Program detection method, device, electronic device and medium

Abstract

The present disclosure provides a method for detecting a program, comprising: obtaining a startup event of a target program; determining at least one environment variable set by the target program according to the startup event; detecting whether the at least one environment variable contains a preset environment variable; and if the at least one environment variable contains a preset environment variable, deleting the preset environment variable in the at least one environment variable, and restoring the setting item corresponding to the preset environment variable to a default item, so as to run the target program according to the default item. The present disclosure also provides a program detection device, an electronic device, and a medium.

Description

Technical Field

[0001] The present disclosure relates to a program detection method, device, electronic device and medium. Background Art

[0002] Malicious programs (such as Trojan programs) can link illegal dynamic library files (such as SO files) to normal programs by changing program environment variables. Illegal dynamic library files may contain malicious function codes used to damage computer systems. After the program is linked to the illegal dynamic library file, it will preferentially load the illegal dynamic library file at startup to replace the address of the normal function with the address of the malicious function, thereby injecting the malicious program. When it is necessary to call a normal function, due to the change of the function address, the program will actually call the corresponding malicious function, thereby changing the normal operation logic of the program, which is more harmful to the system. Summary of the invention

[0003] One aspect of the present disclosure provides a program detection method, comprising: obtaining a startup event of a target program; determining at least one environment variable set by the target program based on the startup event; detecting whether the at least one environment variable includes a preset environment variable; and if the at least one environment variable includes a preset environment variable, deleting the preset environment variable in the at least one environment variable, and restoring the setting item corresponding to the preset environment variable to a default item, so as to run the target program according to the default item.

[0004] Optionally, the preset environment variables include environment variables for loading dynamic library files. Optionally, the startup event includes a process identifier of the target program; and determining at least one environment variable set by the target program according to the startup event includes: querying at least one environment variable set by the target program according to the process identifier.

[0005] Optionally, the method further includes: detecting whether there is a program file containing a preset feature in the target program according to a preset file path; and if there is a program file containing the preset feature in the target program, determining that the program file is a suspicious file and generating an alarm message.

[0006] Optionally, the preset feature includes a variable name of the preset environment variable.

[0007] Optionally, the method further includes: determining at least one dynamic library file corresponding to the suspicious file; determining whether there is an abnormal dynamic library file in the at least one dynamic library file; and if there is an abnormal dynamic library file in the at least one dynamic library file, deleting the suspicious file.

[0008] Another aspect of the present disclosure provides a program detection device, including: an acquisition module, used to acquire a startup event of a target program; a determination module, used to determine at least one environment variable set by the target program based on the startup event; a detection module, used to detect whether the at least one environment variable includes a preset environment variable; and a repair module, used to delete the preset environment variable in the at least one environment variable when the preset environment variable is included in the at least one environment variable, and restore the setting item corresponding to the preset environment variable to a default item, so as to run the target program according to the default item.

[0009] Another aspect of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0010] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0011] Another aspect of the present disclosure provides a computer program, which includes computer executable instructions, and the instructions are used to implement the method described above when executed.

[0012] According to an embodiment of the present disclosure, malicious injection in a program is discovered by checking whether the program's environment variables contain preset environment variables. If it is found that the program has set the preset environment variables, the preset environment variables are deleted from the environment variables set by the program, and the relevant setting items are restored, thereby removing the injection and ensuring the safety of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] For a more complete understanding of the present disclosure and its advantages, reference will now be made to the following description taken in conjunction with the accompanying drawings, in which:

[0014] Figure 1 A schematic diagram schematically shows an exemplary application scenario of the detection method that can be applied to an application according to an embodiment of the present disclosure;

[0015] Figure 2 A flowchart schematically illustrates a method for detecting a program according to an embodiment of the present disclosure;

[0016] Figure 3 A flowchart schematically shows a method for detecting a program according to another embodiment of the present disclosure;

[0017] Figure 4 A flowchart schematically shows a method for detecting a program according to another embodiment of the present disclosure;

[0018] Figure 5 A block diagram schematically showing a detection device of a program according to an embodiment of the present disclosure; and

[0019] Figure 6 The block diagram of a computer system suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0021] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0022] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0023] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0024] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some boxes or combinations thereof in the block diagrams and / or flow charts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions can create a device for implementing the functions / operations described in these block diagrams and / or flow charts when executed by the processor. The technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable storage medium storing instructions, which can be used by an instruction execution system or used in conjunction with an instruction execution system.

