Process whitelist detection method, apparatus, and related device

Abstract

The application discloses a program white list detection method and device and related equipment. The method comprises the following steps: when a program file is opened, it is judged whether the program file exists in a high-frequency program white list which is established in advance, wherein the high-frequency program white list comprises running information and a plurality of program files; when it is determined that the program file exists in the high-frequency program white list which is established in advance, the running information of the program file in the high-frequency program white list is acquired; and according to the running information of the program file in the high-frequency program white list, it is determined that the program file is a program white list. Through the running information of the program file, the efficient detection of the program white list can be realized, and the performance problems caused by the starting and executing processes of the operating system and the application program are effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of nuclear power, and in particular to a program whitelist detection method and device, electronic equipment and computer readable storage medium. BACKGROUND

[0002] In the related art, during the starting process of a system program or an application program, the program whitelist detection reads the file content of the complete system program and application program and calculates the hash value, which will lose the advantage of executing program segment loading to the memory, thereby affecting the performance of the operating system and business. Therefore, how to better implement the detection of the program whitelist has become a problem to be solved. SUMMARY

[0003] The purpose of the present application is to at least solve one of the technical problems in the related art to some extent.

[0004] To this end, the first purpose of the present application is to propose a program whitelist detection method. The method can realize efficient detection of the program whitelist through the running information of the program file, and effectively solve the performance problems caused by the starting and execution process of the operating system and the application program.

[0005] The second purpose of the present application is to propose a program whitelist detection device.

[0006] The third purpose of the present application is to propose an electronic equipment.

[0007] The fourth purpose of the present application is to propose a computer readable storage medium.

[0008] To achieve the above purpose, the first aspect of the present application proposes a program whitelist detection method, which comprises: detecting the opening of a program file, and judging whether the program file exists in a pre-established high-frequency program whitelist list, wherein the high-frequency program whitelist list comprises running information and a plurality of program files; when it is determined that the program file exists in the pre-established high-frequency program whitelist list, obtaining the running information of the program file in the high-frequency program whitelist list; and determining the program file as a program whitelist according to the running information of the program file in the high-frequency program whitelist list.

[0009] According to the program whitelist detection method of the embodiment of the present application, when a program file is opened, it is determined whether the program file exists in a pre-established high-frequency program whitelist list, wherein the high-frequency program whitelist list comprises running information and a plurality of program files, and then when it is determined that the program file exists in the pre-established high-frequency program whitelist list, the running information of the program file in the high-frequency program whitelist list is obtained, and then according to the running information of the program file in the high-frequency program whitelist list, it is determined that the program file is a program whitelist. The method can realize efficient detection of the program whitelist through the running information of the program file, and effectively solve the performance problems caused by the starting and executing processes of the operating system and the application program.

[0010] According to an embodiment of the present application, the pre-established high-frequency program whitelist list comprises: obtaining a program whitelist library in a secure running environment; and generating the high-frequency program whitelist list from the program whitelist library in the secure running environment according to a running module list.

[0011] According to an embodiment of the present application, the running module list comprises a running program file, and the generating of the high-frequency program whitelist list from the program whitelist library in the secure running environment according to the running module list comprises: traversing attribute information of the running program file to generate the high-frequency program whitelist list.

[0012] According to an embodiment of the present application, the running information comprises a modification flag, and the method further comprises: when detecting modification of the attribute information of the running file, updating the modification flag of the high-frequency program whitelist list.

[0013] According to an embodiment of the present application, when it is determined that the program file exists in the pre-established high-frequency program whitelist list, the obtaining of the running information of the program file in the high-frequency program whitelist list comprises: when it is determined that the program file exists in the pre-established high-frequency program whitelist list, determining whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list; if yes, determining whether the running information is set in the program file in the high-frequency program whitelist list; if yes, obtaining the running information of the program file in the high-frequency program whitelist list.

