A method, system, device and storage medium for detecting program abnormal behavior

Abstract

The application discloses a program abnormal behavior detection method, system, device and storage medium, and is applied to the technical field of computer security, and comprises the following steps: according to a set verification data generation rule, first verification data of a specified process file is generated in advance, and the first verification data is stored; when it is detected that the process file is executed, second verification data of the process file is generated according to the verification data generation rule, and it is judged whether the second verification data is consistent with the first verification data; if yes, it is determined that the process file is normally executed; and if no, the behavior of the process file when the process file is executed is monitored, and whether the process file is normally executed is determined based on the behavior. According to the scheme of the application, the detection of the program abnormal behavior can be effectively performed, and the computer security is protected.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a method, system, device, and storage medium for detecting abnormal program behavior. Background Technology

[0002] Currently, with the rapid development of cloud computing and big data, creating virtual machines is becoming increasingly easy, and host assets are also increasing. In recent years, however, mining viruses have appeared more and more frequently, affecting many users. As a result, the regulation of virtual currencies is becoming increasingly strict, and cracking down on such mining activities has become a key focus of recent crackdowns.

[0003] Cryptocurrency mining not only causes computer lag, excessive CPU usage, and skyrocketing maintenance costs, but some mining hosts may also be infected with viruses, leading to the leakage of important user data. Furthermore, hackers may use compromised machines as springboards to continue infiltrating internal networks or attacking other targets, resulting in even more serious cybersecurity attacks.

[0004] In conclusion, effectively detecting abnormal program behavior and protecting computer security is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a method, system, device, and storage medium for detecting abnormal program behavior, so as to effectively detect abnormal program behavior and protect computer security.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] A method for detecting abnormal program behavior, comprising:

[0008] According to the set verification data generation rules, the first verification data of the specified process file is generated in advance and stored;

[0009] When the execution of the process file is detected, the second verification data of the process file is generated according to the verification data generation rules, and it is determined whether it is consistent with the first verification data.

[0010] If so, then the process file is confirmed to be executing normally;

[0011] If not, monitor the behavior of the process file when it is executed, and determine whether the process file is executed normally based on the behavior.

[0012] Preferably, the step of generating and storing the first verification data of the specified process file in advance according to the set verification data generation rules includes:

[0013] The initial verification data of the specified process file is generated in advance using a preset verification algorithm.

[0014] The initial verification data is adjusted according to the set verification data generation rules to obtain the first verification data of the process file and store it.

[0015] Preferably, adjusting the initial verification data according to the set verification data generation rules to obtain and store the first verification data of the process file includes:

[0016] Select each odd-numbered data or each even-numbered data from the initial verification data, and use the selected result as the first verification data of the process file and store it.

[0017] Preferably, the step of monitoring the behavior of the process file when it is executed, and determining whether the process file is executed normally based on the behavior, includes:

[0018] Monitor the various behavioral parameters of the process file when it is executed;

[0019] According to the set assignment rules, assign corresponding weight values ​​to each monitored behavioral parameter;

[0020] The weight values ​​are summed up, and it is determined whether the summed value exceeds the preset first threshold.

[0021] If yes, then the process file is determined not to be executed correctly; otherwise, the process file is determined to be executed correctly.

[0022] Preferably, the monitoring of various behavioral parameters when the process file is executed includes:

[0023] The system monitors whether the user who owns the process file when it is executed is a normal user, whether the process attribute is read-only, whether there is random startup of the process or any child process, whether the CPU usage rate is higher than the CPU usage rate threshold, whether there are any actions that attack security software, whether the process or any parent or child process is connected to external ports, and whether it is connected to scheduled tasks.

[0024] Preferably, after determining that the process file is not executing correctly, the process further includes:

[0025] Pause the execution of the process file and log the events.

[0026] Preferably, after determining that the value after superposition does not exceed a preset first threshold, the method further includes:

[0027] Determine whether the summed value is less than or equal to a preset second threshold.

[0028] If not, the monitoring frequency is adjusted to a preset second monitoring frequency to periodically monitor various behavioral parameters of the process file when it is executed based on the second monitoring frequency;

[0029] Wherein, the second monitoring frequency is higher than the default first monitoring frequency, and the second threshold is lower than the first threshold.