[0025] The embodiment of the present disclosure provides a method for detecting a program. The method includes obtaining an original data frame and a protocol type corresponding to the original data frame; parsing the original data frame according to the protocol type to obtain target information; determining whether there is a target data structure corresponding to the target information in the historical data; in response to determining that there is no target data structure in the historical data, performing the following operations: determining a detection strategy corresponding to the original data frame according to the protocol type; performing a security detection on the original data frame according to the detection strategy; and storing the target information and the detection strategy in the target data structure; and in response to determining that there is a target data structure in the historical data, performing the following operations: reading the detection strategy in the target data structure; and performing a security detection on the original data frame according to the detection strategy.

[0026] Figure 1 The following schematically illustrates an exemplary application scenario of the detection method that can be applied to an application according to an embodiment of the present disclosure. It should be noted that: Figure 1 What is shown are merely examples of application scenarios to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0027] like Figure 1As shown, according to the application scenario of this embodiment, when a program starts, the kernel driver intercepts the startup event of the program. Then the daemon process is notified to send information such as the process identifier (e.g., process D) in the startup event to the daemon process. The daemon process obtains the environment variables of the program according to the process identifier, and determines whether the environment variables contain preset environment variables by checking whether the environment variables contain preset fields. If these environment variables contain preset environment variables, it means that the program has injection risks, and the daemon process deletes all the preset environment variables and restores the setting items corresponding to the preset environment variables to the default items, thereby eliminating the injection risks. The daemon process then notifies the kernel driver of the processing result. After receiving the processing result as successful, the kernel driver releases the program so that the program continues to run.

[0028] Figure 2 The flowchart schematically shows a method for detecting a program according to an embodiment of the present disclosure.

[0029] like Figure 2 As shown, the method includes operations S210 to S240.

[0030] In operation S210, a start event of a target program is acquired.

[0031] According to an embodiment of the present disclosure, the startup event includes a process identifier of the target program.

[0032] According to an embodiment of the present disclosure, operation S210 may include, for example, intercepting a startup event of the target program through a kernel driver of the system.

[0033] In operation S220, at least one environment variable set by the target program is determined according to the startup event.

[0034] According to an embodiment of the present disclosure, the preset environment variables include environment variables for loading dynamic library files. Taking the Linux system as an example, the preset environment variables may include LD_PRELOAD, LD_ELF_PRELOAD and LD_AOUT_PRELOAD.

[0035] According to an embodiment of the present disclosure, operation S220 may, for example, include querying at least one environment variable set by the target program according to the process identifier.

[0036] More specifically, the process identifier may be, for example, a process ID. In this embodiment, the environment variables of the target program may be queried by the following command: cat / proc / $PID / environ, where $PID refers to the process ID corresponding to the target program.

[0037] In operation S230, it is detected whether the at least one environment variable includes a preset environment variable.

[0038] In operation S240, if the at least one environment variable includes a preset environment variable, the preset environment variable in the at least one environment variable is deleted, and the setting item corresponding to the preset environment variable is restored to a default item, so that the target program is run according to the default item.

[0039] According to an embodiment of the present disclosure, malicious injection in a program is discovered by checking whether the program's environment variables contain preset environment variables. If it is found that the program has set the preset environment variables, the preset environment variables are deleted from the environment variables set by the program, and the relevant setting items are restored, thereby removing the injection and ensuring the safety of the device.

[0040] Figure 3 The flowchart schematically shows a method for detecting a program according to another embodiment of the present disclosure.

[0041] like Figure 3 As shown, in addition to operations S210 to S240, the method includes operations S310 to S320.

[0042] Operations S310 to S320 may be performed before operation S210, or at any stage between operations S210 to S240. For example, in this embodiment, operations S310 to S320 are performed before operation S210.

[0043] In operation S310, it is detected whether there is a program file containing a preset feature in the target program according to a preset file path.

[0044] According to an embodiment of the present disclosure, a file path where a file that may contain a preset environment variable is located may be predetermined as a preset file path.