[0014] According to an embodiment of the present application, the method further comprises: if no, calculating a first hash value of the program file and determining whether the first hash value is consistent with a second hash value of the program file in the high-frequency program whitelist list; and when it is determined that the first hash value is not consistent with the second hash value, updating the running information of the program file in the high-frequency program whitelist list.

[0015] According to one embodiment of the present application, the determining the program file as a program whitelist according to the running information of the program file in the high-frequency program whitelist list comprises: determining the program file as a program whitelist when the running information of the program file in the high-frequency program whitelist list is not modified.

[0016] According to one embodiment of the present application, the running information comprises the access times, and the method further comprises: updating the access times of the program file in the high-frequency program whitelist list when the program file exists in the high-frequency program whitelist list.

[0017] To achieve the above object, the second aspect of the present application provides a program whitelist detection device, which comprises: a judging module, configured to detect whether a program file exists in a high-frequency program whitelist list when the program file is opened, wherein the high-frequency program whitelist list comprises running information and a plurality of program files; an obtaining module, configured to obtain the running information of the program file in the high-frequency program whitelist list when the program file exists in the high-frequency program whitelist list; and a determining module, configured to determine the program file as a program whitelist according to the running information of the program file in the high-frequency program whitelist list.

[0018] The program whitelist detection device according to the embodiments of the present application can detect whether a program file exists in a high-frequency program whitelist list when the program file is opened, wherein the high-frequency program whitelist list comprises running information and a plurality of program files, then obtain the running information of the program file in the high-frequency program whitelist list when the program file exists in the high-frequency program whitelist list, and finally determine the program file as a program whitelist according to the running information of the program file in the high-frequency program whitelist list. Thus, the efficient detection of the program whitelist can be realized through the running information of the program file, and the performance problems caused by the starting and executing of the operating system and the application program can be effectively solved.

[0019] To achieve the above object, the third aspect of the present application provides an electronic device, which comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the program whitelist detection method according to the first aspect of the present application.

[0020] To achieve the above object, the fourth aspect of the present application provides a computer readable storage medium, wherein the computer program is executable on a processor to implement the program whitelist detection method according to the first aspect of the present application.

[0021] Additional aspects and advantages of the present application will be made apparent by the following description and the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0022] The above and / or additional aspects and advantages of the present application will become apparent and be more readily understood through consideration of the following description, taken in conjunction with the accompanying drawings, in which:

[0023] Figure 1 is a flowchart of a program whitelist detection method according to an embodiment of the present application;

[0024] Figure 2 is a flowchart of a program whitelist detection method according to an embodiment of the present application;

[0025] Figure 3 is a flowchart of a program whitelist detection method according to an embodiment of the present application;

[0026] Figure 4 is a structural schematic diagram of a program whitelist detection device according to an embodiment of the present application;

[0027] Figure 5 is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] Embodiments of the present application are described in detail below with reference to the accompanying drawings. The same or similar components are denoted by the same or similar reference numerals throughout the drawings, and repeated description thereof will be omitted. The embodiments described below are examples for explaining the present application and are not intended to be limiting of the present application.

[0029] In the related art, in the process of starting a system program or an application program, a program whitelist detection reads file contents of the complete system program and the application program and calculates a hash value, which loses the advantage of executing program segment loading to the memory, thereby affecting the performance of the operating system and the business. Therefore, how to better implement the detection of the program whitelist becomes a problem to be solved urgently.

[0030] To this end, the present application provides a program whitelist detection method, device, electronic device and computer readable storage medium.

[0031] Figure 1is a flow chart of a program whitelist detection method according to an embodiment of the present application. It should be noted that the program whitelist detection method of the embodiment of the present application can be applied to the program whitelist detection device of the embodiment of the present application, which can be configured on an electronic device. In the embodiment of the present application, the electronic device can be a PC or a mobile terminal (such as a mobile phone, a tablet computer, a PAD, a personal digital assistant, and the like, which are hardware devices with various operating systems).

