Protection method and device based on registry

Abstract

The embodiment of the present invention provides a protection method and device based on a registry. The method includes: in response to detecting the occurrence of an account event, determining a first registry according to a preset first target path, the first registry including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, and the first value item storing the user's configuration information; determining at least one first value item according to at least one user name key in the first registry; matching the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepting or alarming the account event corresponding to the successfully matched user configuration information. Since the method intercepts at the lowest level, it can prevent most bypass and obfuscation technologies, greatly improving the defense capability.

Description

Technical Field

[0001] The present invention relates to the field of terminal security, and in particular to a protection method and device based on a registry. Background Art

[0002] Assuming that the hacker has already invaded the victim's computer through vulnerabilities and other means, he needs to create a backdoor account to maintain persistence. For example, after hacking into a host, the hacker will try every means to protect his "fruits of labor", so he will leave various backdoors on the zombies to control them for a long time, including creating a backdoor account with administrator privileges. Currently, most security vendors mainly use the following two methods to detect this behavior:

[0003] 1. Analyze the command line parameters when net1.exe is started. Simply copy the net1.exe file to any directory and rename it to any file name to bypass it.

[0004] 2. The kernel hooks the ALPC communication function and analyzes the communication content. Hooking system calls under x64 is risky, and the hard offset of each system version is slightly different, which requires a lot of maintenance in the later stage. In addition, the ALPC communication function is called quite frequently in the system, which seriously affects the system performance. Summary of the invention

[0005] In response to the problems in the prior art, an embodiment of the present invention provides a protection method and device based on a registry. In order to detect tampering with operating system accounts in a targeted manner, interception of abnormal user account behavior based on the registry is implemented. By filtering registry events in real time, when a specific behavior occurs, the event itself is intercepted. Since the present invention intercepts at the lowest level, it can prevent most bypass and obfuscation technologies, greatly improving the defense capability. In addition, by filtering user account operations through the registry, terminal user accounts are protected from being tampered with, preventing hackers from subsequent access to the compromised host.

[0006] Specifically, the embodiment of the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a registry-based protection method, comprising: in response to detecting an account event, determining a first registry according to a preset first target path, the first registry including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, the first value item storing user configuration information; determining at least one first value item according to at least one user name key in the first registry; matching the user configuration information stored in the determined first value item with a first preset rule respectively, and if the match is successful, intercepting or alarming the account event corresponding to the successfully matched user configuration information.

[0008] Further, the response to detecting an account event includes: responding to detecting user account creation, deletion, password modification, deactivation or login.

[0009] Further, the at least one user name key includes at least one corresponding binary value, the at least one binary value corresponds to the key name of the at least one user configuration key, and the determining of at least one first value item based on the at least one user name key includes: determining the at least one user configuration key based on the key name of the at least one user configuration key and the at least one binary value; determining at least one first value item based on the at least one user configuration key.

[0010] Furthermore, in response to detecting the occurrence of a grouping event, a second registration table is determined according to a preset second target path, the second registration table includes at least one group name key and at least one corresponding group configuration key, the group configuration key includes a second value item, and the second value item stores group configuration information; at least one second value item is determined according to at least one group name key in the second registration table; the group configuration information stored in the determined second value item is matched with the second preset rule respectively, and if the match is successful, the group event corresponding to the successfully matched group configuration information is intercepted or an alarm is issued.

[0011] Furthermore, the at least one group name key includes at least one corresponding binary value, the at least one binary value corresponds to the key name of the at least one group configuration key, and the determining of at least one second value item based on the at least one group name key includes: determining the at least one group configuration key based on the key name of the at least one group configuration key and the at least one binary value; determining at least one second value item based on the at least one group configuration key.

[0012] Furthermore, the user configuration information and the group configuration information are stored in the form of structures.