[0045] Exemplarily, for a Linux system, the preset file path may be, for example, as shown in Table 1. It should be noted that the file path shown in Table 1 is only an example, and the present disclosure is not limited thereto.

[0046]

[0047]

[0048] Table 1

[0049] According to an embodiment of the present disclosure, the preset feature may include, for example, a variable name of a preset environment variable and / or a keyword used to set the preset environment variable.

[0050] Exemplarily, the preset features may be as shown in Table 2. It should be noted that the preset features shown in Table 2 are only examples, and the present disclosure is not limited thereto.

[0051] Variable Name Keywords for setting environment variables LD_PRELOAD export LD_PRELOAD LD_ELF_PRELOAD export LD_ELF_PRELOAD LD_AOUT_PRELOAD export LD_AOUT_PRELOAD

[0052] Table 2

[0053] In operation S320, if a program file containing a preset feature exists in the target program, the program file is determined to be a suspicious file, and an alarm message is generated.

[0054] According to an embodiment of the present disclosure, based on a preset file path, it is detected whether there is a program file containing preset features in the target program, and the target program can be statically detected to discover suspicious files in the target program, and an alarm message is generated to alert the user.

[0055] Figure 4 The flowchart schematically shows a method for detecting a program according to another embodiment of the present disclosure.

[0056] like Figure 4 As shown, the method may further include operations S410 to S430 after operations S310 to S320.

[0057] In operation S410, at least one dynamic library file corresponding to the suspicious file is determined.

[0058] In operation S420 , it is determined whether there is an abnormal dynamic library file among the at least one dynamic library file.

[0059] According to an embodiment of the present disclosure, for each dynamic library file corresponding to a suspicious file, whether each dynamic library file is abnormal can be determined by analyzing whether the related files on which each dynamic library file depends are malicious files. If the related files on which a dynamic library file depends are malicious files, then the dynamic library file is abnormal.

[0060] According to an embodiment of the present disclosure, whether each dynamic library file is abnormal can also be determined by analyzing the function of each dynamic library file corresponding to the suspicious file. If the function of the dynamic library file involves dangerous behavior, the dynamic library file is abnormal.

[0061] In operation S430, if there is an abnormal dynamic library file in at least one dynamic library file, the suspicious file is deleted.

[0062] According to the embodiment of the present disclosure, by detecting the dynamic library file corresponding to the suspicious file, the security of the suspicious file is further analyzed. If there is an abnormal dynamic library file, it means that the suspicious file has malicious injection, and the suspicious file is deleted to remove the malicious injection, thereby preventing the device from being harmed.

[0063] The following is a detailed description of the embodiments of the present invention. Figure 2 to Figure 4 The method shown is further explained.

[0064] An exemplary embodiment according to an embodiment of the present disclosure is shown below. Those skilled in the art can understand that the following exemplary embodiment is only used to understand the present disclosure, and the present disclosure is not limited thereto.

[0065] Exemplarily, in this embodiment, the preset environment variables include LD_PRELOAD, LD_ELF_PRELOAD, and LD_AOUT_PRELOAD.

[0066] First, static detection is performed to detect whether there is a file containing the features shown in Table 2 above in the file path shown in Table 1 above. If a file containing the features shown in Table 2 is detected, it can be concluded that the system may be injected with the relevant SO module, an alarm message is thrown, and the dependencies and functions of the dynamic library files corresponding to the file path are scanned and analyzed. If the dynamic library file related to the file is found to be abnormal through scanning and analysis, and the file is a file that the user does not recognize, it will be deleted.

[0067] Then, dynamic detection is performed, that is, during the running of the program, the method of setting the preset environment variables called by the function in the program is detected in real time.

[0068] More specifically, when the program is started, the kernel driver intercepts the process start event. The kernel driver notifies the daemon process of the process ID and other information in the start event. The daemon process obtains the environment variables of the program process according to the process ID. According to the environment variables of the obtained process, it is checked whether each environment variable contains the LD_PRELOAD, LD_ELF_PRELOAD or LD_AOUT_PRELOAD field. If the above fields are contained, the environment variables containing the above fields are removed, and the setting items corresponding to these environment variables are set back to the default values.