[0032] As shown in Figure 1 , the program whitelist detection method comprises the following steps.

[0033] S110, detecting that a program file is opened, and determining whether the program file exists in a pre-established high-frequency program whitelist list, wherein the high-frequency program whitelist list comprises running information and a plurality of program files.

[0034] In the embodiment of the present application, when a system program or an application program is started, the electronic device can detect whether a program file is opened, and when it is detected that the program file is opened in an execution mode, it can further determine whether the program file exists in a pre-established high-frequency program whitelist list. The implementation process of the pre-established high-frequency program whitelist list can refer to the subsequent embodiments.

[0035] The high-frequency program whitelist list comprises running information and a plurality of program files.

[0036] The running information comprises, but is not limited to, a path name, an access frequency, and a modification flag.

[0037] For example, whether the program file exists in the pre-established high-frequency program whitelist list can be determined by the name of the program file. For example, when the program file A is detected to be opened, it can be determined whether the program file A exists in the pre-established high-frequency program whitelist list.

[0038] S120, when it is determined that the program file exists in the pre-established high-frequency program whitelist list, obtaining the running information of the program file in the high-frequency program whitelist list.

[0039] For example, when it is determined that the program file exists in the pre-established high-frequency program whitelist list, the modification flag of the program file in the high-frequency program whitelist list is obtained.

[0040] S130, determining that the program file is a program whitelist according to the running information of the program file in the high-frequency program whitelist list.

[0041] In an embodiment of the present application, when the modification flag of the program file in the high-frequency program whitelist list is obtained, it can be determined whether the modification flag is modified, and when it is determined that the modification flag is not modified, it is determined that the program file is a program whitelist.

[0042] According to the program whitelist detection method provided in the embodiments of the present application, when a program file is opened, it is determined whether the program file exists in a high-frequency program whitelist list established in advance, wherein the high-frequency program whitelist list comprises running information and a plurality of program files, and then when it is determined that the program file exists in the high-frequency program whitelist list established in advance, the running information of the program file in the high-frequency program whitelist list is acquired, and then according to the running information of the program file in the high-frequency program whitelist list, it is determined that the program file is a program whitelist. The method can realize efficient detection of the program whitelist through the running information of the program file, and effectively solve the performance problems caused by the starting and executing processes of the operating system and the application program.

[0043] In order for those skilled in the art to more easily understand the present application, Figure 2 is a flowchart of the program whitelist detection method according to one specific embodiment of the present application, as Figure 2 shown, the program whitelist detection method can comprise:

[0044] S210, when a program file is opened, it is determined whether the program file exists in a high-frequency program whitelist list established in advance, wherein the high-frequency program whitelist list comprises running information and a plurality of program files.

[0045] In the embodiments of the present application, the high-frequency program whitelist list established in advance comprises: acquiring a program whitelist library in a secure running environment, and generating a high-frequency program whitelist list from the program whitelist library in the secure running environment according to a running module list.

[0046] For example, a virus killing APP can be installed on the central control machine device, and a secure operating system running environment can be generated after being scanned by the virus killing APP, and then a program whitelist library in the current secure running environment is scanned and generated, and the program whitelist library in the secure running environment is acquired as the latest program whitelist library.

[0047] For example, the central control machine device can be understood as a host running various industrial control software in an industrial control environment, including operator stations, engineer stations, etc. The program whitelist can be understood as a program identified as safe and allowed to run on the industrial control host.

[0048] For example, after the program whitelist library in the secure running environment is acquired, the latest program whitelist library acquired can be generated into a high-frequency program whitelist list through a running module list.

[0049] The running module list comprises running program files, and correspondingly, the attribute information of the running program files can be traversed to generate the high-frequency program whitelist list.

[0050] The attribute information of the program file can be understood as a file storage structure information table of an operating system for managing a disk, which is actually a structure information stored on a file system disk, such as Ext4 of Linux or NTFS of Windows.