[0013] In the second aspect, an embodiment of the present invention also provides a registry-based protection device, including: a first processing module, used to determine a first registry according to a preset first target path in response to detecting an account event, the first registry including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, and the first value item storing the user's configuration information; a second processing module, used to determine at least one first value item according to at least one user name key in the first registry; a third processing module, used to match the user configuration information stored in the determined first value item with a first preset rule respectively, and if the match is successful, intercept or alarm the account event corresponding to the successfully matched user configuration information.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the registry-based protection method described in the first aspect are implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the registry-based protection method as described in the first aspect.

[0016] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the registry-based protection steps described in the first aspect.

[0017] The registry-based protection method and device provided by the embodiment of the present invention, in response to detecting the occurrence of an account event, determines a first registry according to a preset first target path, wherein the first registry includes at least one user name key and at least one corresponding user configuration key, wherein the user configuration key includes a first value item, wherein the first value item stores the user's configuration information; determines at least one first value item according to at least one user name key in the first registry; matches the user configuration information stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepts or alarms the account event corresponding to the successfully matched user configuration information. By intercepting the registry, it is realized that there is no need to inject into any process, it is safe and stable, no need for post-maintenance, and no need for the kernel to do any Hook, it is safe and stable, and no need for post-maintenance. It can synchronously perceive manual (non-Api call) modification of account information. It has high execution efficiency and almost no performance loss to the operating system. It has good compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is a flow chart of an embodiment of a protection method based on a registry of the present invention;

[0020] Figure 2 Flow charts of other embodiments of the registry-based protection method of the present invention;

[0021] Figure 3-1A schematic diagram of a scenario in which a backdoor account is created after a computer is hacked;

[0022] Figure 3-2 A schematic diagram of the application scenario of all user information on the terminal;

[0023] Figure 3-3 A schematic diagram of an application scenario for grouping information of all accounts on a terminal;

[0024] Figure 4 It is a schematic diagram of the structure of an embodiment of a protection device based on a registration table of the present invention;

[0025] Figure 5 It is a schematic diagram of the structure of an electronic device entity embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] Figure 1 FIG. 1 is a flow chart of an embodiment of the protection method based on the registry of the present invention. Figure 1 As shown, the protection method based on the registry of the embodiment of the present invention includes:

[0028] S101, in response to detecting an account event, determining a first registry according to a preset first target path, the first registry including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, and the first value item storing user configuration information.

[0029] In some embodiments, the registry (Registry, referred to as the login file in the Traditional Chinese version of Windows operating system) is a core database in the Windows operating system, which stores various parameters and directly controls the startup of Windows, the loading of hardware drivers, and the operation of some Windows applications, thus playing a core role in the entire system. Users can open the registry by entering commands, such as regedit or regedit.exe, regedt32 or regedt32.exe. The registry consists of keys (also called primary keys or "items"), subkeys (sub-items) and value items. A key is a folder in a branch, and a subkey is a subfolder in this folder (for example, a user name key, or a user configuration key), and a subkey is also a key. A value item is the current definition of a key (for example, the first value item), which consists of a name, a data type, and an assigned value (for example, the user configuration information stored in the first value item). A key can have one or more values, and the name of each value is different. If the name of a value is empty, the value is the default value of the key.

[0030] Assuming that the hacker has already invaded the victim's computer through vulnerabilities, he needs to create a backdoor account and keep it persistent, such as Figure 3-1 shown.

[0031] As an example, a first registry user manages user accounts.

[0032] As an example, the file name of the username key (or username folder) is the name of the user created by the user, and the user configuration key (or user configuration folder) corresponding to the username key includes the information when the user created the username (that is, the first value item stores the user's configuration information).

[0033] As an example, the user configuration key includes at least one value item, the at least one value item includes a default value item, and the user information stored in each value item may be different.

[0034] As an example, configuration information, such as creation time, user permissions, etc.

[0035] S102: Determine at least one first value item according to at least one user name key in the first registration table.

[0036] In some embodiments, the user name key and the user configuration key correspond to each other, and the user configuration key includes a first value item. Therefore, the user name key may be determined first, and then the user configuration key may be determined based on the corresponding relationship, and then the first value item may be determined.

