External device processing method, device, electronic device and storage medium

Abstract

The present invention provides a method, device, electronic device and storage medium for processing external devices, wherein the method includes: obtaining an IP list of external devices that are in a network connection state with a current terminal device; determining whether there is a malicious IP in the IP list, and if so, shutting down the process corresponding to the malicious IP; capturing traffic related to the malicious IP, and determining whether there is a malicious file related to the malicious IP in the current terminal device based on the traffic related to the malicious IP, and if so, detecting and killing the malicious file. This solution can determine malicious files based on traffic during the network connection process, and can improve the security of terminal devices during the network connection process compared to traditional solutions.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer security technology, and in particular to an external device processing method, device, electronic device and storage medium. Background Art

[0002] At present, the terminal device generally detects the external device by using the IP whitelist when connecting to the external device. However, this method has limitations and cannot guarantee the security of the entire connection process, so there are still security risks. Summary of the invention

[0003] The embodiments of the present invention provide a method, apparatus, electronic device and storage medium for processing an external device, so as to perform corresponding processing on malicious external devices during the entire connection process and improve the security of the terminal device.

[0004] In a first aspect, an embodiment of the present invention provides a method for processing an external device, including:

[0005] Get the IP list of external devices that are connected to the current terminal device;

[0006] Determine whether there is a malicious IP in the IP list, and if so, close the process corresponding to the malicious IP;

[0007] Capture the traffic related to the malicious IP, and determine whether there are malicious files related to the malicious IP in the current terminal device based on the traffic related to the malicious IP. If so, detect and kill the malicious files.

[0008] In a possible implementation, before determining whether there is a malicious IP in the IP list, the method further includes: obtaining a port list of the current terminal device in a network connection state;

[0009] Determining whether there is a malicious IP in the IP list includes:

[0010] Determine whether there is an abnormal port in the port list, and determine the IP in the IP list that uses the abnormal port as a malicious IP.

[0011] In a possible implementation, determining whether there is a malicious IP in the IP list includes:

[0012] Determine whether there is an untrusted IP in the IP list;

[0013] According to the network connection status corresponding to each untrusted IP, determine whether there is an untrusted IP that is in a non-data transmission state, and the update time of the current network connection status exceeds the set time from the current system time, and the corresponding process is running. If so, the untrusted IP is determined as a malicious IP.

[0014] In a possible implementation manner, the non-data transmission state includes: any one network connection state of FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING and CLOSED.

[0015] In a possible implementation, capturing traffic related to the malicious IP includes:

[0016] The malicious IP is determined as a search keyword to perform a global search in the current terminal device to obtain traffic related to the malicious IP.

[0017] In one possible implementation, the malicious files related to the malicious IP include at least one of the following: a file sent to the current terminal device by an external device corresponding to the malicious IP, a file sent to the current terminal device by other external devices and containing the malicious IP, and a file of the process that generates the malicious IP.

[0018] In a possible implementation manner, when there is a file sent to the current terminal device by other external devices and the file contains the malicious IP, the method further includes:

[0019] Obtain other IPs and IPs of other external devices contained in the file except the malicious IP, and perform security checks on the other IPs and IPs of other external devices to determine whether the other IPs and IPs of other external devices are determined as malicious IPs.

[0020] In a second aspect, an embodiment of the present invention further provides an external device processing device, including:

[0021] An acquisition unit, used to acquire an IP list of external devices that are in network connection with the current terminal device;

[0022] A malicious IP determination unit, used to determine whether there is a malicious IP in the IP list, and if so, trigger the processing unit to close the process corresponding to the malicious IP;

[0023] The malicious file determination unit is used to capture the traffic related to the malicious IP, and determine whether there is a malicious file related to the malicious IP in the current terminal device based on the traffic related to the malicious IP. If so, the processing unit is triggered to detect and kill the malicious file.

[0024] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0025] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0026] The embodiment of the present invention provides an external device processing method, device, electronic device and storage medium, which obtains the IP list of external devices that are in a network connection state with the current terminal device, determines whether there are malicious external devices by detecting whether there are malicious IPs during the entire connection process, and determines the malicious files related to the malicious IP by capturing the traffic related to the malicious IP, and performs detection and killing, thereby ensuring the security of the current terminal device during the connection process with the external device. It can be seen that this solution can determine malicious files based on traffic during the network connection process, which can improve the security of terminal devices during the network connection process compared to traditional solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 It is a flow chart of an external device processing method provided by an embodiment of the present invention;

[0029] Figure 2 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;

[0030] Figure 3 It is a structural diagram of an external device processing apparatus provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0032] As mentioned above, when a terminal device establishes a connection with an external device, an IP whitelist can be used to perform a security check on the connected external device to determine whether the external device can be accessed. However, after the security check passes, after the terminal device establishes a connection with the external device, and during the entire connection process, the antivirus software in the terminal device only performs virus detection on the files sent from the external device to the terminal device, but does not detect the traffic data between the terminal device and the external device, and does not detect whether the external device has malicious behavior during the connection process.