[0051] The attribute information of the program file includes, but is not limited to, length, modification time, stored disk information, and the like.

[0052] S220, when it is determined that the program file exists in the pre-established high-frequency program whitelist list, it is determined whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list. If yes, S230 is executed, and if no, S280 is executed.

[0053] In an embodiment of the present application, when it is determined that the program file exists in the pre-established high-frequency program whitelist list, it is necessary to first determine whether the modification time and the length of the program file are consistent with the modification time and the length of the program file in the high-frequency program whitelist list. That is, it is determined whether the modification time and the length of the program file are changed.

[0054] In an embodiment of the present application, the running information further includes the access times. Correspondingly, when it is determined that the program file exists in the pre-established high-frequency program whitelist list, the access times of the program file in the high-frequency program whitelist list are updated. Since many common program startup processes will open some common dynamic libraries, and each opening needs to verify the legality of the dynamic library, the present application can reduce the number of program hash calculations through the high-frequency program whitelist list, thereby improving the performance.

[0055] In an embodiment of the present application, when it is necessary to read the PF file generated by the super preload function of the operating system, the high-frequency execution program file and the access times are obtained through the PF file.

[0056] The super preload can be understood as monitoring the data exchange status of memory pages, swap files and other files on the hard disk when the system and application programs are started. When data exchange occurs, for example, A system records the hard disk files that need to be read frequently when each program runs, and records the reading situation in the PF suffix name file in the \A system\Prefetch directory.

[0057] The running information includes a modification mark, access times, a path name, and the like.

[0058] That is, the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list, that is, the modification time and length of the program file have not changed, and it is further determined whether the running information of the program file in the high-frequency program whitelist list is set.

[0059] For example, taking the running information as the modification mark as an example, it is determined whether the modification mark of the program file in the high-frequency program whitelist list is set.

[0060] S240, the running information of the program file in the high-frequency program whitelist list is set, the running information of the program file in the high-frequency program whitelist list is obtained, and it is determined whether the running information of the program file in the high-frequency program whitelist list is modified.

[0061] For example, the file filtering and disk filtering driver can be used to detect whether the program whitelist file content is modified.

[0062] For example, taking the running information as the modification mark as an example, it is determined whether the modification mark of the program file in the high-frequency program whitelist list is set.

[0063] In an embodiment of the present application, when it is determined that the running information of the program file in the high-frequency program whitelist list is modified, it is determined that the program file is not a program whitelist.

[0064] S250, the running information of the program file in the high-frequency program whitelist list is not modified, and it is determined that the program file is a program whitelist.

[0065] In an embodiment of the present application, the running information of the program file in the high-frequency program whitelist list is obtained, it is determined that the running information of the program file in the high-frequency program whitelist list is not modified, and it is determined that the program file is a program whitelist.

[0066] For example, taking the running information as the modification mark as an example, the modification mark of the program file in the high-frequency program whitelist list is obtained, it is determined whether the modification mark of the program file in the high-frequency program whitelist list is modified, and if it is determined that the modification mark is not modified, it is determined that the program file is a program whitelist.

[0067] S260, the running information of the program file in the high-frequency program whitelist list is not set, the first hash value of the program file is calculated, and it is determined whether the first hash value is consistent with the second hash value of the program file in the high-frequency program whitelist list.

[0068] For example, taking the running information as the modification mark as an example, when the program file is not set with the modification mark in the high-frequency program whitelist list, the first hash value of the program file is calculated, and the first hash value is compared with the second hash value of the program file in the high-frequency program whitelist list to determine whether the first hash value is consistent with the second hash value.

[0069] For example, the first hash value of the program file can be calculated by using the MD5 (Message Digest Algorithm MD5, message digest algorithm) algorithm.

[0070] S270, when the first hash value is determined to be inconsistent with the second hash value, the running information of the program file in the high-frequency program whitelist list is updated.