[0037] S103, matching the user configuration information stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepting or alerting the account event corresponding to the successfully matched user configuration information.

[0038] In some embodiments, the first preset rule may be a pre-set threshold, or a keyword, or a regular expression, and the first preset rule is used to match illegal account security events from the user configuration information. If the match is successful, the illegal account security event corresponding to the successfully matched user configuration information is intercepted or alarmed. For example, all information of the illegal account security event can be synchronously thrown to the security threat engine for specific analysis and processing, at which time the security threat engine can intercept and record the corresponding suspicious or threatening behavior. As an example, when an account creation event is detected by the driver, the user configuration information to be saved in the determined first value item is determined, the user configuration information is matched by the first preset rule, and the account is intercepted or alarmed according to the matching result.

[0039] As an example, the driver first calls the CmRegisterCallbackEx function to register a callback to filter registry events. When the function is called to operate an account (such as adding, deleting, modifying or grouping), the system will modify (for example, creating an account creates a key value and a value item containing account information, and deleting deletes the corresponding key value and value item) the account value item under a specific registry path (for example, a specific path of \REGISTRY\MACHINE\SAM\SAM\DOMAINS\Account\Users\). Before the modification, the system will notify the driver through the previously registered callback. When the driver receives the callback notification, it will compare the registry path of the operation and the modified content according to the rules. If it meets the specific rules, it will send the information to the anti-virus engine for processing. The engine uses built-in rules to decide whether to release, block or alarm the operation.

[0040] The registry-based protection method provided by the embodiment of the present invention, in response to detecting the occurrence of an account event, determines the first registry according to the preset first target path, the first registry includes at least one user name key and at least one corresponding user configuration key, the user configuration key includes a first value item, and the first value item stores the user's configuration information; determines at least one first value item according to at least one user name key in the first registry; matches the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepts or alarms the account event corresponding to the successfully matched user configuration information. By intercepting the registry, it is realized that there is no need to inject into any process, it is safe and stable, no need for post-maintenance, and no need for the kernel to do any Hook, it is safe and stable, and no need for post-maintenance. It can synchronously perceive manual (non-Api call) modification of account information. The execution efficiency is high, and there is almost no performance loss to the operating system. Good compatibility.

[0041] In some optional implementations, responding to detecting an account event includes: responding to detecting user account creation, deletion, password modification, deactivation, or login.

[0042] The intercepted account events can be five types of account events: account creation, deletion, password modification, deactivation, and login. These five events share the same interception point, namely the account event.

[0043] In some optional implementations, at least one user name key includes at least one corresponding binary value, the at least one binary value corresponds to a key name of at least one user configuration key, and at least one first value item is determined based on the at least one user name key, including: determining at least one user configuration key based on the key name of at least one user configuration key and at least one binary value; determining at least one first value item based on at least one user configuration key.

[0044] As an example, a value item is the current definition of a key, which consists of a name, a data type, and an assigned value. A value item is included under the user name key, and the value assigned to this value item is a binary value. This binary value is consistent with the key name of a user configuration key. Therefore, the corresponding user configuration key can be found according to the binary value, and the user configuration key includes the first value item.

[0045] like Figure 3-2The following table shows all the user information of the current terminal. All the user information on the current terminal is saved in the registry path "\REGISTRY\MACHINE\SAM\SAM\DOMAINS\Account\Users\". When a new user is created, a user name key corresponding to the user will be created in this path. The default value item stores a binary value item called "Rid", and the data type of the value item corresponds to the user configuration key above. Filtering the user configuration key can accurately determine whether the current user is created or deleted.

[0046] There are multiple value items in the user configuration key. We are more concerned about the first value item, such as the "F" value. This value stores some key configuration information of the corresponding user. The value is an undocumented structure. By filtering this value in each key value under the above path, you can intercept and filter the deactivation, login, and password modification events of the corresponding account. The detailed structure information is as follows:

[0047]

[0048]

[0049] Figure 2 Flowcharts of other embodiments of the present invention based on registry protection. Figure 2 As shown, the protection method based on the registry of the embodiment of the present invention includes:

[0050] S201, in response to detecting a grouping event, determining a second registration table according to a preset second target path, the second registration table including at least one group name key and at least one corresponding group configuration key, the group configuration key including a second value item, and the second value item storing group configuration information.