[0030] A system for detecting abnormal program behavior, comprising:

[0031] The first verification data pre-storage module is used to generate and store the first verification data of the specified process file in advance according to the set verification data generation rules.

[0032] The verification execution module is used to generate second verification data of the process file according to the verification data generation rules and determine whether it is consistent with the first verification data when the execution of the process file is detected.

[0033] If so, the first execution module is triggered to determine that the process file is executing normally;

[0034] If not, the second execution module is triggered to monitor the behavior of the process file when it is executed, and to determine whether the process file is executed normally based on the behavior.

[0035] A device for detecting abnormal program behavior, comprising:

[0036] Memory, used to store computer programs;

[0037] A processor for executing the computer program to implement the steps of the method for detecting abnormal program behavior as described above.

[0038] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method for detecting abnormal program behavior as described above.

[0039] The technical solution provided by this invention generates and stores first verification data for a specified process file according to a pre-defined verification data generation rule. When the process file is detected to be executing, second verification data is generated according to the same rule. Therefore, when the process file is not modified, the second verification data will match the first verification data, confirming normal execution. When the second verification data differs from the first verification data, to avoid misjudgment, this application further monitors the behavior of the process file during execution, thereby more accurately determining whether the process file is executing normally and improving the accuracy of detecting abnormal program behavior. In summary, the solution of this application can effectively detect abnormal program behavior and protect computer security. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a flowchart illustrating the implementation of a method for detecting abnormal program behavior according to the present invention.

[0042] Figure 2 This is a schematic diagram of the structure of a program abnormal behavior detection system according to the present invention;

[0043] Figure 3 This is a schematic diagram of the structure of a detection device for abnormal program behavior according to the present invention. Detailed Implementation

[0044] The core of this invention is to provide a method for detecting abnormal program behavior, so as to effectively detect abnormal program behavior and protect computer security.

[0045] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] Please refer to Figure 1 , Figure 1 The following is a flowchart illustrating an implementation method for detecting abnormal program behavior according to the present invention. This method may include the following steps:

[0047] Step S101: According to the set verification data generation rules, generate and store the first verification data of the specified process file in advance.

[0048] In this application's scheme, the first verification data of the process file needs to be generated according to the set verification data generation rules for subsequent consistency verification. Therefore, the specific method used for the verification data generation rules can be set and adjusted as needed. For example, existing verification algorithms can be used as the verification data generation rules used in this application. For example, parity check, MD5 check, checksum algorithm, BCC (Block Check Character), CRC (Cyclic Redundancy Check), LRC (Longitudinal Redundancy Check), etc., can be used.

[0049] Process files, also known as executable files, can be specified in advance. For example, in a specific scenario, all process files under the operating system can be used as the specified process file. Taking Linux as an example, in one scenario, all process files under the paths / bin / or / sbin / can be used as the specified process file.

[0050] It is understandable that when multiple process files are specified, the scheme of this application can be executed separately for each process file, that is, the detection of abnormal program behavior can be performed separately for each process file.

[0051] After generating the first verification data for a specified process file according to the established verification data generation rules, the first verification data needs to be stored. The specific storage location of the first verification data can be set and adjusted as needed. For example, in a specific scenario, the first verification data can be stored in the attribute information of the process file.

[0052] Step S102: When the execution of the process file is detected, generate the second verification data of the process file according to the verification data generation rules and determine whether it is consistent with the first verification data. If yes, proceed to step S103; otherwise, proceed to step S104.

[0053] When a process file is detected to be executed, the same rules, namely the preset verification data generation rules, are used to calculate the verification data of the current process file, thereby generating the second verification data of the current process file.

[0054] When the second verification data matches the first verification data, it indicates that the process file has not been tampered with by malicious programs, and the operation of step S103 can be executed, that is, to determine that the process file is currently executing normally.

[0055] Step S103: Confirm that the process file is executing normally;

[0056] Step S104: Monitor the behavior of the process file when it is executed, and determine whether the process file is executed normally based on the behavior.