[0071] That is, when the first hash value is determined to be inconsistent with the second hash value, it is indicated that the program file has been changed, and the modification mark of the program file in the high-frequency program whitelist list is updated, and at this time, the program file is not the program whitelist.

[0072] In an embodiment of the present application, when the first hash value is determined to be consistent with the second hash value, it is determined that the program file is the program whitelist.

[0073] For example, when the first hash value is determined to be consistent with the second hash value, it is indicated that the modification mark of the program file in the high-frequency program whitelist list is not modified, and the modification mark is set to 0, and at this time, it is determined that the program file is the program whitelist.

[0074] S280, when the attribute information of the program file is inconsistent with the attribute information of the program file in the high-frequency program whitelist list, it is determined that the program file is not the program whitelist.

[0075] In a specific embodiment of the present application, as shown in Figure 3 The detection method of the program whitelist can be completed by three components, wherein the detection method of the program whitelist includes a program whitelist management component, a program whitelist change detection component and a program whitelist control component.

[0076] The program whitelist management component is used to maintain the program whitelist library and the high-frequency program whitelist list, the program whitelist change detection component is used to monitor whether the program file is modified and update the modification mark of the high-frequency program whitelist list in real time, and the program whitelist control component is used for the detection of the program whitelist in the program file startup process and the control according to the detection result.

[0077] Specifically, the program whitelist management component includes an application layer and a driver layer, for example, after the sub-module of the driver layer of the program whitelist management component is started, the program whitelist change detection component is automatically started, and the program whitelist library and the high-frequency program whitelist list are loaded; the application layer of the program whitelist management component re-establishes the program whitelist library and the high-frequency program whitelist list, and notifies the driver layer in the program whitelist management component; the driver layer of the program whitelist management component reads the program whitelist library and the high-frequency program whitelist list into the memory, then checks whether the file of the high-frequency program whitelist list is modified, and updates the high-frequency program whitelist list according to the checking result.

[0078] The program whitelist change detection component monitors the change of the program file in real time, and if the program file exists in the high-frequency program whitelist list, the "modification mark" of the updated file is refreshed.

[0079] The program whitelist control component monitors the running of the executed program file in real time, and if the running program file is stored in the high-frequency program whitelist list, the length and the modification time of the executed program file are preliminarily detected, if the length and the modification time of the program file do not change, the program file is determined to be the program whitelist; if the length and the modification time of the executed program change, it is further judged whether the "modification mark" of the executed program file in the high-frequency program whitelist list is set, and whether the "modification mark" is modified, if not, the program file is determined to be the program whitelist, if modified, the hash value of the executed program file is calculated, and it is judged whether the hash value is consistent with the hash value of the executed program file in the high-frequency program whitelist list, if not, the "modification mark" of the program file in the high-frequency program whitelist list is updated, if yes, the executed program file is determined to be the program whitelist.

[0080] According to the program whitelist detection method of the embodiment of the present application, when the program file is opened, by judging that the program file exists in the high-frequency program whitelist list established in advance, it can be further judged whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list, and when it is determined to be consistent, it is further judged whether the running information of the program file in the high-frequency program whitelist list is set, and when it is determined to exist, by judging that the running information is not modified, the program file is determined to be the program whitelist. The method realizes efficient detection of the program whitelist by judging whether the running information of the program file is modified, and effectively solves the performance problems caused by the starting and executing process of the operating system and the application program.

[0081] Corresponding to the program whitelist detection methods provided in the above embodiments, an embodiment of this application also provides a program whitelist detection device. Since the program whitelist detection device provided in this embodiment corresponds to the program whitelist detection methods provided in the above embodiments, the implementation methods of the program whitelist detection methods are also applicable to the program whitelist detection device provided in this embodiment, and will not be described in detail in this embodiment. Figure 3 This is a schematic diagram of the structure of a program whitelist detection device according to an embodiment of this application.

[0082] like Figure 4 As shown, the detection device 400 for the program whitelist may include: a judgment module 410, an acquisition module 420, and a determination module 430.

