Security vulnerability repair method, device, electronic device and storage medium

Abstract

Embodiments of the present invention disclose a security vulnerability repair method, apparatus, electronic device, and storage medium, relating to the field of computer security technology and capable of improving computer security. The method comprises: determining a computer file on a local computer that has a security vulnerability; obtaining and storing an optimization file corresponding to the computer file; wherein the optimization file has already repaired the security vulnerability; and upon detecting that the computer file has been called, prohibiting the computer file from being launched and launching the optimization file instead. Embodiments of the present invention are applicable to scenarios where security vulnerabilities need to be repaired.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a security vulnerability repair method, device, electronic device and storage medium. Background Art

[0002] With the widespread use of computers in our daily lives and work, computer file security vulnerabilities are becoming an increasingly important issue in computer security. A security vulnerability is a flaw in hardware, software, protocol implementation, or system security policy that can allow attackers to access or damage a system without authorization. It is an unintentional, unprotected entry point into a restricted computer, component, application, or other online resource. Failure to promptly repair computer files with security vulnerabilities on local computers can lead to significant security risks. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a security vulnerability repair method, device, electronic device, and storage medium, which can improve the security of a local computer.

[0004] In a first aspect, an embodiment of the present invention provides a method for repairing a security vulnerability, the method comprising: determining a computer file having a security vulnerability on a local computer; obtaining and storing an optimization file corresponding to the computer file; wherein the optimization file has repaired the security vulnerability; and when it is detected that the computer file is called, prohibiting the startup of the computer file and starting the optimization file.

[0005] Optionally, determining a computer file having a security vulnerability on a local computer includes: determining version information of a first computer file on the local computer; comparing the version information of the first computer file with specified version information of the first computer file; if the version number in the version information of the first computer file is lower than the version number in the specified version information, determining that the first computer file is a computer file having a security vulnerability.

[0006] Optionally, obtaining the optimization file corresponding to the computer file includes: obtaining the optimization file corresponding to the computer file based on information about security vulnerabilities.

[0007] Optionally, storing the optimization file corresponding to the computer file includes: changing the name of the optimization file to a name different from that of the computer file, and storing the optimization file in a storage location pointed to by the storage path of the computer file.

[0008] Optionally, when it is detected that the computer file is called, the computer file is prohibited from being started and the optimization file is started, including: detecting whether the computer file is called through a hook function; when the computer file is called, prohibiting the computer file from being started, modifying the startup path in the hook function so that the modified startup path points to the optimization file; and starting the optimization file based on the modified startup path.

[0009] Optionally, the method further includes: when it is detected that the local computer is restarted or shut down, deleting the computer file or renaming the computer file; and changing the name of the optimized file to the same name as the original name of the computer file.

[0010] Optionally, after obtaining and storing the optimization file corresponding to the computer file, the method further includes: obtaining a designated associated file of the optimization file corresponding to the computer file, and storing the designated associated file in a storage location pointed to by the storage path of the computer file; and / or obtaining a designated associated file of the optimization file corresponding to the computer file, and replacing the original associated file corresponding to the designated associated file with the designated associated file at the storage location pointed to by the storage path of the computer file.

[0011] In a second aspect, an embodiment of the present invention provides a security vulnerability repair device, which includes: a determination module for determining a computer file with a security vulnerability on a local computer; an acquisition module for acquiring an optimization file corresponding to the computer file; wherein the optimization file has repaired the security vulnerability; a first storage module for storing the optimization file corresponding to the computer file; and a startup module for prohibiting the startup of the computer file and starting the optimization file when it is detected that the computer file is called.

[0012] Optionally, the determination module includes: a first determination unit, used to determine the version information of a first computer file on a local computer; a comparison unit, used to compare the version information of the first computer file with the specified version information of the first computer file; and a second determination unit, used to determine that the first computer file is a computer file with a security vulnerability if the version number in the version information of the first computer file is lower than the version number in the specified version information.

