Process behavior identification method, device, electronic device, storage medium and program

Abstract

The present invention provides a process behavior identification method, device, electronic device, storage medium, and program. The method includes: a target system function monitors a first local procedure call request sent by a target process, and when it is determined based on the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, it is determined that the target process is executing the behavior of adding a fileless backdoor; wherein the target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool. The process behavior identification method, device, electronic device, storage medium, and program provided by the present invention realize the identification of the behavior of adding a fileless backdoor by determining whether the local procedure call request sent by the target process calls the pre-specified first interface and first method, which is beneficial for preventing network risks.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a process behavior identification method, device, electronic device, storage medium and program. Background Art

[0002] A fileless backdoor means that the malicious code is not saved to disk but is directly loaded and executed in memory, thus bypassing file scanning by most security software.

[0003] The Windows Management Instrumentation (WMI) provided by the Windows operating system allows any process to add fileless backdoors to the operating system, increasing security risks for the computer operating system. Therefore, it is necessary to identify processes that add fileless backdoors to the operating system.

[0004] There is no method in the prior art for identifying a process that adds a fileless backdoor to an operating system. Summary of the Invention

[0005] In response to the problems existing in the prior art, the present invention provides a process behavior identification method, device, electronic device, storage medium and program.

[0006] The present invention provides a process behavior identification method, comprising:

[0007] The target system function monitors a first local procedure call request sent by a target process, and when it is determined according to the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, it is determined that the target process is executing an action of adding a fileless backdoor; wherein,

[0008] The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool.

[0009] According to a process behavior identification method provided by the present invention, the target system function is the NtAlpcSendWaitReceivePort function, the first interface is the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} in the Windows management tool, and the first method is the PutInstance method with identification number 14 in the IWbemServices interface.

[0010] According to a process behavior identification method provided by the present invention, the target system function monitors the first local procedure call request sent by the target process, including:

[0011] The monitoring function in the target function searches for the parameters of the first local procedure call request sent by the target process, and determines whether the parameters of the first local procedure call request include the identification number of the first interface and the identification number of the first method; when the parameters of the first local procedure call request include both the identification number of the first interface and the identification number of the first method, it is determined that the target process requests to call the first interface and the first method.

[0012] According to a process behavior identification method provided by the present invention, the monitoring function is a hook function.

[0013] According to a process behavior identification method provided by the present invention, after determining that the target process is executing the behavior of adding a fileless backdoor, the method further includes:

[0014] The legitimacy of the target process is determined, and when the target process is illegal, a first local procedure call request sent by the target process is intercepted.

[0015] According to a process behavior identification method provided by the present invention, before the step of monitoring the first local procedure call request sent by the target process by the target system function, the method further includes:

[0016] A monitoring function is set in the system function NtAlpcSendWaitReceivePort, which is used to monitor the behavior of calling the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the behavior of calling the PutInstance method with identification number 14 in the IWbemServices interface.

[0017] The present invention also provides a process behavior identification device, comprising:

[0018] A monitoring and determination module is configured to monitor a first local procedure call request sent by a target process by a target system function, and when it is determined based on the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, determine that the target process is executing an action of adding a fileless backdoor; wherein,

[0019] The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool.

[0020] According to a process behavior identification device provided by the present invention, the target system function is the NtAlpcSendWaitReceivePort function, the first interface is the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} in the Windows management tool, and the first method is the PutInstance method with identification number 14 in the IWbemServices interface.

[0021] According to a process behavior identification device provided by the present invention, the target system function monitors the first local procedure call request sent by the target process, including:

[0022] The monitoring function in the target function searches for the parameters of the first local procedure call request sent by the target process, and determines whether the parameters of the first local procedure call request include the identification number of the first interface and the identification number of the first method; when the parameters of the first local procedure call request include both the identification number of the first interface and the identification number of the first method, it is determined that the target process requests to call the first interface and the first method.