[0057] When the second verification data matches the first verification data, it indicates that the current process file is not consistent with the process file when the first verification data was generated. However, this application considers that the first verification data is the first verification data of the process file pre-generated according to the set verification data generation rules. As time goes by, the process file may undergo normal updates and modifications. Even in some cases, the first verification data of each process file may be updated periodically, but this update is usually not frequent. Therefore, in practical applications, when the execution of a process file is detected, the generated second verification data may be inconsistent with the pre-stored first verification data.

[0058] In order to more accurately determine whether the process file is executed normally and avoid misjudgment, this application will further monitor the behavior of the process file when it is executed, and thus determine whether the process file is executed normally based on the behavior.

[0059] Understandably, the behavior of the process file being monitored when it is executed can be set and adjusted as needed, but generally speaking, the behavior that can more accurately reflect whether the process file is being executed normally can be selected.

[0060] In one specific embodiment of the present invention, step S101 may specifically include the following steps:

[0061] The first step: Using a preset verification algorithm, generate initial verification data for the specified process file in advance;

[0062] The second step is to adjust the initial verification data according to the set verification data generation rules to obtain the first verification data of the process file and store it.

[0063] As described above, this application needs to generate the first verification data of the process file according to the set verification data generation rules for subsequent consistency verification. The specific method used for the verification data generation rules can be set and adjusted as needed; for example, existing methods such as MD5 checksum and CRC algorithm can be used.

[0064] This implementation further considers that some malicious programs, such as mining programs, may counter or prevent certain security detection behaviors to evade detection. For example, some mining programs may generate verification data corresponding to the modified process file after tampering with the process file, and replace the original stored first verification data with this verification data.

[0065] For ease of description, the verification data corresponding to the tampered process file is referred to as the third verification data. For example, the verification data generation rule of this application uses the commonly used MD5 algorithm. After the mining program tampers with the process file, the third verification data is also generated using the MD5 algorithm. Therefore, when step S102 is executed, that is, when the execution of the process file is detected, even if the current process file is a tampered process file, since the generated verification data corresponding to the current process file and the previously stored verification data of the process file are both third verification data, the process file tampered with by the mining program will pass the detection.

[0066] The first step of this implementation is to generate initial verification data for a specified process file using a preset verification algorithm, such as the MD5 algorithm. Then, the initial verification data is adjusted according to pre-defined verification data generation rules. This adjustment method can be arbitrarily set by the operator, and the adjusted data is stored as the first verification data for the resulting process file. In other words, this implementation is essentially a customized modification of a commonly used verification algorithm, ensuring that even if malicious programs such as mining programs generate verification data corresponding to the tampered process file, the tampered process file cannot evade detection due to the different rules used to generate the verification data.

[0067] The initial verification data is adjusted according to the set verification data generation rules. There are various specific methods. For example, in one specific embodiment of the present invention, the second step mentioned above may specifically include: selecting each odd-numbered data or each even-numbered data from the initial verification data, and storing the selected result as the first verification data of the process file.

[0068] In this implementation, the operation of selecting each odd-numbered data or each even-numbered data from the initial verification data is very simple, which facilitates the implementation of the scheme and also helps to reduce the time required to generate the first verification data and the second verification data.

[0069] Of course, in other situations, other adjustment methods can be set as needed, such as selecting the first N or last N bits of data from the initial verification data as the first verification data generated.

[0070] In one specific embodiment of the present invention, step S104 may specifically include the following steps:

[0071] Step 1: Monitor the various behavioral parameters of the process file when it is executed;

[0072] Step 2: According to the set assignment rules, configure the corresponding weight values ​​for each monitored behavioral parameter;

[0073] Step 3: Add up the weight values ​​and determine whether the added value exceeds the preset first threshold.

[0074] If so, proceed to step four: determine if the process file is not executing correctly;

[0075] If not, proceed to step five: confirm that the process file is executing normally.

[0076] In this implementation, after detecting the various behavioral parameters of the process file when it is executed, the corresponding weight values ​​are configured for each detected behavioral parameter according to the set assignment rules. Then, the weight values ​​are superimposed, and it is determined whether the superimposed value exceeds the preset first threshold.