[0013] Optionally, the acquisition module is specifically used to: acquire the optimization file corresponding to the computer file based on the information of the security vulnerability.

[0014] Optionally, the first storage module is specifically configured to: change the name of the optimization file to a name different from that of the computer file, and store the optimization file in a storage location pointed to by a storage path of the computer file.

[0015] Optionally, the startup module includes: a detection unit, used to detect whether the computer file is called through a hook function; a modification unit, used to prohibit the startup of the computer file when the computer file is called, and modify the startup path in the hook function so that the modified startup path points to the optimized file; and a startup unit, used to start the optimized file based on the modified startup path.

[0016] Optionally, the device further includes: a processing module, used to delete the computer file or rename the computer file when detecting that the local computer is restarted or shut down; and a renaming module, used to change the name of the optimized file to the same name as the original name of the computer file.

[0017] Optionally, the device also includes: a second storage module, which is used to obtain the designated associated file of the optimization file corresponding to the computer file after obtaining and storing the optimization file corresponding to the computer file, and store the designated associated file in the storage location pointed to by the storage path of the computer file; and / or, a replacement module, which is used to obtain the designated associated file of the optimization file corresponding to the computer file, and replace the original associated file corresponding to the designated associated file with the designated associated file at the storage location pointed to by the storage path of the computer file.

[0018] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; a power supply circuit for supplying power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the security vulnerability repair method provided by any embodiment of the present invention.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the security vulnerability repair method described in any of the aforementioned implementation methods.

[0020] The security vulnerability repair method, device, electronic device, and storage medium provided by the embodiments of the present invention can determine a computer file with a security vulnerability on a local computer, and then obtain and store an optimization file corresponding to the computer file. When it is detected that the computer file is being called, the computer file is prohibited from being started, and the optimization file is started instead. In this way, because the security vulnerability has been repaired in the optimization file, the security threat generated by a network attack targeting the security vulnerability when the optimization file is called can be avoided. Therefore, the security vulnerability can be repaired without restarting the computer or the software on the computer, thereby improving the security of the local computer. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A schematic diagram of a process for repairing a security vulnerability provided by an embodiment of the present invention;

[0023] Figure 2 A schematic structural diagram of a security vulnerability repair device provided by an embodiment of the present invention;

[0024] Figure 3 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0026] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0027] The embodiment of the present invention provides a method for repairing a security vulnerability. Figure 1 , the method may include:

[0028] S11, determining a computer file having a security vulnerability on the local computer;

[0029] A security vulnerability is a flaw in the implementation of hardware, software, or a protocol, or in system security policies, that can allow an attacker to access or damage a system without authorization. It is an unintentional, unprotected entry point into a restricted computer, component, application, or other online resource. Computer files are components of a system or software application installed on a local computer. Computer files with security vulnerabilities can include executable files (exe files), dynamic link libraries (dll files), static link libraries, or system files (sys files).

[0030] In this step, security vulnerability information can first be obtained from the official website of the target software vendor (such as Microsoft) or the security vulnerability database (such as the China National Information Security Vulnerability Database), and based on this security vulnerability information, it is determined which computer files in the local computer have the above-mentioned security vulnerabilities.

[0031] In one example, a security vulnerability detection tool can be used to perform security vulnerability detection on computer files of the Windows system installed on the local computer based on security vulnerability information released by a software vendor (such as Microsoft) to determine which computer files on the local computer have the above-mentioned security vulnerabilities.

[0032] S12, obtaining and storing an optimization file corresponding to the computer file; wherein the optimization file has repaired the security vulnerability;

[0033] To continuously optimize their products and reduce security risks, software vendors continually identify and fix security vulnerabilities in the computer files they provide. They upload these optimized files to a designated location (e.g., the vendor's official website) for download and use by relevant technical personnel. After obtaining the optimized files corresponding to the computer files with security vulnerabilities, they can store them on a local computer so that they can be used to fix the security vulnerabilities.