[0023] According to a process behavior identification device provided by the present invention, the monitoring function is a hook function.

[0024] According to a process behavior identification device provided by the present invention, the device further includes:

[0025] The judgment and interception module is used to judge the legitimacy of the target process, and when the target process is illegal, intercept the first local procedure call request sent by the target process.

[0026] According to a process behavior identification device provided by the present invention, the device further includes:

[0027] The monitoring function setting module is used to set a monitoring function in the system function NtAlpcSendWaitReceivePort, wherein the monitoring function is used to monitor the behavior of calling the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the behavior of monitoring the behavior of calling the PutInstance method with identification number 14 in the IWbemServices interface.

[0028] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above-described process behavior identification methods when executing the program.

[0029] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the above-described process behavior identification methods.

[0030] The present invention also provides a computer program product, which includes computer executable instructions, and when the instructions are executed, are used to implement the steps of any of the above-mentioned process behavior identification methods.

[0031] The process behavior identification method, device, electronic device, storage medium and program provided by the present invention realize the identification of the behavior of adding fileless backdoors by judging whether the local procedure call request sent by the target process calls a pre-specified first interface and first method, which is beneficial to preventing network risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 is a flow chart of the process behavior identification method of the present invention;

[0034] Figure 2 A schematic diagram of a process behavior identification device provided by the present invention;

[0035] Figure 3 This is a schematic structural diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0036] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0037] The following combination Figure 1-Figure 3The present invention describes a process behavior identification method, device, electronic device, storage medium and program.

[0038] WMI (Windows Management Instrumentation) is a set of interfaces for managing system resources provided by Microsoft Corporation of the United States. It has been built into the Windows system since Windows 2000 and supports common operations such as files, processes, services, and registry.

[0039] WMI provides a process with the ability to add a fileless backdoor to the operating system, allowing any process to do so through WMI, posing a security risk to the operating system.

[0040] The process behavior identification method provided by the present invention is used to identify the behavior of any process adding a fileless backdoor to the operating system through WMI.

[0041] Figure 1 Flowchart of the process behavior identification method of the present invention, as shown in FIG. Figure 1 As shown, the process behavior identification method of the present invention includes:

[0042] Step 101: The target system function monitors the first local procedure call request sent by the target process. When it is determined that the target process requests to call the first interface and the first method in the Windows management tool based on the first local procedure call request, it is determined that the target process is executing the behavior of adding a fileless backdoor.

[0043] In the present invention, the target system function is a system function pre-set with a monitoring function, the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool. In this embodiment, the monitoring function is a hook function.

[0044] The target process refers to the process whose behavior needs to be identified using the process behavior identification method provided by the present invention.

[0045] Local Procedure Call (LPC) is an inter-process communication method provided by the Windows NT kernel, which allows processes on the same computer to communicate with each other in a lightweight manner.

[0046] Since the interface identifier (GUID, Globally Unique Identifier) and the method identifier (Method ID) involved when the target process adds a fileless backdoor to the operating system are both stored in the LPC request data packet, the present invention needs to monitor the LPC requests sent by the target process.

[0047] The first local procedure call request refers to any local procedure call request sent by the target process.

[0048] In this embodiment, the target system function is the NtAlpcSendWaitReceivePort function in the Windows operating system, the first interface is the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} in the Windows management tool, and the first method is the PutInstance method with identification number 14 in the IWbemServices interface.

[0049] The NtAlpcSendWaitReceivePort function is a system function in the Windows operating system that sends and receives LPC packets or messages. Because LPC requests between all processes in the operating system pass through this function, setting a monitoring function on this function can retrieve the interface identifier and method identifier in the LPC request.

[0050] The IWbemServices interface, identified as {9556dc99-828c-11cf-a37e-00aa003240c7}, is a WMI interface in the Windows operating system. Any process that adds a fileless backdoor to the operating system through WMI must call this interface.