[0051] In some embodiments, the second registry user manages the grouping of user accounts. The grouping indicates the user's permissions when the user account already exists, for example, the administrator group has the highest permissions, and the ordinary user group has some specific restricted permissions. The grouping event, that is, the event of intercepting the account grouping, can be another interception point different from the interception point of the account event.

[0052] As an example, the name of the group name key (or group name folder) is the name of the group, and the group configuration key (or group configuration folder) corresponding to the group name key includes the information of the group (that is, the second value item stores the user's configuration information).

[0053] As an example, the user configuration key includes at least one value item, the at least one value item includes a default value item, and the grouping information stored in each value item may be different.

[0054] As an example, group configuration information, such as the time when the user joined the group, the time when the user was created, the permissions of the group, etc. A group includes at least one user, or may not include any user. Users in the group have the permissions set by the group. For example, if user A and user B are in the administrator group, user A and user B have the administrator permissions. For example, if user C and user D are in the general group, user C and user D have general permissions.

[0055] S202: Determine at least one second value item according to at least one group name key in the second registration table.

[0056] In some embodiments, the group name key and the group configuration key correspond to each other, and the group configuration key includes a second value item. Therefore, the group name key can be determined first, and then the group configuration key can be determined according to the corresponding relationship, and then the second value item can be determined.

[0057] S203, matching the group configuration information to be stored in the determined second value item with the second preset rule respectively, and if the match is successful, intercepting or alarming the group event corresponding to the group configuration information that is successfully matched.

[0058] In some embodiments, the second preset rule may be a preset threshold, a keyword, or a regular expression, and the second preset rule is used to match illegal grouping events from the grouping configuration information. If the match is successful, the illegal grouping event corresponding to the successfully matched grouping configuration information is intercepted or an alarm is issued. As an example, if a user account that is promoted from an ordinary user to an administrator is suddenly added to the matched group account, the user account may be intercepted and an alarm may be issued according to the rule.

[0059] The registry-based protection method provided by the embodiment of the present invention intercepts the registry, thereby achieving the goal of not injecting into any process, being safe and stable, and not requiring any subsequent maintenance, and not requiring any Hooking of the kernel. It can synchronously perceive manual (non-Api call) modification of account information. It has high execution efficiency and almost no performance loss to the operating system. It has good compatibility.

[0060] In some optional implementations, at least one group name key includes at least one corresponding binary value, the at least one binary value corresponds to the key name of at least one group configuration key, and at least one second value item is determined based on the at least one group name key, including: determining at least one group configuration key based on the key name of at least one group configuration key and at least one binary value; determining at least one second value item based on at least one group configuration key.

[0061] As an example, a value item is the current definition of a key, which consists of a name, a data type, and an assigned value. A value item is included under the group name key, and the value assigned to this value item is a binary value. This binary value is consistent with the key name of a group configuration key. Therefore, the corresponding group configuration key can be found according to the binary value, and the group configuration key includes the second value item.

[0062] In some optional implementations, the user configuration information and the group configuration information are stored in the form of structures.

[0063] A structure is a data set consisting of a series of data of the same or different types (a data set, such as user configuration information and group configuration information). In C language, a structure refers to a data structure, which is a type of aggregate data type in C language. A structure can be declared as a variable, pointer, or array, etc., to implement a more complex data structure. A structure is also a collection of some elements, which are called members of the structure. These members can be of different types and are generally accessed by name. Although the structure is an undocumented structure, it has good versatility and does not require post-maintenance in the long run.