[0034] S13, when it is detected that the computer file is called, prohibiting the startup of the computer file and starting the optimization file.

[0035] When it is detected that a computer file with a security vulnerability is being called by a process on the local computer, the computer file can be prohibited from being started and the corresponding optimization file can be started. In this way, since the security vulnerability has been repaired in the optimization file, the security threat caused by network attacks targeting the security vulnerability when the optimization file is called can be avoided. Therefore, without restarting the computer or the software on the computer, the security vulnerability can be repaired while ensuring the normal function of the local computer, thereby improving the security of the local computer.

[0036] The security vulnerability repair method provided by an embodiment of the present invention can determine a computer file containing a security vulnerability on a local computer, and then obtain and store an optimization file corresponding to the computer file. When it is detected that the computer file is being called, the computer file is prohibited from being started, and the optimization file is started instead. In this way, because the security vulnerability has been repaired in the optimization file, the security threat caused by a network attack targeting the security vulnerability when the optimization file is called can be avoided. Thus, the security vulnerability can be repaired without restarting the computer or the software on the computer, thereby improving the security of the local computer.

[0037] Optionally, in one embodiment of the present invention, the determining of a computer file having a security vulnerability on the local computer (step S11) may include: determining version information of a first computer file on the local computer; comparing the version information of the first computer file with specified version information of the first computer file; if the version number in the version information of the first computer file is lower than the version number in the specified version information, determining that the first computer file is a computer file having a security vulnerability.

[0038] In an embodiment of the present invention, the security vulnerability information released by a certain software vendor (such as Microsoft) can be first obtained. For a certain security vulnerability in the security vulnerability information, for example, a security vulnerability numbered KB4565489 included in the security vulnerability information, the computer files containing the security vulnerability, including the winload.exe file, can be found from the official website of the software vendor. At the same time, it can also be learned from the official website of the software vendor that all winload.exe files with version numbers less than 10.0.17134.1610 have security vulnerabilities, and winload.exe files with version numbers greater than 10.0.17134.1610 have already implemented repairs to the security vulnerabilities. Then, it can be detected whether the version number of winload.exe in the current computer to be detected is lower than the above-mentioned version number 10.0.17134.1610. If it is lower, it can be determined that the winload.exe file in the computer has a security vulnerability numbered KB4565489. Similarly, for other security vulnerability information released by the above-mentioned software vendors or security vulnerability information released by other software vendors, the same method as above can be used to find computer files with these security vulnerabilities on the computer.

[0039] Optionally, in one embodiment of the present invention, obtaining the optimization file corresponding to the computer file in step S12 may include: obtaining the optimization file corresponding to the computer file based on information about security vulnerabilities.

[0040] In an embodiment of the present invention, the corresponding optimization file can be searched and downloaded from the official website of the software vendor according to the number of the security vulnerability. Specifically, using the above example, the winload.exe file that fixes the security vulnerability can be downloaded from the official website of Microsoft according to the security vulnerability number KB4565489 for use in subsequent processes.

[0041] Optionally, in one embodiment of the present invention, storing the optimization file corresponding to the computer file in step S12 may include: changing the name of the optimization file to a name different from that of the computer file, and storing the optimization file in a storage location pointed to by the storage path of the computer file.

[0042] In an embodiment of the present invention, after obtaining an optimized file that has fixed a security vulnerability, the optimized file can be renamed to a different name than the corresponding computer file and stored in the storage location pointed to by the storage path of the computer file. This effectively distinguishes the two files by name and avoids name conflicts caused by storing them in the same storage path.

[0043] Continuing with the previous example, after obtaining the optimized file (new winload.exe file) corresponding to the original winload.exe file with a security vulnerability, both files are named winload.exe, differing only in the version. The new winload.exe file can then be renamed to winload-new.exe and stored in the same storage location as the original winload.exe file. This allows newly started processes on the computer to subsequently call the winload-new.exe file from this storage path.

