detectors 106 (the update management server 104 has the same software environment as the white list host 102) is greater than or equal to the threshold value, the update management server 104 can judge whether the update is legitimate. This is a way of judging whether the update is legitimate by "majority decision" (that is, the number of update detectors 106 executing the update installation package is greater than or equal to the threshold value).

[0048] The update management server 104 can also generate an update program list ULst according to the return information RP1-RP4 transmitted by each update detector 106(1)-106(4). The update program list ULst contains at least one candidate update program, which includes update programs Upd1-Upd4 and update packages Upck1 and Upck3 that all appear in the return information RP1-RP4. Among them, the program MLW in the return information RP2 only appears in the return information RP2 and does not appear in other return information RP1, RP3 and RP4. The update management server 104 judges the program MLW as suspicious malware and does not list it in the update program list ULst. The reason for judging the program MLW as suspicious malware and not listing it in the update program list ULst is as follows. Since the same update installation package 202 should generate the same update program after execution, the update programs listed in the return information RP1-RP4 should be the same. Therefore, the update management server 104 only lists the update programs Upd1-Upd7 and update packages Upck1 and Upck3 that all appear in the return information RP1-RP4 in the update program list ULst, and does not list the suspicious program MLW in the update program list ULst, so that the update program list ULst only contains update programs that can be trusted and listed in the application program whitelist of at least one white list host 102. This is a way of filtering out suspicious programs or malware by "intersection" (only listing the update programs Upd1-Upd7 and update packages Upck1 and Upck3 that all appear in the return information RP1-RP4 in the update program list ULst) to obtain safe and trusted update programs.

[0049] Please refer to Figure 4Fig. 1 is a diagram illustrating an example of a detailed configuration of an update management server, an update detector, and a white list host. The update management server 104 includes a filter 402, a recognizer 404, a query service unit 406, and a database 408. The filter 402 filters illegal programs in the reply information RP1-RP4 to generate an update program list. The recognizer 404 determines whether the update installation package 202 is legal according to the number of detectors that have been recently updated. The query service unit 406 receives a query from at least one white list host 102 to reply whether the update installation package 202 is legal for the at least one white list host. The database 408 stores the update program list UPst.

[0050] Each update detector 106 includes an auto triggering module 410, a safety checking module 412, and an update collection module 414. The auto triggering module 410 automatically starts an update action of at least one application. The safety checking module 412 ensures that the source of the update installation package 202 is a reliable installation source. The update collection module 414 collects information of at least one update program as reply information. Figure 4 For example, a plurality of update detectors 106 includes update detectors 106(1)-106(I), where I is a positive integer.

[0051] The white list host 102 includes an update executor 416, an update verifier 418, a program processor 420, a repair engine 422, and a database 424. The update executor 416 performs an update action of at least one application by means of an update installation package. The update verifier 418 verifies whether the update action of at least one application is completely performed. The program processor 420 executes an update program and generates a corresponding program. The repair engine 422 repairs the update action if the update action of at least one application is not completely performed. The database 424 stores an application white list of the update white list host 102. Figure 4 For example, a plurality of white list hosts 102 includes white list hosts 102(1)-102(J), where J is a positive integer.

[0052] Now further describe the actions performed by the update management server 104, the update detector 106, and the white list host 102 as follows. Collecting update program step. In this step, the automatic triggering module 410 triggers the corresponding update detector 106 to continuously reboot or restart the at least one application program by a script program (Script) to check whether the update installation package 202 has been released and needs to be updated. Alternatively, the automatic triggering module 410 uses a tool (for example, a software tool) to simulate user operations (simulate user operations of a mouse or a keyboard to click the user interface of the screen) to start an update interface to update the at least one application program.