[0083] Specifically, the judgment module 410 is used to determine whether the program file exists in a pre-established high-frequency program whitelist when the program file is opened, wherein the high-frequency program whitelist includes running information and multiple program files;

[0084] The acquisition module 420 is used to acquire the running information of the program file in the high-frequency program whitelist when it is determined that the program file exists in the pre-established high-frequency program whitelist.

[0085] The determination module 430 is used to determine that the program file is in the program whitelist based on the running information of the program file in the high-frequency program whitelist list.

[0086] In one embodiment of this application, the pre-established high-frequency program whitelist includes: a first acquisition unit, configured to acquire a program whitelist library under a secure operating environment; and a first generation unit, configured to generate the high-frequency program whitelist from the program whitelist library under the secure operating environment based on a list of running modules.

[0087] In one embodiment of this application, the list of running modules includes running program files, wherein the first generation unit is specifically used to: traverse the attribute information of the running program files to generate the high-frequency program whitelist list.

[0088] In one embodiment of this application, the runtime information includes a modification flag, and further includes: when the attribute information of the runtime file is detected to be modified, the modification flag of the high-frequency program whitelist is updated.

[0089] In an embodiment of the present application, the obtaining module 420 is specifically configured to: when it is determined that the program file exists in the pre-established high-frequency program whitelist list, determine whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list; if yes, determine whether the running information is set for the program file in the high-frequency program whitelist list; if yes, obtain the running information of the program file in the high-frequency program whitelist list.

[0090] In an embodiment of the present application, the obtaining module 420 is specifically configured to: when it is determined that the program file exists in the pre-established high-frequency program whitelist list, determine whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list; if yes, determine whether the running information is set for the program file in the high-frequency program whitelist list; if yes, obtain the running information of the program file in the high-frequency program whitelist list.

[0091] In an embodiment of the present application, the determining module 330 is specifically configured to: when it is determined that the running information of the program file in the high-frequency program whitelist list is not modified, determine that the program file is a program whitelist.

[0092] In an embodiment of the present application, the running information includes the access times, and the apparatus further includes an updating module configured to: when it is determined that the program file exists in the pre-established high-frequency program whitelist list, update the access times of the program file in the high-frequency program whitelist list.

[0093] According to the program whitelist detection apparatus of the embodiment of the present application, when a program file is opened, it is determined that the program file exists in a pre-established high-frequency program whitelist list, and then it is further determined whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist list. When it is determined that the attribute information is consistent, it is further determined whether the running information is set for the program file in the high-frequency program whitelist list. When it is determined that the running information exists, it is determined that the program file is a program whitelist when it is determined that the running information is not modified. Thus, it is determined whether the running information of the program file is modified, and the efficient detection of the program whitelist is realized, and the performance problem caused by the starting and executing of the operating system and the application program is effectively solved.

[0094] According to the apparatus of the embodiment of the present application, the following is described with reference to the accompanying drawings Figure 5FIG. 1 shows a block diagram of an electronic device (e.g., a terminal device or a server) 500 suitable for use in implementing embodiments of the present application. The terminal device in embodiments of the present application can include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet PC), a PMP (Portable Multimedia Player), a car terminal (e.g., a car navigation terminal), and the like, as well as a stationary terminal such as a digital TV, a desktop computer, and the like. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functions and the range of use of embodiments of the present application.

[0095] As shown in FIG. 1, the electronic device 500 can include a processing means (e.g., a central processor, a graphic processor, etc.) 501 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or programs loaded into a random access memory (RAM) 503 from a storage means 508. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing means 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504. Figure 5

[0096] Generally, the following means can be connected to the I / O interface 505: an input means 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, and the like; an output means 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; a storage means 508 including, for example, a magnetic tape, a hard disk, and the like; and a communication means 509. The communication means 509 can allow the electronic device 500 to communicate wirelessly or by wire with other devices to exchange data. Although Figure 5 The electronic device 500 is shown with various means, but it is understood that not all of the means shown are required, nor is it required that all of the means be embodied or present.