[0064] The application scenarios of the present invention may be one or more of the following:

[0065] The Security Accounts Manager (SAM) database contains the defined local users and groups, their passwords and other properties. On a domain controller, SAM does not store domain-defined users, but rather the system's administrator recovery account definitions and passwords. The database is stored in the registry under HKLM\SAM;

[0066] Interactive logon manager user mode process (such as Winlogon is a component of the Microsoft Windows operating system =), responsible for responding to SAS (Security attention sequence, designed to ensure that users can log on safely) and managing interactive logon sessions. For example, when a user logs on, Winlogon creates the user's first process;

[0067] A user-mode process (Logon user interface, or LogonUI), which provides a user interface to users that they can use to authenticate themselves to the system;

[0068] The Local Security Authority subsystem (LSASS) is responsible for local system security policy (such as which users are allowed to log on to the computer, password policy, permissions granted to users and groups, and system security audit settings), user authentication, and sending security audit messages to the event log.

[0069] like Figure 3-3 The current registry terminal account grouping information is shown. The grouping information of all accounts on the current terminal is saved in the registry path "\REGISTRY\MACHINE\SAM\SAM\Domains\Builtin\Aliases\". When a new group is created, a group name key corresponding to the group will be created under this path. The data type saved in the default value item corresponds to the group configuration key above.

[0070] There is a "C" value item under the group configuration key, which is the second value item. An undocumented structure is also stored inside the "C" value item. This structure mainly describes the name of the group and which accounts belong to the current group. By filtering this value item, account grouping events can be intercepted. The undocumented structure is as follows:

[0071]

[0072]

[0073] Figure 4 FIG. 1 is a schematic diagram of the structure of an embodiment of a protection device based on a registry of the present invention. Figure 4 As shown, the device 400 comprises:

[0074] A first processing module 401 is used to determine a first registration table according to a preset first target path in response to detecting that an account event has occurred, wherein the first registration table includes at least one user name key and at least one corresponding user configuration key, wherein the user configuration key includes a first value item, and the first value item stores user configuration information;

[0075] A second processing module 402, configured to determine at least one first value item according to at least one user name key in the first registration table;

[0076] The third processing module 403 is used to match the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercept or alarm the account event corresponding to the successfully matched user configuration information.

[0077] Optionally, the first processing module 401 is further configured to:

[0078] In response to detecting a user account creation, deletion, password modification, deactivation, or login.

[0079] Optionally, at least one user name key includes at least one corresponding binary value, the at least one binary value corresponds to the key name of at least one user configuration key, and

[0080] The second processing module 402 is further used for:

[0081] determining at least one user configuration key according to a key name of the at least one user configuration key and at least one binary value;

[0082] At least one first value item is determined based on at least one user configuration key.

[0083] Optionally, the apparatus 400 further includes:

[0084] The fourth processing module 404 is used to determine, in response to detecting the occurrence of a grouping event, a second registration table according to a preset second target path, the second registration table including at least one group name key and at least one corresponding group configuration key, the group configuration key including a second value item, and the second value item storing group configuration information; determine at least one second value item according to at least one group name key in the second registration table; match the group configuration information to be stored in the determined second value item with the second preset rule respectively, and if the match is successful, intercept or alarm the grouping event corresponding to the successfully matched group configuration information.

[0085] Optionally, at least one group name key includes at least one corresponding binary value, the at least one binary value corresponds to the key name of at least one group configuration key, and

[0086] The fourth processing module 404 is further configured to:

[0087] Determine at least one group configuration key according to a key name of the at least one group configuration key and at least one binary value;

[0088] At least one second value item is determined according to at least one grouping configuration key.

[0089] Optionally, the user configuration information and the group configuration information are stored in the form of structures.

[0090] Here is an example:

[0091] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502 and the memory 503 communicate with each other through the communication bus 504. The processor 501 may call the logic instructions in the memory 503 to execute the following method: in response to detecting the occurrence of an account event, a first registry is determined according to a preset first target path, the first registry includes at least one user name key and at least one corresponding user configuration key, the user configuration key includes a first value item, and the first value item stores the user's configuration information; at least one first value item is determined according to at least one user name key in the first registry; the user configuration information to be stored in the determined first value item is matched with the first preset rule respectively, and if the match is successful, the account event corresponding to the successfully matched user configuration information is intercepted or an alarm is issued.