[0053] Security confirmation step. In the process of downloading the update installation package 202 from the network, the security checking module 412 blocks the active connection of external networks (for example, does not allow external hosts to actively connect to the update detector 106 to implant unknown programs into the update detector 106) and checks the website of the download point of the update installation package 202 (that is, the website of the server on the network that can download the update installation package) to ensure that the source of the update installation package 202 is a reliable installation source to avoid unknown programs or malicious programs from being loaded into the update detector 106. The security checking module 412 also avoids storing unknown data. In addition, the update detector 106 also has its own white list to block unknown programs to ensure that the programs and software installed into the update detector 106 are reliable.

[0054] Submitting update information step. That is, the update collection module 414 of the update detector 106 collects the update programs generated after the execution of the update installation package 202, and transmits the return information recording the update programs generated after the update detector 106 (1) executes the update installation package and the sampled executable file information to the update management server 104.

[0055] Filtering step. The filter 402 of the update management server 104 finds the intersection of the update data for the collected multiple return information to filter out unknown programs or malicious programs that are not in the intersection to obtain an update program list. In order to ensure that the detected data is legal and reliable, the present embodiment strictly guards the update detector 106 by the design of multiple checks from the security confirmation step to the filtering step to prevent unsafe software and generate reliable update information.

[0056] Legitimacy confirmation step. The recognizer 404 judges whether the update installation package is legal according to the number of update detectors 106 that transmit return information according to the above-mentioned manner.

[0057] A storing update information step. The database 408 stores the above-mentioned update program list.

[0058] A retrieving update information step. The program processor 420 of the white list host 102 inquires the inquiry service unit 406 of the update management server 104 for the update program list and the sampled executable file information.

[0059] A tracing update program step. After the white list host 102 starts the update, the program processor 420 executes the update installation package, and the execution process generates necessary update programs. The new executable files are found by tracing the update programs. Therefore, the system continuously monitors each program to be executed, judges whether the currently executed program is listed in the update program list retrieved from the update management server 104. If yes, the program is considered as a safe program, and the file access operation thereof is traced.

[0060] A collecting new executable file step. After confirming that the currently executed program is the update program listed in the update program list retrieved from the update management server 104, the update executor 416 collects the executable files generated after the execution of the plurality of update programs, and writes the executable files into the application white list database 424 of the white list host 102, so that the executable files can be executed by the white list host 102.

[0061] Please refer to Figure 5 , which is an example of a sequence diagram illustrating the identification of legal updates by the update management server. After the software publisher on the network releases an update, the plurality of update detectors 106 respectively download the update package from the network. After the plurality of update detectors 106 collect the update programs and perform the security check, the plurality of update detectors 106 transmit the return information to the update management server 104. The recognizer 404 of the update management server 104 counts the number of the update detectors 106 that transmit the return information to the update management server 104, and if the number is greater than or equal to a threshold value N (N is a positive integer), the update program list is stored in the database 408.

[0062] Please refer to Figure 6Figure 6 illustrates an example of a sequence diagram of a white-listed host performing an update procedure. After an update is released by a software publisher on the network, any of the plurality of white-listed hosts 102 downloads the update package from the network. The program processor 420 of the white-listed host 102 queries the update management server 104 whether the currently executed programs match the list of update programs recorded by the update management server 104. When one or more programs match the list of update programs, the update tracker 416 starts tracking these new programs. If an executable file is found from these programs, the executable file is added to the application white-list of the white-listed host 102 and stored in the database 424.

[0063] The foregoing list of update programs reveals a complete update procedure, when the white-listed hosts are to be confirmed whether they have updated according to the update procedure, the update verification is initiated. By the above-mentioned detection method, the present embodiment further proposes an update verification method, which is preconfigured by one of the at least one white-listed host 102 to be performed by the white-listed host. The update verification method comprises the following steps. First, the preconfigured white-listed host receives the list of update programs, and after a period of time when the file activity is static, enters a verification procedure. In the verification procedure, the preconfigured white-listed host checks an execution log to compare whether all the at least one candidate update program in the list of update programs has been tracked, if not, it is judged as an incomplete update. In the verification procedure, the preconfigured white-listed host checks an application white-list of the preconfigured white-listed host to compare whether all the at least one sample executable file has been in the application white-list of the preconfigured white-listed host. If not, it is judged as an incomplete update.