[0044] Optionally, in one embodiment of the present invention, when it is detected that the computer file is called, the computer file is prohibited from being started and the optimization file is started, including: detecting whether the computer file is called through a hook function; when the computer file is called, prohibiting the computer file from being started, modifying the startup path in the hook function so that the modified startup path points to the optimization file; and starting the optimization file based on the modified startup path.

[0045] Hooks are a platform within the Windows message processing mechanism. Applications can set up subroutines to monitor specific messages from designated windows, even those created by other processes. When a message arrives, it is processed before the target window's handler function. The hook mechanism allows applications to intercept and process window messages or specific events.

[0046] A hook is essentially a message-processing program segment, hooked into the system via system calls. Whenever a specific message is sent, before it reaches the destination window, the hook program captures the message, effectively giving the hook function control. The hook function can then process the message, pass it on without processing, or forcefully terminate the message. Specifically, in an embodiment of the present invention, when the aforementioned computer file with a security vulnerability is an .exe file, the newly launched process will inevitably use the system API: CreateProcess (or ShellExecute). Therefore, in order to detect the calling of exe file, a hook function can be adopted to hook system API: CreateProcess (or system API: ShellExecute), thereby the newly called exe file can be detected, and according to the name of the newly called exe file, it is judged whether it is a target exe file (for example winload.exe), when detecting that it is the target exe file, the target exe file can be forbidden to be started, and the startup path is modified in the hook function, so that the modified startup path points to the optimized file corresponding to the target exe file, for example, the startup path can be modified to c:\windows\winload-new.exe by original c:\windows\winload.exe, to start the optimized file (winload-new.exe file) corresponding to the target exe file, so that the normal function of the computer can be realized, and the repair of the security hole is also realized. In one example, a global hook function can be adopted to hook system API: CreateProcess (or system API: ShellExecute) within the scope of the entire operating system, so as to timely detect the newly called exe file within the scope of the entire operating system.

[0047] In another example, when the aforementioned computer file with a security vulnerability is a dll file, since a newly started process calls the dll file, it will inevitably use the system API: LoadLibray. Therefore, in order to detect the call of the dll file, a hook function can be used to hook the system API: LoadLibray, so that the newly called dll file can be detected and, based on the name of the dll file, it can be determined whether it is the target dll file. If it is the target dll file, the target dll file can be prohibited from being started, and the startup path can be modified in the hook function so that the modified startup path points to the optimized file corresponding to the target dll file. For example, the startup path can be modified from the original c:\windows\winload.dll to c:\windows\winload-new.dll to start the optimized file corresponding to the target dll file. This can achieve normal function of the computer and also fix the security vulnerability. In another example, a global hook function can be used to hook the system API: LoadLibray throughout the entire operating system to timely detect newly called dll files throughout the entire operating system.

[0048] When the aforementioned computer files are static link library files or system files, the detection method for calling these computer files by the new process is similar to the above two methods and will not be described in detail here.

[0049] In this way, since the security vulnerability has been repaired in the called optimization file, the security threat caused by the network attack against the security vulnerability can be avoided. The security vulnerability can be repaired without restarting the computer, thereby improving the security of the local computer.

[0050] Optionally, in one embodiment of the present invention, the security vulnerability repair method provided by the embodiment of the present invention may also include: when it is detected that the local computer is restarted or shut down, deleting the computer file or renaming the computer file; changing the name of the optimized file to the same name as the original name of the computer file.

[0051] In an embodiment of the present invention, a hook function can be used to hook the system API: ShutDown.exe to detect a computer restart operation or shutdown operation. When a local computer restart or shutdown is detected, the original winload.exe file can be renamed winload-old.exe (or the original winload.exe file can be deleted), and the winload-new.exe file can be renamed winload.exe. In this way, the name of the optimized file is consistent with the original name of the computer file (the original winload.exe file). After the computer is restarted, when a certain process calls winload.exe, the winload.exe file can be directly called without using a hook function (the winload.exe file is an optimized file at this time), and the original computer file (the original winload.exe file) will not be called, thereby fundamentally repairing the security vulnerability of the computer file.