[0092] In addition, the logic instructions in the above-mentioned memory 503 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0093] On the other hand, an embodiment of the present invention further provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, and when the program instructions are executed by a computer, the computer can execute the registry-based protection method provided by the above-mentioned embodiments, for example including: in response to detecting the occurrence of an account event, determining a first registry according to a preset first target path, the first registry including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, and the first value item storing the user's configuration information; determining at least one first value item according to at least one user name key in the first registry; matching the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepting or alarming the account event corresponding to the successfully matched user configuration information.

[0094] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the registry-based protection method provided by the above-mentioned embodiments, for example, including: in response to detecting the occurrence of an account event, determining a first registry according to a preset first target path, the first registry including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, and the first value item storing the user's configuration information; determining at least one first value item according to at least one user name key in the first registry; matching the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepting or alarming the account event corresponding to the successfully matched user configuration information.

[0095] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without paying creative labor.

[0096] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A protection method based on a registry, characterized in that: The method comprises: In response to detecting that an account event has occurred, determining a first registration table according to a preset first target path, the first registration table including at least one user name key and at least one corresponding user configuration key, the user configuration key including a first value item, and the first value item storing user configuration information; Determine at least one first value item according to at least one user name key in the first registry; Matching the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercepting or alerting the account event corresponding to the successfully matched user configuration information; The at least one user name key includes at least one corresponding binary value, the at least one binary value corresponding to the key name of the at least one user configuration key, and The determining at least one first value item according to at least one user name key comprises: Determining the at least one user configuration key according to a key name of the at least one user configuration key and the at least one binary value; At least one first value item is determined according to the at least one user configuration key.

2. The protection method based on the registry according to claim 1, characterized in that: The response to detecting that an account event occurs includes: In response to detecting a user account creation, deletion, password modification, deactivation, or login.

3. The protection method based on the registry according to claim 1, characterized in that: The method further comprises: In response to detecting that a grouping event occurs, determining a second registration table according to a preset second target path, the second registration table comprising at least one group name key and at least one corresponding group configuration key, the group configuration key comprising a second value item, and the second value item storing group configuration information; Determine at least one of the second value items according to at least one group name key in the second registration table; The group configuration information to be stored in the determined second value item is matched with the second preset rule respectively, and if the match is successful, the group event corresponding to the group configuration information that is successfully matched is intercepted or an alarm is issued.

4. The protection method based on the registry according to claim 3 is characterized in that: The at least one group name key includes at least one corresponding binary value, the at least one binary value corresponds to the key name of the at least one group configuration key, and The determining at least one second value item according to at least one group name key comprises: Determine the at least one group configuration key according to the key name of the at least one group configuration key and the at least one binary value; At least one second value item is determined according to the at least one group configuration key.

5. The protection method based on a registry according to any one of claims 1 or 3, characterized in that: The user configuration information and the group configuration information are stored in the form of structures.

6. A protection device based on a registry, characterized in that: The method comprises: A first processing module, configured to, in response to detecting that an account event has occurred, determine a first registration table according to a preset first target path, wherein the first registration table includes at least one user name key and at least one corresponding user configuration key, wherein the user configuration key includes a first value item, and the first value item stores user configuration information; A second processing module, configured to determine at least one first value item according to at least one user name key in the first registration table; A third processing module is used to match the user configuration information to be stored in the determined first value item with the first preset rule respectively, and if the match is successful, intercept or alarm the account event corresponding to the successfully matched user configuration information; The at least one user name key includes at least one corresponding binary value, the at least one binary value corresponding to the key name of the at least one user configuration key, and The second processing module is further used to: determine the at least one user configuration key according to the key name of the at least one user configuration key and the at least one binary value; and determine at least one first value item according to the at least one user configuration key.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the registry-based protection method as described in any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the registry-based protection method as described in any one of claims 1 to 5 are implemented.

9. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the registry-based protection method as described in any one of claims 1 to 5.

Images