[0051] The PutInstance method with identification number 14 is the method involved when a process adds a fileless backdoor. This method will be called when any process adds a WMI fileless backdoor to the operating system.

[0052] The PutInstance method may also be called in other types of operations. Therefore, when determining whether the target process is performing the behavior of adding a fileless backdoor, it is necessary to meet the conditions of calling the IWbemServices interface and the PutInstance method at the same time.

[0053] Because the target system function is pre-set with a monitoring function, the monitoring function is used to search the parameters of the first local procedure call request sent by the target process to determine whether the parameters of the first local procedure call request contain the identification number of the first interface and the identification number of the first method. When the parameters of the first local procedure call request contain both the identification number of the first interface and the identification number of the first method, it is determined that the target process requests to call the first interface and the first method. Therefore, when the first local procedure call request sent by the target process contains the identifier of the first interface ({9556dc99-828c-11cf-a37e-00aa003240c7}) and the identifier of the first method (MethodID=14), it is possible to detect the target process's call to the first interface and the first method, thereby confirming that the target process is executing the action of adding a fileless backdoor to the operating system.

[0054] The process behavior identification method provided by the present invention realizes the identification of the behavior of adding fileless backdoors by judging whether the local procedure call request sent by the target process calls a pre-specified first interface and first method, which is beneficial to preventing network risks.

[0055] Based on any of the above embodiments, in this embodiment, after determining that the target process is executing the step of adding a fileless backdoor, the method further includes:

[0056] The legitimacy of the target process is determined, and when the target process is illegal, a first local procedure call request sent by the target process is intercepted.

[0057] Since not all processes adding fileless backdoors to the operating system are prohibited, the legitimacy of the target process itself needs to be judged in this step.

[0058] For example, the notepad.exe program is a standalone program that doesn't require external communication and lacks any WMI functionality. If a virus injects malicious code into the notepad.exe process, it could trigger the addition of a fileless backdoor via WMI. Since the notepad.exe process itself theoretically lacks the ability to add a fileless backdoor via WMI, it is considered highly suspicious and illegal.

[0059] Based on the legitimacy determination, if the target process itself is illegal, the target process's act of adding a fileless backdoor to the operating system is deemed illegal, and the first local procedure call request sent by the target process is intercepted. If the target process itself is legal, the target process's act of adding a fileless backdoor to the operating system is deemed legal, and the first local procedure call request sent by the target process is allowed.

[0060] The process behavior identification method provided by the present invention realizes the identification of the behavior of adding a fileless backdoor by judging whether the local procedure call request sent by the target process calls a pre-specified first interface and first method, and then determines the legitimacy of the first local procedure call request based on the legitimacy of the target process itself, thereby reducing network security risks.

[0061] Based on any of the above embodiments, in this embodiment, before the step of the target system function monitoring the first local procedure call request sent by the target process, the method further includes:

[0062] A monitoring function is set in the system function NtAlpcSendWaitReceivePort, which is used to monitor the behavior of calling the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the behavior of calling the PutInstance method with identification number 14 in the IWbemServices interface.

[0063] The IWbemServices interface, identified as {9556dc99-828c-11cf-a37e-00aa003240c7}, is a WMI interface in the Windows operating system. Any process that adds a fileless backdoor to the operating system through WMI must call this interface.

[0064] The PutInstance method with identification number 14 is the method involved when a process adds a fileless backdoor. This method will be called when any process adds a WMI fileless backdoor to the operating system.

[0065] Therefore, by setting the monitoring function, it is possible to promptly discover the behavior of the target process adding a fileless backdoor to the operating system.

[0066] The process behavior identification method provided by the present invention can detect the behavior of a process calling the IWbemServices interface with the identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the PutInstance method with the identification number 14 by setting a monitoring function, thereby realizing the identification of the behavior of adding a fileless backdoor, which is beneficial to preventing network risks.