[0064] After the preconfigured white-listed host determines the incomplete update, the preconfigured white-listed host actively downloads the update installation package from the update management server and executes to restart the update procedure and collect new executable files.

[0065] Now the above-mentioned update verification method is further illustrated by the sequence diagram of Figure 7 and Figure 8 Please refer to Figure 7Figure 6 illustrates an example of a sequence diagram of a white-listed host verifying an update. After the software publisher on the network releases an update, any of the plurality of white-listed hosts 102 downloads the update package from the network. The program processor 420 of the white-listed host 102 queries the update management server 104 for the update program list and does not find the update program list from the update management server 104. At this time, the program processor 420 of the white-listed host 102 executes the update package and generates new programs. When the update program list is ready from the update management server 104, if the idle time is expired, the update verifier 418 starts the verification. The update verifier 418 queries the update management server 104 and requests the update management server 104 to provide the update program list and the sample executable files. The update management server 104 replies and provides the update program list and the sample executable files. The update verifier 418 searches the program processor 420 log to see if all the update programs in the update program list are tracked. If the update is incomplete, the update verifier 418 triggers the repair program. The update verifier 418 queries the database 424 to see if all the sample executable files are present. If the update is incomplete, the update verifier 418 also triggers the repair program.

[0066] Please refer to Figure 8 Figure 7 illustrates an example of a sequence diagram of a white-listed host repairing an update. After the software publisher on the network releases an update, the update management server backs up the update installation package. The program processor 420 of the white-listed host 102 queries the update management server 104 for the update program and does not find it. At this time, the program processor 420 of the white-listed host 102 executes the update package and generates new programs, which are expected to be incorrectly updated at this time. If the verification fails, the repair engine 422 starts the repair action. The repair engine 422 requests the update management server 104 and downloads the update installation package from the update management server 104. The program processor 420 executes the update installation package and is expected to re-enter the normal tracking process. The program processor 420 queries the update management server 104 for the update program and, if it is correct, the update executor 416 starts tracking the update program. If the executable files are found, the update executor 416 adds the executable files to the application white list and stores them in the database 424.

[0067] According to the embodiment of the present application, a detection method is also provided to determine whether an update of at least one application program installed on at least one white-listed host is legitimate. The method includes the following steps. First, an update management server and a plurality of update detectors are provided, each of the update detectors is installed with the at least one application program. During a process in which each of the update detectors waits for an automatic update and executes an update installation package to perform an update action of the at least one application program, the update installation package after being executed correspondingly generates at least one update program. Each of the update detectors verifies a download source and transmits a feedback information to the update management server, the feedback information includes information of the at least one update program and sampled executable file information. The update management server obtains a number of updated detectors that perform the update action of the at least one application program by the update installation package according to the feedback information of each of the update detectors. When the number of the updated detectors is greater than or equal to a threshold value, the update management server determines that the update is legitimate.

[0068] The detection system, the detection method, and the update verification method performed by using the detection method described above can identify legitimate application program updates (legitimate update installation packages), exclude improper programs (unknown programs or malicious programs), find update packages in time, track corresponding update programs in time, and add generated new executable files to the application program white list. The system and the method of the present application are particularly suitable for a case where there are a large number of white-listed hosts, such as large factories or production line machines. The detection system with the update detectors can automatically adapt to software updates, replace manual setting of the application program white list of the white-listed hosts, reduce manual operations, greatly reduce operation time, reduce personnel burden, and avoid personnel errors. The system and the method of the present application can output a safe and reliable update program list without relying on manual judgment or external white-listed authentication units, easily support new application programs, are quite convenient, and save manpower. By adding the update programs and the executable files generated by the update programs to the application program white list, the subsequent execution of the application programs can be facilitated. In this way, the white-listed hosts can be well protected, and the demand for software upgrades of application software can be met.

[0069] In summary, although the present application has been disclosed as above with embodiments, the present application is not limited to the embodiments. Those skilled in the art can make various modifications and improvements without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application is defined by the appended claims.