[0033] Based on the above problems, the inventive concept of the present invention is: when the terminal device and the external device are in a network connection state, by determining whether the IP of the external device is a malicious IP, the external device corresponding to the malicious IP is further processed to ensure detection during the entire network connection process and improve the security of the entire network connection process.

[0034] The specific implementation of the above concept is described below.

[0035] Please refer to Figure 1 , an embodiment of the present invention provides a method for processing an external device, the method comprising:

[0036] Step 100, obtaining an IP list of external devices that are in network connection with the current terminal device;

[0037] Step 102, determining whether there is a malicious IP in the IP list, and if so, shutting down the process corresponding to the malicious IP;

[0038] Step 104, capturing the traffic related to the malicious IP, and determining whether there is a malicious file related to the malicious IP in the current terminal device based on the traffic related to the malicious IP, and if so, detecting and killing the malicious file.

[0039] In the embodiment of the present invention, the IP list of the external devices in the network connection state with the current terminal device is obtained, and the existence of malicious external devices is determined by detecting whether there are malicious IPs during the entire connection process, and the malicious files related to the malicious IPs are determined by capturing the traffic related to the malicious IPs, and then checked and killed to ensure the security of the current terminal device during the connection process with the external devices. It can be seen that this solution can determine malicious files based on traffic during the network connection process, which can improve the security of terminal devices during the network connection process compared to traditional solutions.

[0040] Described below Figure 1 How the various steps are performed.

[0041] First, with respect to step 100, an IP list of external devices that are in network connection with the current terminal device is obtained.

[0042] In one implementation, the netstat tool in the current terminal device may be used to obtain an IP list of external devices that are in network connection with the current terminal device.

[0043] In the embodiment of the present invention, the network connection status may include the following states: LISTEN, SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING and CLOSED.

[0044] Then, for step 102, determine whether there is a malicious IP in the IP list, and if so, close the process corresponding to the malicious IP.

[0045] In one implementation, the IP blacklist included in the IP intelligence library can be matched with the IP list obtained in step 100. If there is an IP in the IP blacklist in the IP list, the IP is determined to be a malicious IP. If the IP blacklist is updated during the time when the external device is connected to the network to the current time, the updated IP blacklist can be used to re-detect all external devices in the network connection state to determine whether there are corresponding malicious IPs, so as to ensure that the external devices that have been connected are further detected to ensure the security of the terminal device.

[0046] In another implementation, when using the netstat tool to obtain the IP list, the netstat tool can also be used to obtain the port list of the current terminal device in the network connection state; when determining whether there is a malicious IP in the IP list, specifically, determine whether there is an abnormal port in the port list, and determine the IP in the IP list that uses the abnormal port as a malicious IP.

[0047] In one embodiment of the present invention, the method for determining the abnormal port may include at least one of the following methods:

[0048] Method A: Determine whether there is a preset closed port opened by the external device corresponding to the target IP in the IP list according to the port list. If so, determine the port as an abnormal port and the target IP as a malicious IP.

[0049] Method B: Count the number of times each high-risk port in the port list is called, and determine the high-risk port whose number of calls is greater than the corresponding number threshold as an abnormal port.

[0050] In the embodiment of the present invention, after the external device is connected, it uses the port of the local terminal device to interact with traffic and data. If the external device has malicious behavior, it will cause port abnormality. The malicious IP is determined by identifying the abnormal port, which increases the identification method of the malicious IP and makes the definition of the malicious IP more accurate, thereby ensuring the security of the terminal device.

[0051] In one embodiment of the present invention, based on the above method of determining malicious IP addresses, other methods may be further included to determine:

[0052] Determine whether there is an untrusted IP in the IP list;

[0053] According to the network connection status corresponding to each untrusted IP, determine whether there is an untrusted IP that is in a non-data transmission state, and the update time of the current network connection status exceeds the set time from the current system time, and the corresponding process is running. If so, the untrusted IP is determined as a malicious IP.