[0077] As can be seen, in this implementation method, the degree of influence of the behavioral parameters of different items on the result can be different, because the weight values ​​assigned to the behavioral parameters of different items can be set according to the set assignment rules.

[0078] The specific behavioral parameters of the process files to be monitored when they are executed can be set as needed. It's understandable that behaviors less likely to occur in normal process files, but more likely to occur in malicious programs such as mining programs, should be assigned higher weight values.

[0079] When the summed values ​​exceed the preset first threshold, it indicates that the process file is behaving abnormally, thus confirming that the process file is not executing properly.

[0080] The specific value of the first threshold can be set and adjusted as needed. In one specific embodiment of the present invention, the first threshold can be determined based on a malicious program. For example, during an experiment, a pre-set mining program is allowed to tamper with a normal process file and run the tampered process file. Then, the various behavioral parameters of the process file are detected, and corresponding weight values ​​are configured for each behavioral parameter according to the same assignment rules. The summation result is used as the first threshold. Of course, in practical applications, multiple experiments can be conducted. For example, the minimum value from multiple experiments can be used as the final determined first threshold to ensure the reliability of the scheme.

[0081] In one specific embodiment of the present invention, step one above may specifically include:

[0082] Monitor whether the user who owns the process file when it is executed is a normal user, whether the process attribute is read-only, whether there is random startup of this process or any child process, whether the CPU usage rate is higher than the CPU usage rate threshold, whether there are any actions to attack security software, whether this process or any parent or child process is connected to external ports, and whether it is connected to scheduled tasks.

[0083] The solution in this application is mainly aimed at mining programs in malicious programs. Therefore, in this implementation method, based on the characteristics of mining programs, various behavioral parameters of the process file to be monitored when it is executed are set. That is, the parameters specifically selected in this implementation method are behavioral parameters that can accurately and effectively reflect whether the process file is executed normally.

[0084] In a specific scenario, when the user who owns the process file when it is executed is a normal user, it indicates that the behavior parameter is normal. In this case, the weight value of the detected behavior parameter can be configured to be 0 according to the set assignment rules. Conversely, when the user who owns the process file when it is executed is an abnormal user, it indicates that the behavior parameter is abnormal. For example, the weight value of the detected behavior parameter can be configured to be 3 according to the set assignment rules.

[0085] Normal process files are not typically read-only files. Therefore, when the process attribute is not read-only, the weight value of this behavior parameter can be 0. However, when the process attribute is read-only, the weight value of this behavior parameter can be 3.

[0086] Normally, process files and their child processes do not start randomly. Therefore, when a process file is detected to be executed, if there is no random start of the current process or any child processes, the weight value of this behavior parameter can be 0. However, if the current process or any child processes start randomly, the weight value of this behavior parameter can be 3.

[0087] Normal process files typically don't consume excessive CPU resources. Therefore, when CPU utilization is below the CPU utilization threshold, the weight value for this behavior parameter can be 0. The utilization threshold can be set and adjusted as needed, for example, set to 50%. When CPU utilization exceeds the threshold, the weight value for this behavior parameter can be 10. It should be noted that high CPU utilization is a key characteristic of mining programs; therefore, in practical applications, when CPU utilization exceeds the threshold, the configured weight value can be higher, such as 10 in this example.

[0088] Normal process files typically do not exhibit actions that could attack security software. Therefore, when no such actions are present, the weight value for this behavior parameter can be 0. However, when such actions are present, the weight value can be 10. Similar to high CPU utilization, the presence of actions that could attack security software is also a key characteristic of mining programs. Therefore, in practical applications, when such actions are present, the weight value can be higher, such as 10 in this example.

[0089] Normal process files typically do not link to scheduled tasks. Therefore, when no scheduled task is linked, the weight value of this behavior parameter can be 0. However, when a scheduled task is linked, the weight value of this behavior parameter can be 15. Linking to scheduled tasks is also an important feature of mining programs; therefore, in practical applications, the weight value configured for this action can be relatively high, such as 15 in this example.