[0052] Optionally, in one embodiment of the present invention, after obtaining and storing the optimization file corresponding to the computer file, the security vulnerability repair method provided by the embodiment of the present invention may also include: obtaining a designated associated file of the optimization file corresponding to the computer file, and storing the designated associated file in the storage location pointed to by the storage path of the computer file.

[0053] In an embodiment of the present invention, if an optimized file has newly associated files compared to the computer file, the newly associated files corresponding to the optimized file can be obtained after obtaining the optimized file, and both can be stored in the storage location pointed to by the storage path of the computer file. When a newly started process on the local computer calls the optimized file, it can directly call the newly associated files that the optimized file depends on and the original associated files from the storage location pointed to by the storage path, thereby ensuring the normal operation of the local computer.

[0054] Optionally, in one embodiment of the present invention, after obtaining and storing the optimized file corresponding to the computer file, the security vulnerability repair method provided by the embodiment of the present invention may also include: obtaining a designated associated file of the optimized file corresponding to the computer file, and replacing the original associated file corresponding to the designated associated file with the designated associated file at the storage location pointed to by the storage path of the computer file.

[0055] In an embodiment of the present invention, if an optimized file has an associated file with a newer version than the computer file, the updated associated file corresponding to the optimized file can be obtained at the same time as the optimized file is obtained. The updated associated file can then be used to replace the original associated file at the storage location pointed to by the computer file's storage path, so that the associated file's version matches the optimized file. When a newly started process on the local computer calls the optimized file, the updated associated file that the optimized file depends on can be directly called from the storage path, thereby ensuring the normal operation of the local computer.

[0056] In addition, if the optimized file has both newly added associated files and associated files with updated versions compared to the computer file, the above two technical solutions can be used in combination.

[0057] Correspondingly, such as Figure 2 As shown, an embodiment of the present invention further provides a security vulnerability repair device 1, comprising: a determination module 11, for determining a computer file having a security vulnerability on a local computer; an acquisition module 12, for acquiring an optimization file corresponding to the computer file; wherein the optimization file has repaired the security vulnerability; a first storage module 13, for storing the optimization file corresponding to the computer file; and a startup module 14, for prohibiting the startup of the computer file and starting the optimization file when detecting that the computer file is called.

[0058] The security vulnerability repair device provided by an embodiment of the present invention can determine a computer file on a local computer that has a security vulnerability, then obtain and store an optimization file corresponding to the computer file. When the computer file is detected to be called, the device prohibits the computer file from being started and starts the optimization file instead. In this way, because the security vulnerability has been repaired in the optimization file, the security threat caused by a network attack targeting the security vulnerability when the optimization file is called can be avoided. Thus, the security vulnerability can be repaired without restarting the computer or the software on the computer, thereby improving the security of the local computer.

[0059] Optionally, in one embodiment of the present invention, the determination module 11 includes: a first determination unit, used to determine the version information of a first computer file on a local computer; a comparison unit, used to compare the version information of the first computer file with the specified version information of the first computer file; and a second determination unit, used to determine that the first computer file is a computer file with a security vulnerability if the version number in the version information of the first computer file is lower than the specified version information.

[0060] Optionally, in one embodiment of the present invention, the acquisition module 12 is specifically configured to: acquire an optimization file corresponding to the computer file based on the information about the security vulnerability.

[0061] Optionally, in one embodiment of the present invention, the first storage module 13 is specifically used to: change the name of the optimization file to a name different from that of the computer file, and store the optimization file in a storage location pointed to by the storage path of the computer file.

[0062] Optionally, in one embodiment of the present invention, the startup module 14 includes: a detection unit, used to detect whether the computer file is called through a hook function; a modification unit, used to prohibit the startup of the computer file when the computer file is called, and modify the startup path in the hook function so that the modified startup path points to the optimized file; and a startup unit, used to start the optimized file based on the modified startup path.