[0054] Business personnel operating terminal devices often establish network connections with external devices related to their business areas. Therefore, in an embodiment of the present invention, the IP addresses of external devices related to the business area of ​​the current terminal device can be added to a trusted list, while IP addresses outside the trusted list need to be focused on whether they have malicious behavior and whether they are malicious IP addresses.

[0055] Furthermore, users can also update the IP addresses that are confirmed to be safe to the trust list.

[0056] When determining whether there is an untrusted IP in the IP list, the trust list may be used for determination.

[0057] It is understandable that a process is created during the process of establishing a connection between a terminal device and an external device, and after the connection is established, data is generally transmitted, and the entire connection process corresponds to different network connection states. If the external device of an untrusted IP is in a network connection state with the current terminal device, but the network connection state is a non-data transmission state, and the update time of the current network state exceeds the set time from the current system time, that is, no data is transmitted during the set time, and its process is still running, it indicates that the untrusted IP may have malicious operations on the current terminal device, so the malicious IP can be identified.

[0058] The non-data transmission state may be any other state in the network connection state except ESTABLISHED. Generally, after the ESTABLISHED state has been passed, it indicates that malicious traffic or malicious files have been injected into the current terminal device. Therefore, preferably, the non-data transmission state includes: any one of the network connection states of FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING and CLOSED.

[0059] After the malicious IP is determined, in order to reduce the further threat of the malicious IP to the current terminal device, the process corresponding to the malicious IP needs to be closed. In one implementation, after the corresponding process PID is determined through the malicious IP, the process path is located, and at least one of the corresponding process name, the MD5 value of the process file, the path of the process file, and the creation time of the process file is recorded.

[0060] Finally, for step 104, the traffic related to the malicious IP is captured, and based on the traffic related to the malicious IP, it is determined whether there are malicious files related to the malicious IP in the current terminal device. If so, the malicious files are checked and killed.

[0061] In the embodiment of the present invention, when a threat behavior is found in an external device, network analysis can be automatically started to capture traffic related to a malicious IP. Network statistics can be further collected to decode the captured traffic related to the malicious IP into a readable form and save it in a pcap form.

[0062] In one implementation, the capturing of traffic related to the malicious IP may capture traffic whose source IP is the malicious IP and / or traffic whose destination IP is the malicious IP.

[0063] In another implementation, capturing traffic related to a malicious IP may include: determining the malicious IP as a search keyword to perform a global search in the current terminal device to obtain traffic related to the malicious IP.

[0064] By using malicious IP as a search keyword, not only can we retrieve traffic with the malicious IP as the source or destination IP, but we can also retrieve traffic from other external devices interacting with the current terminal device that contains the malicious IP. The malicious IP in the traffic interacting with other external devices indicates that this part of the traffic or even the other external devices has security issues. Therefore, using malicious IP as a search keyword for a global search can capture more abundant traffic.

[0065] When capturing traffic related to malicious IPs, you can use Wireshark. Since it only captures traffic related to malicious IPs instead of all traffic, the capture speed is fast and it can avoid occupying too many processing resources of the host.

[0066] Accordingly, the malicious files related to the malicious IP include at least one of the following: a file sent to the current terminal device by an external device corresponding to the malicious IP, a file sent to the current terminal device by other external devices and containing the malicious IP, and a file of the process that generates the malicious IP.

[0067] In one embodiment of the present invention, when there is a file sent from other external devices to the current terminal device and the file contains the malicious IP, it also includes: obtaining other IPs and the IPs of the other external devices contained in the file except the malicious IP, and performing security checks on the other IPs and the IPs of the other external devices to determine whether the other IPs and the IPs of the other external devices are determined as malicious IPs.

[0068] Since the file contains the malicious IP, it is possible that the file also contains other IPs. If other IPs are included, since the other IPs are of the same nature as the malicious IP, they need to be security checked. Similarly, the external device that sends the file still has security issues, and the IP of the external device that sends the file also needs to be security checked.

[0069] Among them, the method of performing security detection on IP can be through blacklist or whitelist.

[0070] In one embodiment of the present invention, after a malicious file is determined, the malicious file may be checked and killed in order to reduce the security threat of the malicious file to the current terminal device.

[0071] Furthermore, after a malicious file is identified, a pop-up window can be used to prompt the user and warn of the possible impact of the malicious file. A specified time period can also be set. If the user does not choose whether to check and kill within the specified time period, the check and kill work will be automatically completed when the specified time period is exceeded.