[0069] Figure 5 The following is a block diagram schematically showing a program detection device according to an embodiment of the present disclosure.

[0070] like Figure 5 As shown, the program detection device 500 includes an acquisition module 510, a determination module 520, a detection module 530 and a repair module 540. The program detection device 500 can execute the above reference Figure 2 Describe the method.

[0071] Specifically, the acquisition module 510 is used to acquire a startup event of a target program.

[0072] The determination module 520 is used to determine at least one environment variable set by the target program according to the startup event.

[0073] The detection module 530 is used to detect whether at least one environment variable includes a preset environment variable.

[0074] The repair module 540 is used to delete the preset environment variable in at least one environment variable when at least one environment variable includes the preset environment variable, and restore the setting item corresponding to the preset environment variable to the default item, so as to run the target program according to the default item.

[0075] According to an embodiment of the present disclosure, the preset environment variables include environment variables for loading dynamic library files.

[0076] According to an embodiment of the present disclosure, the startup event includes a process identifier of the target program. The determination module can be specifically used to query at least one environment variable set by the target program according to the process identifier.

[0077] According to an embodiment of the present disclosure, malicious injection in a program is discovered by checking whether the program's environment variables contain preset environment variables. If it is found that the program has set the preset environment variables, the preset environment variables are deleted from the environment variables set by the program, and the relevant setting items are restored, thereby removing the injection and ensuring the safety of the device.

[0078] According to an embodiment of the present disclosure, the detection module 530 can also be used to detect whether there is a program file containing preset features in the target program based on a preset file path. If there is a program file containing preset features in the target program, the program file is determined to be a suspicious file and an alarm message is generated.

[0079] According to an embodiment of the present disclosure, the preset feature may include a variable name of a preset environment variable.

[0080] According to an embodiment of the present disclosure, based on a preset file path, it is detected whether there is a program file containing preset features in the target program, and the target program can be statically detected to discover suspicious files in the target program, and an alarm message is generated to alert the user.

[0081] According to another embodiment of the present disclosure, the program detection device 500 may also include a clearing module for determining at least one dynamic library file corresponding to a suspicious file; determining whether there is an abnormal dynamic library file in the at least one dynamic library file; and deleting the suspicious file if there is an abnormal dynamic library file in the at least one dynamic library file.

[0082] According to the embodiment of the present disclosure, by detecting the dynamic library file corresponding to the suspicious file, the security of the suspicious file is further analyzed. If there is an abnormal dynamic library file, it means that the suspicious file has malicious injection, and the suspicious file is deleted to remove the malicious injection, thereby preventing the device from being harmed.

[0083] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0084] For example, any multiple of the acquisition module 510, the determination module 520, the detection module 530, and the repair module 540 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 510, the determination module 520, the detection module 530, and the repair module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 510, the determination module 520, the detection module 530, and the repair module 540 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0085] Figure 6 The block diagram of a computer system suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Figure 6 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0086] like Figure 6As shown, the computer system 600 includes a processor 610 and a computer-readable storage medium 620. The computer system 600 can execute the method according to the embodiment of the present disclosure.

[0087] Specifically, the processor 610 may include, for example, a general-purpose microprocessor, an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 610 may also include an onboard memory for cache purposes. The processor 610 may be a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0088] The computer-readable storage medium 620 may be, for example, a non-volatile computer-readable storage medium, and specific examples include but are not limited to: a magnetic storage device, such as a magnetic tape or a hard disk (HDD); an optical storage device, such as a compact disk (CD-ROM); a memory, such as a random access memory (RAM) or flash memory; and the like.

[0089] The computer-readable storage medium 620 may include a computer program 621 , which may include code / computer-executable instructions that, when executed by the processor 610 , cause the processor 610 to perform a method according to an embodiment of the present disclosure or any variation thereof.

[0090] The computer program 621 may be configured to have, for example, a computer program code including a computer program module. For example, in an example embodiment, the code in the computer program 621 may include one or more program modules, for example, including 621A, module 621B, ... It should be noted that the division method and number of modules are not fixed, and those skilled in the art may use appropriate program modules or program module combinations according to actual conditions, and when these program module combinations are executed by the processor 610, the processor 610 may execute the method according to the embodiment of the present disclosure or any variation thereof.