Claims

1. A detection system for determining whether an update of at least one application program installed on at least one whitelisted host is legitimate, the system comprising: an update management server; and a plurality of update detection machines, each update detection machine having the at least one application program installed thereon, during a process in which a software automatic update occurs at each update detection machine and an update installer is executed to perform an update action of the at least one application program, the update installer being executed to correspondingly generate at least one update program, each update detection machine verifying a download source and transmitting a return message to the update management server, the return message including information of the at least one update program and sampled executable file information; wherein the update management server obtains a number of updated detection machines that perform the update action of the at least one application program by the update installer according to the return message of each update detection machine, and determines that the update is legitimate when the number of updated detection machines is greater than or equal to a threshold value, wherein a reason for determining that the download source is legitimate is that if the update installer installed on the at least one whitelisted host is indeed a program officially released by a software publisher to update at least one application program, then many hosts or computers should download the update installer to upgrade or update a specific application software in a recent period of time, wherein the update management server generates an update program list according to the return message transmitted by each update detection machine, the update program list containing at least one candidate update program, the at least one candidate update program including the at least one update program that appears in the return message of each update detection machine that transmits the return message to the update management server, so that a program determined to be suspicious malware of the download source is not included in the update program list, and the update program list only contains an update program that is trusted and included in an application program whitelist of the at least one whitelisted host. When the at least one whitelisted host wants to perform the update action on the at least one application program, the update management server is further configured to receive an inquiry of the at least one whitelisted host, and the update management server replies to the at least one whitelisted host with a legitimate update program list according to whether the collected update program list is legitimate.

2. The detection system of claim 1, wherein, When the at least one whitelisted host wants to perform the update action on the at least one application program, the update management server is further configured to receive an inquiry of the at least one whitelisted host, and the update management server provides the update program list to the at least one whitelisted host, and the at least one whitelisted host updates an application program whitelist of the at least one whitelisted host according to the update program list.

3. The detection system of claim 1, wherein, The update management server comprises:

4. The detection system of claim 3, wherein, a filter configured to filter an illegitimate program in the return message to generate the update program list; a recognizer configured to determine whether the update installer is legitimate according to the number of updated detection machines; an inquiry service unit configured to receive the inquiry of the at least one whitelisted host to reply to the at least one whitelisted host with the legitimate update program list; and a database configured to store the update program list. ​ 5. The detection system of claim 1, wherein, The update detectors each include: a security check module to ensure that the source of the update package is a reliable installation source; and an update collection module to collect information of the at least one update program as the return information.

6. The detection system of claim 5, wherein the update detectors each include an automatic trigger module to automatically initiate the update action of the at least one application.

7. The detection system of claim 6, wherein, The automatic trigger module is to continuously reboot or restart the at least one application by a script program to check whether the update package has been released to trigger the at least one application to perform the update action, or the automatic trigger module is to simulate user operations by a tool to initiate an update interface to perform the update action of the at least one application.

8. The detection system of claim 5, wherein, The security check module is to ensure that the source of the update package is a reliable installation source by blocking active connection of external networks and checking the URL of the download point of the update package.

9. The detection system of claim 1, wherein, The number of updated detectors corresponds to the number of the update detectors that have performed the update action of the at least one application by the update package within a time zone related to the current time point.

10. The detection system of claim 1, wherein, The number of updated detectors corresponds to the number of the update detectors that have performed the update action of the at least one application by the update package within the same time related to the current time point.

11. The detection system of claim 1, wherein, The at least one application installed in each update detector and the at least one application installed in the at least one white-list host are the same application version, the operating system installed in each update detector and the operating system installed in the at least one white-list host are the same operating system version, the update package is decompressed or unpacked after being executed to generate the at least one update program, and the at least one update program generates new at least one executable file.