[0072] Furthermore, the virus type of the malicious file can be determined. If it is an infected file or a macro virus file, the infected original file is restored after the malicious code part is deleted. If the virus type of the malicious file is a preset type, such as a virus file that spreads by exploiting the EternalBlue vulnerability, after isolating and deleting the malicious file, a new empty file with the same name is created, and the permission of the empty file with the same name is set to deny writing.

[0073] In addition, you can also encrypt the malicious file and store it in the quarantine area before detecting and killing it, and then delete the malicious file. This can avoid accidentally deleting important files, allowing users to retrieve the file in the quarantine area.

[0074] After the malicious file detection and killing process is completed, a log of the processing of the external device can be generated. The log content may include: a description of the malicious behavior of the external device corresponding to the malicious IP, the time of establishing a connection with the external device, the malicious IP, the process that generates the malicious IP, the MD5 value of the process file, the path of the process file, the creation time of the process file and at least one of the disposal results.

[0075] Furthermore, it can also be linked with external tracing tools to analyze and trace the traffic and malicious files related to malicious IPs.

[0076] The analysis of traffic may include: analyzing whether sensitive files in the current terminal device have been leaked to external devices with malicious IPs. Specifically, if the traffic transmission uses the TCP protocol, analyze whether the TCP three-way handshake has been completed and whether the link has been established; if the data transmission uses file transfer protocols such as HTTP and FTP, analyze the transmitted data flow and analyze whether sensitive files are transmitted (sensitive files are defined by the user).

[0077] Among them, the analysis of virus files may include: understanding the operations of the virus files on the current terminal device after they are run, analyzing whether there are residual virus files, as well as undeleted startup items, registry keys, scheduled tasks, services, etc., so as to further remove residual virus files and traces of virus files' operations on the current terminal device.

[0078] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides an external device processing device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, it is a hardware architecture diagram of an electronic device where an external device processing device provided by an embodiment of the present invention is located, except Figure 2In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides an external device processing device, including:

[0079] The acquisition unit 301 is used to acquire an IP list of external devices that are in network connection with the current terminal device;

[0080] A malicious IP determination unit 302 is used to determine whether there is a malicious IP in the IP list, and if so, trigger the processing unit 303 to close the process corresponding to the malicious IP;

[0081] The malicious file determination unit 304 is used to capture the traffic related to the malicious IP, and determine whether there is a malicious file related to the malicious IP in the current terminal device based on the traffic related to the malicious IP. If so, the processing unit 303 is triggered to detect and kill the malicious file.

[0082] In one embodiment of the present invention, the acquisition unit 301 is further used to acquire a port list of the current terminal device in a network connection state before determining whether there is a malicious IP in the IP list;

[0083] The malicious IP determination unit 302 is specifically configured to determine whether there is an abnormal port in the port list, and determine the IP in the IP list that uses the abnormal port as a malicious IP.

[0084] In one embodiment of the present invention, the malicious IP determination unit 302 can also be used to determine whether there is an untrusted IP in the IP list; according to the network connection status corresponding to each untrusted IP, determine whether there is an untrusted IP that is in a non-data transmission state, and the update time of the current network connection status is more than a set time from the current system time, and the corresponding process is running. If so, the untrusted IP is determined as a malicious IP.

[0085] In one embodiment of the present invention, the non-data transmission state includes: any one of the network connection states of FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING and CLOSED.

[0086] In one embodiment of the present invention, the malicious file determination unit 304, when capturing traffic related to the malicious IP, is specifically used to determine the malicious IP as a search keyword to perform a global search in the current terminal device to obtain traffic related to the malicious IP.

[0087] In one embodiment of the present invention, the malicious files related to the malicious IP include at least one of the following: a file sent to the current terminal device by an external device corresponding to the malicious IP, a file sent to the current terminal device by other external devices and the file contains the malicious IP, and a file of the process that generates the malicious IP.

[0088] In one embodiment of the present invention, when there is a file sent from other external devices to the current terminal device and the file contains the malicious IP, the processing unit 302 is also used to obtain other IPs and the IPs of the other external devices contained in the file except the malicious IP, and perform security checks on the other IPs and the IPs of the other external devices to determine whether the other IPs and the IPs of the other external devices are determined as malicious IPs.

[0089] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on an external device processing apparatus. In other embodiments of the present invention, an external device processing apparatus may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0090] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0091] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, an external device processing method in any embodiment of the present invention is implemented.

[0092] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes an external device processing method in any embodiment of the present invention.