[0091] According to an embodiment of the present invention, at least one of the acquisition module 510, the determination module 520, the detection module 530, and the repair module 540 may be implemented as a reference module. Figure 6 The computer program modules described herein, when executed by the processor 610, can implement the corresponding operations described above.

[0092] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the detection method of the program according to the embodiment of the present disclosure is implemented.

[0093] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0094] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0095] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0096] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A method for detecting a program, comprising: In the static detection process, according to the preset file path, it is detected whether there is a program file containing the preset features in the target program. If there is a program file containing the preset features in the target program, the program file is determined to be a suspicious file and an alarm message is generated; Determining at least one dynamic library file corresponding to the suspicious file; Determine whether there is an abnormal dynamic library file in the at least one dynamic library file; and if there is an abnormal dynamic library file in the at least one dynamic library file, delete the suspicious file; wherein, for each dynamic library file corresponding to the suspicious file, determine whether each dynamic library file is abnormal by analyzing whether the related files on which each dynamic library file depends are malicious files, and if the related files on which the dynamic library file depends are malicious files, the dynamic library file is abnormal; or, determine whether each dynamic library file is abnormal by analyzing the function of each dynamic library file corresponding to the suspicious file, and if the function of the dynamic library file involves dangerous behavior, the dynamic library file is abnormal; In the dynamic detection process, the startup event of the target program is obtained through the kernel driver; the process identifier in the startup event is sent to the daemon process; the daemon process determines at least one environment variable set by the target program according to the process identifier; the daemon process detects whether the at least one environment variable contains a preset environment variable, wherein whether the environment variable contains the preset environment variable is determined by detecting whether the environment variable contains a preset field; and if the at least one environment variable contains the preset environment variable, it indicates that there is an injection risk in the target program, and the daemon process deletes the preset environment variable in the at least one environment variable, and restores the setting item corresponding to the preset environment variable to the default item, thereby eliminating the injection risk, so as to run the target program according to the default item.

2. The method according to claim 1, wherein: The preset environment variables include environment variables used to load dynamic library files.

3. The method according to claim 1, wherein: The preset feature includes the variable name of the preset environment variable.

4. A program detection device, comprising: An acquisition module is used to acquire the startup event of the target program through the kernel driver during the dynamic detection process; A sending module, used to send the process identifier in the startup event to the daemon process; a determination module, configured to enable the daemon process to determine at least one environment variable set by the target program according to the process identifier; a detection module, configured to enable the daemon process to detect whether the at least one environment variable includes a preset environment variable, wherein whether the environment variable includes the preset environment variable is determined by detecting whether the environment variable includes a preset field; and a repair module, configured to, when the at least one environment variable includes a preset environment variable, indicating that there is an injection risk in the target program, delete the preset environment variable in the at least one environment variable by the daemon process, and restore the setting item corresponding to the preset environment variable to a default item, thereby eliminating the injection risk, so as to run the target program according to the default item; The detection module is also used to detect whether there is a program file containing preset features in the target program according to a preset file path during the static detection process. If there is a program file containing the preset features in the target program, the program file is determined to be a suspicious file and an alarm message is generated; A clearing module is used to determine at least one dynamic library file corresponding to the suspicious file; determine whether there is an abnormal dynamic library file in at least one dynamic library file; and if there is an abnormal dynamic library file in at least one dynamic library file, delete the suspicious file; wherein, for each dynamic library file corresponding to the suspicious file, determine whether each dynamic library file is abnormal by analyzing whether the related files on which the dynamic library file depends are malicious files, and if the related files on which the dynamic library file depends are malicious files, the dynamic library file is abnormal; or, determine whether each dynamic library file is abnormal by analyzing the function of each dynamic library file corresponding to the suspicious file, and if the function of the dynamic library file involves dangerous behavior, the dynamic library file is abnormal.

5. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, When one or more computer programs are executed by one or more processors, the one or more processors are caused to implement the method of any one of claims 1 to 3.

6. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to implement the method of any one of claims 1 to 3.

7. A computer program product, comprising computer executable instructions for implementing the method according to any one of claims 1 to 3 when the instructions are executed.

Images