[0063] Optionally, in one embodiment of the present invention, the security vulnerability repair device 1 also includes: a processing module, used to delete the computer file or rename the computer file when it is detected that the local computer is restarted or shut down; and a renaming module, used to change the name of the optimized file to the same name as the original name of the computer file.

[0064] Optionally, in one embodiment of the present invention, the security vulnerability repair device 1 also includes: a second storage module, which is used to obtain the designated associated file of the optimization file corresponding to the computer file after obtaining and storing the optimization file corresponding to the computer file, and store the designated associated file in the storage location pointed to by the storage path of the computer file; and / or, a replacement module, which is used to obtain the designated associated file of the optimization file corresponding to the computer file, and replace the original associated file corresponding to the designated associated file with the designated associated file at the storage location pointed to by the storage path of the computer file.

[0065] The security vulnerability repair device provided in the embodiment of the present invention and the aforementioned security vulnerability repair method belong to the same inventive concept. Technical details not described in the security vulnerability repair device can be found in the relevant description of the aforementioned security vulnerability repair method and will not be repeated here.

[0066] Accordingly, an embodiment of the present invention further provides an electronic device, Figure 3 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can realize the present invention. Figure 1 The process of the embodiment shown. Figure 3As shown, the above-mentioned electronic device may include: a shell 31, a processor 32, a memory 33, a circuit board 34 and a power supply circuit 35, wherein the circuit board 34 is placed inside the space enclosed by the shell 31, and the processor 32 and the memory 33 are arranged on the circuit board 34; the power supply circuit 35 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 33 is used to store executable program code; the processor 32 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 33, so as to execute the method described in any of the above-mentioned embodiments.

[0067] For details on the specific execution process of the above steps by the processor 32 and the steps further executed by the processor 32 by running the executable program code, please refer to the present invention. Figure 1 The description of the illustrated embodiment will not be repeated here.

[0068] This electronic device exists in many forms, including but not limited to:

[0069] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.

[0070] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0071] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0072] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0073] (5) Other electronic devices with data interaction functions.

[0074] In addition, an embodiment of the present invention also provides a computer program medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method provided by any embodiment of the present invention, thereby also achieving corresponding beneficial technical effects. The corresponding explanation has been made in the previous text and will not be repeated here.

[0075] The security vulnerability repair method, device, electronic device and storage medium provided by the embodiments of the present invention can determine the computer files with security vulnerabilities on the local computer, and then obtain and store the optimization files corresponding to the computer files. When it is detected that the computer file is called, the computer file is prohibited from being started and the optimization file is started. In this way, since the security vulnerability has been repaired in the optimization file, the security threat generated by the network attack against the security vulnerability when the optimization file is called can be avoided, so that the security vulnerability can be repaired without restarting the computer or the software on the computer, thereby improving the security of the local computer. Furthermore, the embodiments of the present invention can also determine which computer files have security vulnerabilities based on the version number in the version information of the computer files in the local computer. Similarly, the embodiments of the present invention can also determine the optimization files that have repaired the security vulnerabilities in the computer based on the information of the security vulnerabilities. Furthermore, after obtaining the optimization file that has repaired the security vulnerability, the optimization file can be changed to a name different from the computer file corresponding to it, and the optimization file can be stored in the storage location pointed to by the storage path of the computer file. In this way, it is possible to effectively distinguish the two by name, avoid the conflict of duplicate names caused by storing the two in the same storage path, and enable the new startup process in the computer to call the optimization file from the storage path. Furthermore, the embodiment of the present invention can detect whether the computer file is called through a hook function, and realize the startup of the optimization file by modifying the startup path in the hook function, thereby realizing the repair of the security vulnerability. Furthermore, the embodiment of the present invention can delete the computer file or rename the computer file when it detects that the local computer is restarted or shut down, and change the name of the optimization file to the same name as the original name of the computer file, so as to fundamentally realize the repair of the security vulnerability of the computer file. Furthermore, the embodiment of the present invention can also add new associated files and / or update the original associated files under the calculation file storage path when there are new associated files and / or updated associated files in the optimization file, so as to ensure the normal operation of the local computer.