[0097] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present application. For example, embodiments of the present application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication means 509, or installed from the storage means 508, or installed from the ROM 502. When the computer program is executed by the processing means 501, the above-described functions defined in the methods of embodiments of the present application are performed.

[0098] ​It should be noted that the computer-readable medium in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer-readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take many forms, including but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium that is not a storage medium and that can communicate, transmit, or propagate program code for use by or in connection with an instruction execution system, apparatus or device. The program code contained in the computer-readable medium can be transmitted using any suitable medium, including but not limited to, wire, cable, fiber optic, RF (radio frequency), or any suitable combination of the above.

[0099] In some embodiments, the client, server, or both can communicate using any current known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any current known or future developed networks.

[0100] The above computer-readable medium can be contained in the above electronic device; or can exist separately without being assembled into the electronic device.

[0101] The computer readable medium described above carries one or more programs, which when executed by the electronic device, cause the electronic device to: obtain at least two Internet Protocol addresses; send a node evaluation request including the at least two Internet Protocol addresses to a node evaluation device, wherein the node evaluation device selects an Internet Protocol address from the at least two Internet Protocol addresses and returns; receive the Internet Protocol address returned by the node evaluation device; and wherein the obtained Internet Protocol address indicates an edge node in a content distribution network.

[0102] Alternatively, the computer readable medium described above carries one or more programs, which when executed by the electronic device, cause the electronic device to: receive a node evaluation request including at least two Internet Protocol addresses; select an Internet Protocol address from the at least two Internet Protocol addresses; and return the selected Internet Protocol address; and wherein the received Internet Protocol address indicates an edge node in a content distribution network.

[0103] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0104] The computer program product of the present application can be a computer program product comprising a computer-readable medium bearing computer program code embodied therein for use with a computer. The computer program code can be code defining and / or implementing the functionality of the present application described herein. The computer program code can be organized into one or more computer program components, including but not limited to, program components for implementing the functionality described herein.

[0105] The units described in the embodiments of the present application can be implemented by software, or by hardware. In some cases, the name of the unit does not constitute a limitation on the unit itself. For example, the first obtaining unit can also be described as a unit for obtaining at least two Internet protocol addresses.

[0106] The functions described above in the specification of the present application can be performed by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0107] In the context of the present application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more of: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0108] The above description merely illustrates the preferred embodiment of the application and a principle of the applied technologies. It is understood by those skilled in the art that the disclosed range of the present application is not limited to the technical solutions formed by the specific combinations of the technical features described above, and should also cover other technical solutions formed by the combinations of the technical features described above or their equivalent features without departing from the disclosed concept. For example, the technical solutions formed by the mutual replacement of the above features and the technical features with similar functions disclosed in the present application (but not limited to) can be formed.

[0109] Further, although operations are depicted in a particular, chronological sequence, this should not be understood as requiring the operations to be performed in that order, or to be performed sequentially. In some circumstances, multitasking and parallel processing can be advantageous. Likewise, although specific implementation details are contained in the above discussion, these should not be construed as limiting the scope of the application. Some features described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0110] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A method for detecting a program whitelist, characterized in that, include: When a program file is opened, it is determined whether the program file exists in a pre-established high-frequency program whitelist, wherein the high-frequency program whitelist includes running information and multiple program files; When it is determined that the program file exists in a pre-established high-frequency program whitelist, the running information of the program file in the high-frequency program whitelist is obtained; Based on the running information of the program file in the high-frequency program whitelist list, the program file is determined to be in the program whitelist; The pre-established high-frequency program whitelist includes: obtaining a program whitelist library under a secure operating environment; and generating the high-frequency program whitelist from the program whitelist library under the secure operating environment based on the list of running modules. The list of running modules includes running program files. The step of generating the high-frequency program whitelist list from the program whitelist library in the secure operating environment based on the list of running modules includes: traversing the attribute information of the running program files to generate the high-frequency program whitelist list. The running information includes a modification flag, and also includes: when the attribute information of the program file is detected to be modified, the modification flag of the high-frequency program whitelist is updated; The running information includes the number of accesses, and the method further includes: when it is determined that the program file exists in a pre-established high-frequency program whitelist, then update the number of accesses of the program file in the high-frequency program whitelist; The PF file is used to obtain frequently accessed executable files and their access counts.