12. A detection method to determine whether the update of at least one application installed in at least one white-list host is legal, the method comprising: providing an update management server and a plurality of update detectors, each update detector installing the at least one application; during the process of software automatic update and execution of an update package to perform the update action of the at least one application in each update detector, the update package is executed to correspondingly generate at least one update program, each update detector verifies the download source and transmits return information to the update management server, the return information including information of the at least one update program and sampled executable file information; and the update management server obtains the number of updated detectors that have performed the update action of the at least one application by the update package according to the return information of each update detector, and determines that the update is legal when the number of updated detectors is greater than or equal to a threshold value. wherein the reason for judging the download source as legitimate is that if the update installation package installed on the at least one white-listed host is indeed an officially released program for updating at least one application program by a software publisher, then in a recent period of time, many hosts or computers should have downloaded the update installation package to upgrade or update the specific application software; wherein the update management server generates an update program list containing at least one candidate update program including the at least one update program appearing in the return information of the update detectors that have transmitted the return information to the update management server, according to the return information transmitted by the update detectors, so as to exclude the program judged as suspicious malicious software from the update program list, and make the update program list contain only the update programs that are trustworthy and listed in the application program white list of the at least one white-listed host.

13. The detection method of claim 12, further comprising: when the at least one white-listed host intends to perform the update action on the at least one application program, the update management server receives an inquiry from the at least one white-listed host, and the update management server replies to the at least one white-listed host with the update program list collected by the update management server.

14. The detection method of claim 12, further comprising: when the at least one white-listed host intends to perform the update action on the at least one application program, the update management server receives an inquiry from the at least one white-listed host, and the update management server replies to the at least one white-listed host with the update program list and provides the update program list to the at least one white-listed host, and the at least one white-listed host updates the application program white list of the at least one white-listed host according to the at least one new file generated by the update program list.

15. The detection method of claim 14, wherein, the update management server comprises: a filter for filtering the illegal program in the return information to generate the update program list; an identifier for judging whether the update installation package is legitimate according to the number of the updated detectors; an inquiry service unit for receiving the inquiry from the at least one white-listed host to reply to the at least one white-listed host with the update program list collected by the update management server; and a database for storing the update program list.

16. The detection method of claim 12, wherein, each of the update detectors comprises: a security check module for ensuring that the source of the update installation package is a reliable installation source; and an update collection module for collecting the information of the at least one update program as the return information.

17. The detection method of claim 16, wherein, each of the update detectors comprises an automatic trigger module for automatically starting the update action of the at least one application program.

18. The detection method of claim 17, wherein, The automatic triggering module triggers the at least one application to perform the updating action by continuously rebooting or restarting the at least one application via a script program to check whether the update package has been released, or simulating user operations to start an updating interface to perform the updating action on the at least one application.

19. The detection method of claim 16, wherein, The security checking module ensures that the source of the update package is a reliable installation source by blocking active connection of external networks and checking the website of the download point of the update package.

20. The detection method of claim 12, wherein, The number of the updated detection machines corresponds to the number of the update detection machines that have performed the updating action on the at least one application by the update package in a time segment related to the current time point.

21. The detection method of claim 12, wherein, The at least one application installed on each update detection machine and the at least one application installed on the at least one white list host are the same application version, the operating system installed on each update detection machine and the operating system installed on the at least one white list host are also the same operating system version, the update package is decompressed or unpacked after being executed to generate the at least one update program, and the at least one update program generates new at least one executable file.

22. An update verification method performed by using the detection method of claim 12, the update verification method being performed by a preset white list host in the at least one white list host, the update verification method comprising: The preset white list host receives the update program list and enters a verification process after a period of time of file activity is static; In the verification process, the preset white list host checks the execution log to compare whether all the at least one candidate update program in the update program list has been tracked, if not, it is judged as an incomplete update; In the verification process, the preset white list host checks the application white list of the preset white list host to compare whether all the at least one sample executable file has been in the application white list of the preset white list host, if not, it is judged as an incomplete update; When the preset white list host determines that it is an incomplete update, the preset white list host actively downloads the update package from the update management server and executes it to restart the updating process and collect new executable files again.

Images