[0076] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0077] In embodiments of the present invention, the term "and / or" describes the association relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0078] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0079] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0080] For the convenience of description, the above device is described as being divided into various units / modules based on their functions. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0081] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0082] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A security vulnerability repair method, characterized in that: include: Identify computer files on the local computer that have security vulnerabilities; Obtaining and storing an optimized file corresponding to the computer file; wherein the optimized file has repaired the security vulnerability; When it is detected that the computer file is called, prohibiting the startup of the computer file and starting the optimization file; Wherein, the storage of the optimization file corresponding to the computer file includes: Changing the name of the optimized file to a name different from that of the computer file, and storing the optimized file in a storage location pointed to by the storage path of the computer file; When detecting that the computer file is called, prohibiting the computer file from being started and starting the optimization file, comprises: Detecting whether the computer file is called through a hook function; When the computer file is called, the computer file is prohibited from being started, and a startup path is modified in the hook function so that the modified startup path points to the optimized file; Based on the modified startup path, starting the optimized file; After obtaining and storing the optimized file corresponding to the computer file, the method further includes: Obtaining a designated associated file of the optimized file corresponding to the computer file, and storing the designated associated file in a storage location pointed to by a storage path of the computer file; and / or, A designated associated file of the optimized file corresponding to the computer file is obtained, and an original associated file corresponding to the designated associated file is replaced with the designated associated file at a storage location pointed to by a storage path of the computer file.

2. The method according to claim 1, characterized in that The computer file determining the security vulnerability on the local computer includes: determining version information of a first computer file on the local computer; comparing the version information of the first computer file with the specified version information of the first computer file; If the version number in the version information of the first computer file is lower than the version number in the specified version information, it is determined that the first computer file is a computer file with a security vulnerability.

3. The method according to claim 1, characterized in that The obtaining of the optimized file corresponding to the computer file includes: Based on the information about the security vulnerability, an optimized file corresponding to the computer file is obtained.

4. The method according to claim 1, wherein The method further comprises: When detecting that the local computer is restarted or shut down, deleting the computer file or renaming the computer file; The name of the optimized file is changed to the same name as the original name of the computer file.

5. A security vulnerability repair device, characterized in that: include: A determination module, used for determining computer files with security vulnerabilities on a local computer; An acquisition module, configured to acquire an optimization file corresponding to the computer file; wherein the optimization file has repaired the security vulnerability; A first storage module, configured to store an optimization file corresponding to the computer file; A startup module, configured to, when detecting that the computer file is called, prohibit startup of the computer file and startup of the optimization file; Wherein, the first storage module is specifically used to: change the name of the optimization file to a name different from that of the computer file, and store the optimization file in a storage location pointed to by the storage path of the computer file; The startup module includes: a detection unit for detecting whether the computer file is called through a hook function; a modification unit for prohibiting the computer file from being started when the computer file is called, and modifying the startup path in the hook function so that the modified startup path points to the optimized file; and a startup unit for starting the optimized file based on the modified startup path; The device also includes: a second storage module, which is used to obtain a designated associated file of the optimization file corresponding to the computer file after obtaining and storing the optimization file corresponding to the computer file, and store the designated associated file in a storage location pointed to by the storage path of the computer file; and / or, a replacement module, which is used to obtain a designated associated file of the optimization file corresponding to the computer file, and replace the original associated file corresponding to the designated associated file with the designated associated file at the storage location pointed to by the storage path of the computer file.

6. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute any of the methods described in claims 1 to 4 above.

7. A computer program medium, characterized in that A computer program is stored thereon, characterized in that when the program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images