2. The method according to claim 1, characterized in that, When it is determined that the program file exists in a pre-established high-frequency program whitelist, the process of obtaining the program file's execution information in the high-frequency program whitelist includes: When it is determined that the program file exists in a pre-established high-frequency program whitelist, it is then determined whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist. If so, determine whether the program file has the running information set in the high-frequency program whitelist list; If so, obtain the running information of the program file in the high-frequency program whitelist.

3. The method according to claim 2, characterized in that, Also includes: If not, calculate the first hash value of the program file and determine whether the first hash value is consistent with the second hash value of the program file in the high-frequency program whitelist list; When it is determined that the first hash value and the second hash value are inconsistent, the running information of the program file in the high-frequency program whitelist is updated.

4. The method according to claim 1, characterized in that, The step of determining that a program file is on the program whitelist based on the program file's running information in the high-frequency program whitelist list includes: If the program file is determined to be on the program whitelist if its running information has not been modified, then the program file is confirmed to be on the program whitelist.

5. A device for detecting program whitelists, characterized in that, include: The judgment module is used to detect whether a program file exists in a pre-established high-frequency program whitelist when the program file is opened. The high-frequency program whitelist includes running information and multiple program files. The acquisition module is used to acquire the running information of the program file in the high-frequency program whitelist when it is determined that the program file exists in the pre-established high-frequency program whitelist. The determination module is used to determine that the program file is on the program whitelist based on the running information of the program file in the high-frequency program whitelist list; The pre-established high-frequency program whitelist includes: a first acquisition unit, used to acquire a program whitelist library under a secure operating environment; and a first generation unit, used to generate the high-frequency program whitelist from the program whitelist library under the secure operating environment based on the list of running modules. The list of running modules includes running program files, wherein the first generation unit is specifically used to: traverse the attribute information of the running program files to generate the high-frequency program whitelist list; The running information includes a modification flag, and also includes: when the attribute information of the program file is detected to be modified, the modification flag of the high-frequency program whitelist is updated; The operation information includes the number of accesses. The device further includes an update module, which is used to update the number of accesses of the program file in the high-frequency program whitelist when it is determined that the program file exists in a pre-established high-frequency program whitelist. The PF file is used to obtain frequently accessed executable files and their access counts.

6. The apparatus according to claim 5, characterized in that, The acquisition module is specifically used for: When it is determined that the program file exists in a pre-established high-frequency program whitelist, it is then determined whether the attribute information of the program file is consistent with the attribute information of the program file in the high-frequency program whitelist. If so, determine whether the program file has the running information set in the high-frequency program whitelist list; If so, obtain the running information of the program file in the high-frequency program whitelist.

7. The apparatus according to claim 6, characterized in that, It is also specifically used for: If not, calculate the first hash value of the program file and determine whether the first hash value is consistent with the second hash value of the program file in the high-frequency program whitelist list; When it is determined that the first hash value and the second hash value are inconsistent, the running information of the program file in the high-frequency program whitelist is updated.

8. The apparatus according to claim 5, characterized in that, The determining module is specifically used for: If the program file is determined to be on the program whitelist if its running information has not been modified, then the program file is confirmed to be on the program whitelist.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the method for detecting a program whitelist as described in any one of claims 1 to 4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for detecting the program whitelist as described in any one of claims 1 to 4.

Images