[0067] The process behavior identification device provided by the present invention is described below. The process behavior identification device described below and the process behavior identification method described above can be referenced to each other.

[0068] Figure 2 A schematic diagram of a process behavior identification device provided by the present invention is shown as follows: Figure 2 As shown, the process behavior identification device provided by the present invention includes:

[0069] The monitoring and determining module 201 is configured to monitor a first local procedure call request sent by a target process by a target system function, and when it is determined according to the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, determine that the target process is executing an action of adding a fileless backdoor; wherein,

[0070] The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool.

[0071] In this embodiment, the target system function is the NtAlpcSendWaitReceivePort function, the first interface is the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} in the Windows Management Instrumentation, and the first method is the PutInstance method with identification number 14 in the IWbemServices interface.

[0072] The NtAlpcSendWaitReceivePort function is a system function in the Windows operating system that sends and receives LPC packets or messages. Because LPC requests between all processes in the operating system pass through this function, setting a monitoring function on this function is necessary to obtain the interface identifier and method identifier in the LPC request.

[0073] The IWbemServices interface, identified as {9556dc99-828c-11cf-a37e-00aa003240c7}, is a WMI interface in the Windows operating system. Any process that adds a fileless backdoor to the operating system through WMI must call this interface.

[0074] The PutInstance method with identification number 14 is the method involved when a process adds a fileless backdoor. This method will be called when any process adds a WMI fileless backdoor to the operating system.

[0075] The PutInstance method may also be called in other types of operations. Therefore, when determining whether the target process is performing the behavior of adding a fileless backdoor, it is necessary to meet the conditions of calling the IWbemServices interface and the PutInstance method at the same time.

[0076] Since the target system function has a monitoring function pre-set, which is used to monitor the behavior of calling the first interface and the first method, when the first local procedure call request sent by the target process contains the identifier of the first interface ({9556dc99-828c-11cf-a37e-00aa003240c7}) and the identifier of the first method (MethodID=14), the target process's call to the first interface and the first method can be discovered, thereby confirming that the target process is executing the behavior of adding a fileless backdoor to the operating system.

[0077] The process behavior identification device provided by the present invention realizes the identification of the behavior of adding fileless backdoors by judging whether the local procedure call request sent by the target process calls a pre-specified first interface and first method, which is beneficial to preventing network risks.

[0078] Based on any of the foregoing embodiments, in this embodiment, the target system function monitoring the first local procedure call request sent by the target process includes:

[0079] The monitoring function in the target function searches for the parameters of the first local procedure call request sent by the target process, and determines whether the parameters of the first local procedure call request include the identification number of the first interface and the identification number of the first method; when the parameters of the first local procedure call request include both the identification number of the first interface and the identification number of the first method, it is determined that the target process requests to call the first interface and the first method.

[0080] The process behavior identification device provided by the present invention realizes the identification of the behavior of adding fileless backdoors by judging whether the local procedure call request sent by the target process calls a pre-specified first interface and first method, which is beneficial to preventing network risks.

[0081] Based on any of the above embodiments, in this embodiment, the device further includes:

[0082] The judgment and interception module is used to judge the legitimacy of the target process, and when the target process is illegal, intercept the first local procedure call request sent by the target process.

[0083] The process behavior identification device provided by the present invention realizes the identification of the behavior of adding fileless backdoors by judging whether the local procedure call request sent by the target process calls a pre-specified first interface and first method, and then determines the legitimacy of the first local procedure call request based on the legitimacy of the target process itself, thereby reducing network security risks.

[0084] Based on any of the above embodiments, in this embodiment, the device further includes:

[0085] The monitoring function setting module is used to set a monitoring function in the system function NtAlpcSendWaitReceivePort, wherein the monitoring function is used to monitor the behavior of calling the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the behavior of monitoring the behavior of calling the PutInstance method with identification number 14 in the IWbemServices interface.