[0090] Normal process files and their parent and child processes typically do not connect to external ports. Therefore, when neither the current process nor any parent or child process connects to an external port, the weight value of this behavior parameter can be 0. However, when the current process or any parent or child process connects to an external port, the weight value of this behavior parameter can be 20. Connecting to an external port is a key characteristic of mining programs; therefore, in practical applications, the weight value for this action can be relatively high, such as 20 in this example. Examples of external ports include 6379, 3333, 6688, 4444, 5555, 13531, 8888, 8080, 9999, 2020, 1800, 14444, 18888, etc.

[0091] In one specific embodiment of the present invention, after determining that the process file is not executed normally, the method further includes: pausing the execution of the process file and recording the event so that staff can handle the event in a timely manner, and can determine the time, location, and content of the process file being tampered with based on the event record, thereby assisting staff in subsequent processing.

[0092] In one specific embodiment of the present invention, after determining that the value after superposition does not exceed a preset first threshold, the method may further include:

[0093] Determine whether the summed value is less than or equal to a preset second threshold.

[0094] If not, the monitoring frequency will be adjusted to the preset second monitoring frequency to periodically monitor the various behavioral parameters of the process file when it is executed based on the second monitoring frequency;

[0095] The second monitoring frequency is higher than the default first monitoring frequency, and the second threshold is lower than the first threshold.

[0096] In the above implementation, when the summed value does not exceed a preset first threshold, the process file can be determined to be executing normally. However, in this implementation, considering that for a normal process file, the summed value should be 0 or a very low value, to avoid setting the first threshold too high, or to prevent some mining programs from being too stealthy, this implementation further checks whether the summed value is less than or equal to a preset second threshold after determining that the summed value does not exceed the preset first threshold. If it is not less than or equal to the preset second threshold, it indicates that the process file still has a certain degree of risk of being tampered with, and this implementation will strengthen the monitoring of the process file.

[0097] For example, in one specific scenario, the first threshold is set to 30, the second threshold is set to 10, and in another specific scenario, the sum of these values ​​is 22. This meets the conditions for enhanced monitoring, meaning the monitoring frequency is adjusted to a preset second monitoring frequency to periodically monitor the various behavioral parameters of the process file during execution. It is understandable that when periodically monitoring the various behavioral parameters of the process file during execution based on the second monitoring frequency, each behavioral parameter monitored in each period can be judged as described in the above implementation method, i.e., whether the sum of the weighted values ​​is higher than the first threshold.

[0098] It should be noted that when performing step S104, i.e., monitoring the behavior of the process file during execution, periodic monitoring can be performed according to the default first monitoring frequency, or monitoring can be performed several times after the process file is executed. This can be set as needed and does not affect the implementation of the present invention. In this embodiment, regardless of whether periodic monitoring or several monitoring times are previously set, as long as the result after any monitoring meets the above-mentioned enhanced monitoring conditions, i.e., the second threshold < the superimposed value ≤ the first threshold occurs, periodic monitoring will begin, and the monitoring frequency will be relatively high, i.e., the monitoring frequency has been adjusted to a higher second monitoring frequency.

[0099] For example, in a specific scenario, after the process file is tampered with, the CPU utilization rate intermittently increases. However, at the moment when monitoring is triggered, if the detected CPU utilization rate is not higher than the CPU utilization rate threshold, the behavior parameter is assigned a value of 0. Ultimately, the sum of the various weight values ​​is 22, which does not exceed the first threshold of 30. In this implementation, enhanced monitoring will be triggered, which is conducive to achieving more accurate detection of abnormal program behavior, that is, further improving the reliability of the solution in this application.

[0100] The technical solution provided by this invention generates and stores first verification data for a specified process file according to a pre-defined verification data generation rule. When the process file is detected to be executing, second verification data is generated according to the same rule. Therefore, when the process file is not modified, the second verification data will match the first verification data, confirming that the process file is executing correctly. When the second verification data differs from the first verification data, to avoid misjudgment, this application further monitors the behavior of the process file during execution, thereby more accurately determining whether the process file is executing correctly and improving the accuracy of detecting abnormal program behavior. In summary, the solution of this application can effectively detect abnormal program behavior and protect computer security.