[0093] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0094] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0095] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0096] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0097] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0098] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0099] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing an external device, characterized in that: When the terminal device establishes a connection with the external device, a security check is performed on the connected external device using the IP whitelist to determine whether the external device can be accessed. When the security check passes, after the terminal device establishes a connection with the external device and during the entire connection process, the external device is further checked and processed. The method includes: Get the IP list of external devices that are connected to the current terminal device; Determine whether there is a malicious IP in the IP list, and if so, close the process corresponding to the malicious IP; Capture the traffic related to the malicious IP, and determine whether there is a malicious file related to the malicious IP in the current terminal device according to the traffic related to the malicious IP, and if so, detect and kill the malicious file; The determining whether there is a malicious IP in the IP list includes: determining whether there is an untrusted IP in the IP list; according to the network connection status corresponding to each untrusted IP, determining whether there is an untrusted IP in a non-data transmission state, and the update time of the current network connection state exceeds a set time from the current system time, and the corresponding process is running. If so, the untrusted IP is determined as a malicious IP; the non-data transmission state includes: any one of the network connection states of FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING and CLOSED.

2. The method according to claim 1, characterized in that Before determining whether there is a malicious IP in the IP list, the method further includes: obtaining a port list of the current terminal device in a network connection state; Determining whether there is a malicious IP in the IP list includes: Determine whether there is an abnormal port in the port list, and determine the IP in the IP list that uses the abnormal port as a malicious IP.

3. The method according to claim 1, characterized in that The capturing of traffic related to the malicious IP includes: The malicious IP is determined as a search keyword to perform a global search in the current terminal device to obtain traffic related to the malicious IP.

4. The method according to claim 1 or 3, characterized in that: The malicious files related to the malicious IP include at least one of the following: a file sent to the current terminal device by an external device corresponding to the malicious IP, a file sent to the current terminal device by other external devices and containing the malicious IP, and a file that generates a process corresponding to the malicious IP.

5. The method according to claim 4, characterized in that When there is a file sent to the current terminal device by other external devices and the file contains the malicious IP, it also includes: Obtain other IPs and IPs of other external devices contained in the file except the malicious IP, and perform security checks on the other IPs and IPs of other external devices to determine whether the other IPs and IPs of other external devices are determined as malicious IPs.

6. An external equipment processing device, characterized in that: When the terminal device establishes a connection with the external device, a security check is performed on the external device using the IP whitelist to determine whether the external device can be accessed. When the security check passes, after the terminal device establishes a connection with the external device and during the entire connection process, the external device is further checked and processed. The device includes: An acquisition unit, used to acquire an IP list of external devices that are in network connection with the current terminal device; A malicious IP determination unit, used to determine whether there is a malicious IP in the IP list, and if so, trigger the processing unit to close the process corresponding to the malicious IP; A malicious file determination unit is used to capture the traffic related to the malicious IP, and determine whether there is a malicious file related to the malicious IP in the current terminal device according to the traffic related to the malicious IP, and if so, trigger the processing unit to detect and kill the malicious file; The malicious IP determination unit is specifically used to determine whether there is an untrusted IP in the IP list; according to the network connection status corresponding to each untrusted IP, determine whether there is an untrusted IP that is in a non-data transmission state, and the update time of the current network connection state exceeds the set time from the current system time, and the corresponding process is running. If so, the untrusted IP is determined as a malicious IP; the non-data transmission state includes: any one of the network connection states of FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING and CLOSED.

7. The device according to claim 6, characterized in that The acquisition unit is further used to acquire a port list of the current terminal device in a network connection state before determining whether there is a malicious IP in the IP list; The malicious IP determination unit is specifically used to determine whether there is an abnormal port in the port list, and determine the IP in the IP list that uses the abnormal port as a malicious IP.

8. The device according to claim 6, characterized in that The malicious file determination unit is specifically used to determine the malicious IP as a search keyword when capturing the traffic related to the malicious IP, so as to perform a global search in the current terminal device to obtain the traffic related to the malicious IP.

9. The device according to claim 6 or 8, characterized in that The malicious files related to the malicious IP include at least one of the following: a file sent to the current terminal device by an external device corresponding to the malicious IP, a file sent to the current terminal device by other external devices and containing the malicious IP, and a file that generates a process corresponding to the malicious IP.

10. The device according to claim 9, characterized in that When there is a file sent by other external devices to the current terminal device and the file contains the malicious IP, the processing unit is also used to obtain other IPs and the IPs of the other external devices contained in the file except the malicious IP, and perform security checks on the other IPs and the IPs of the other external devices to determine whether the other IPs and the IPs of the other external devices are determined as malicious IPs.

11. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

Images