[0086] The process behavior identification device provided by the present invention can detect the behavior of a process calling the IWbemServices interface with the identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the PutInstance method with the identification number 14 by setting a monitoring function, thereby realizing the identification of the behavior of adding a fileless backdoor, which is beneficial to preventing network risks.

[0087] Figure 3 A schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 3As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the process behavior identification method, which includes:

[0088] The target system function monitors a first local procedure call request sent by a target process, and when it is determined according to the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, it is determined that the target process is executing an action of adding a fileless backdoor; wherein,

[0089] The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool.

[0090] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0091] On the other hand, the present invention further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer, the computer is capable of performing the process behavior identification method provided by the above methods, the method comprising:

[0092] The target system function monitors a first local procedure call request sent by a target process, and when it is determined according to the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, it is determined that the target process is executing an action of adding a fileless backdoor; wherein,

[0093] The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool.

[0094] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the above-mentioned process behavior identification method, the method comprising:

[0095] The target system function monitors a first local procedure call request sent by a target process, and when it is determined according to the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, it is determined that the target process is executing an action of adding a fileless backdoor; wherein,

[0096] The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool.

[0097] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0098] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A process behavior identification method, characterized in that: include: The target system function monitors a first local procedure call request sent by a target process, and when it is determined according to the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, it is determined that the target process is executing an action of adding a fileless backdoor; wherein, The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool; The target system function monitors the first local procedure call request sent by the target process, including: The monitoring function in the target system function searches for the parameters of the first local procedure call request sent by the target process, and determines whether the parameters of the first local procedure call request include the identification number of the first interface and the identification number of the first method; when the parameters of the first local procedure call request include both the identification number of the first interface and the identification number of the first method, it is determined that the target process requests to call the first interface and the first method.

2. The process behavior identification method according to claim 1, characterized in that: The target system function is the NtAlpcSendWaitReceivePort function, the first interface is the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} in the Windows management tool, and the first method is the PutInstance method with identification number 14 in the IWbemServices interface.

3. The process behavior identification method according to claim 1, characterized in that: The monitoring function is a hook function.

4. The process behavior identification method according to any one of claims 1 to 3, characterized in that: After determining that the target process is executing the step of adding a fileless backdoor, the method further includes: The legitimacy of the target process is determined, and when the target process is illegal, a first local procedure call request sent by the target process is intercepted.

5. The process behavior identification method according to claim 2, characterized in that: Before the step of monitoring the first local procedure call request sent by the target process by the target system function, the method further includes: A monitoring function is set in the system function NtAlpcSendWaitReceivePort, which is used to monitor the behavior of calling the IWbemServices interface with identification number {9556dc99-828c-11cf-a37e-00aa003240c7} and the behavior of calling the PutInstance method with identification number 14 in the IWbemServices interface.

6. A process behavior identification device, characterized in that: include: A monitoring and determination module is configured to monitor a first local procedure call request sent by a target process by a target system function, and when it is determined based on the first local procedure call request that the target process requests to call a first interface and a first method in a Windows management tool, determine that the target process is executing an action of adding a fileless backdoor; wherein, The target system function is a system function pre-set with a monitoring function, and the monitoring function is used to monitor the behavior of calling the first interface and the first method in the Windows management tool; The target system function monitors the first local procedure call request sent by the target process, including: The monitoring function in the target system function searches for the parameters of the first local procedure call request sent by the target process, and determines whether the parameters of the first local procedure call request include the identification number of the first interface and the identification number of the first method; when the parameters of the first local procedure call request include both the identification number of the first interface and the identification number of the first method, it is determined that the target process requests to call the first interface and the first method.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the process behavior identification method according to any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the process behavior identification method according to any one of claims 1 to 5 are implemented.

9. A computer program product comprising computer-executable instructions, characterized in that: When executed, the instruction is used to implement the steps of the process behavior identification method according to any one of claims 1 to 5.

Images