[0101] Corresponding to the above method embodiments, this invention also provides a detection system for abnormal program behavior, which can be referred to in conjunction with the above.

[0102] See Figure 2 The diagram shown is a structural schematic of a program abnormal behavior detection system according to the present invention, comprising:

[0103] The first verification data pre-storage module 201 is used to generate and store the first verification data of the process file in advance for the specified process file according to the set verification data generation rules.

[0104] The verification execution module 202 is used to generate second verification data of the process file according to the verification data generation rules and determine whether it is consistent with the first verification data when the execution of the process file is detected.

[0105] If so, the first execution module 203 is triggered to determine if the process file is executing normally;

[0106] If not, the second execution module 204 is triggered to monitor the behavior of the process file when it is executed and to determine whether the process file is executed normally based on the behavior.

[0107] In one specific embodiment of the present invention, the first verification data pre-storage module 201 specifically includes:

[0108] The initial verification data generation unit is used to generate initial verification data for a specified process file in advance using a preset verification algorithm.

[0109] The first verification data generation unit is used to adjust the initial verification data according to the set verification data generation rules, obtain the first verification data of the process file, and store it.

[0110] In one specific embodiment of the present invention, the first verification data generation unit is specifically used for:

[0111] Select each odd-numbered or even-numbered data from the initial check data, and use the selected result as the first check data of the process file and store it.

[0112] In one specific embodiment of the present invention, the second execution module 204 is specifically used for:

[0113] Monitor the various behavioral parameters of the process file when it is executed;

[0114] According to the set assignment rules, assign corresponding weight values ​​to each monitored behavioral parameter;

[0115] The weight values ​​are summed up, and it is determined whether the summed value exceeds the preset first threshold.

[0116] If yes, then the process file is determined not to be executed correctly; otherwise, the process file is determined to be executed correctly.

[0117] In one specific embodiment of the present invention, the second execution module 204 monitors various behavioral parameters when the process file is executed, including:

[0118] Monitor whether the user who owns the process file when it is executed is a normal user, whether the process attribute is read-only, whether there is random startup of this process or any child process, whether the CPU usage rate is higher than the CPU usage rate threshold, whether there are any actions to attack security software, whether this process or any parent or child process is connected to external ports, and whether it is connected to scheduled tasks.

[0119] In one specific embodiment of the present invention, after the second execution module 204 determines that the process file is not executed normally, the method further includes:

[0120] The logging module is used to pause the execution of process files and log events.

[0121] In one specific embodiment of the present invention, after the second execution module 204 determines that the value after superposition does not exceed a preset first threshold, the second execution module 204 is further configured to:

[0122] Determine whether the summed value is less than or equal to a preset second threshold.

[0123] If not, the monitoring frequency will be adjusted to the preset second monitoring frequency to periodically monitor the various behavioral parameters of the process file when it is executed based on the second monitoring frequency;

[0124] The second monitoring frequency is higher than the default first monitoring frequency, and the second threshold is lower than the first threshold.

[0125] Corresponding to the methods and system embodiments described above, this invention also provides a device for detecting abnormal program behavior and a computer-readable storage medium, which can be referred to in conjunction with the above description. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for detecting abnormal program behavior as described in any of the above embodiments.

[0126] The computer-readable storage media referred to herein include random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage media known in the art.

[0127] See also Figure 3 The detection equipment for abnormal behavior of the program may include:

[0128] Memory 301 is used to store computer programs;

[0129] Processor 302 is configured to execute a computer program to implement the steps of the method for detecting abnormal program behavior as described in any of the above embodiments.

[0130] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0131] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0132] This article uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the technical solutions and core ideas of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made to the present invention without departing from the principles of the present invention, and these improvements and modifications also fall within the protection scope of the present invention.

Claims

1. A method for detecting abnormal program behavior, characterized in that, include: According to the set verification data generation rules, the first verification data of the specified process file is generated in advance and stored; When the execution of the process file is detected, the second verification data of the process file is generated according to the verification data generation rules, and it is determined whether it is consistent with the first verification data. If so, then the process file is confirmed to be executing normally; If not, monitor the behavior of the process file when it is executed, and determine whether the process file is executed normally based on the behavior; The monitoring of the behavior of the process file when it is executed, and the determination of whether the process file is executed normally based on the behavior, includes: Monitor the various behavioral parameters of the process file when it is executed; According to the set assignment rules, assign corresponding weight values ​​to each monitored behavioral parameter; The weight values ​​are summed up, and it is determined whether the summed value exceeds the preset first threshold. If yes, then the process file is determined not to be executed correctly; otherwise, the process file is determined to be executed correctly. The monitoring parameters for various behaviors of the process file when it is executed include: Monitor whether the user who owns the process file when it is executed is a normal user, whether the process attribute is read-only, whether there is random startup of this process or any child process, whether the CPU usage rate is higher than the CPU usage rate threshold, whether there is any action to attack security software, whether this process or any parent or child process is connected to external ports, and whether it is connected to scheduled tasks. After determining that the summed value does not exceed a preset first threshold, the process also includes: Determine whether the summed value is less than or equal to a preset second threshold. If not, the monitoring frequency is adjusted to a preset second monitoring frequency to periodically monitor various behavioral parameters of the process file when it is executed based on the second monitoring frequency; Wherein, the second monitoring frequency is higher than the default first monitoring frequency, and the second threshold is lower than the first threshold; The step of generating and storing the first verification data of the specified process file in advance according to the set verification data generation rules includes: The initial verification data of the specified process file is generated in advance using a preset verification algorithm. The initial verification data is adjusted according to the set verification data generation rules to obtain the first verification data of the process file and store it.

2. The method for detecting abnormal program behavior according to claim 1, characterized in that, The step of adjusting the initial verification data according to the set verification data generation rules to obtain and store the first verification data of the process file includes: Select each odd-numbered data or each even-numbered data from the initial verification data, and use the selected result as the first verification data of the process file and store it.

3. The method for detecting abnormal program behavior according to claim 1, characterized in that, After determining that the process file is not executing correctly, the following steps are also included: Pause the execution of the process file and log the events.

4. A system for detecting abnormal program behavior, characterized in that, include: The first verification data pre-storage module is used to generate and store the first verification data of the specified process file in advance according to the set verification data generation rules. The verification execution module is used to generate second verification data of the process file according to the verification data generation rules and determine whether it is consistent with the first verification data when the execution of the process file is detected. If so, the first execution module is triggered to determine that the process file is executing normally; If not, the second execution module is triggered to monitor the behavior of the process file when it is executed, and to determine whether the process file is executed normally based on the behavior. The second execution module is specifically used for: Monitor the various behavioral parameters of the process file when it is executed; According to the set assignment rules, assign corresponding weight values ​​to each monitored behavioral parameter; The weight values ​​are summed up, and it is determined whether the summed value exceeds the preset first threshold. If yes, then the process file is determined not to be executed correctly; otherwise, the process file is determined to be executed correctly. The second execution module monitors various behavioral parameters of the process file when it is executed, including: Monitor whether the user who owns the process file when it is executed is a normal user, whether the process attribute is read-only, whether there is random startup of this process or any child process, whether the CPU usage rate is higher than the CPU usage rate threshold, whether there are any actions to attack security software, whether this process or any parent or child process is connected to external ports, and whether it is connected to scheduled tasks. After the second execution module determines that the summed value does not exceed a preset first threshold, the second execution module is further used to: Determine whether the summed value is less than or equal to a preset second threshold. If not, the monitoring frequency will be adjusted to the preset second monitoring frequency to periodically monitor the various behavioral parameters of the process file when it is executed based on the second monitoring frequency; Among them, the second monitoring frequency is higher than the default first monitoring frequency, and the second threshold is lower than the first threshold; The first verification data pre-storage module is specifically used for: The initial verification data of the specified process file is generated in advance using a preset verification algorithm. The initial verification data is adjusted according to the set verification data generation rules to obtain the first verification data of the process file and store it.

5. A device for detecting abnormal program behavior, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method for detecting abnormal program behavior as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for detecting abnormal program behavior as described in any one of claims 1 to 3.

Images