Terminal weak control method, device, electronic device and storage medium

Abstract

The present invention provides a terminal weak control method, device, electronic device and storage medium, wherein the method includes: in response to monitoring program startup behavior, determining whether the startup process in the program startup behavior is a known trusted process; when it is determined that the startup process is not a known trusted process, determining that the startup process is an unknown process, tampering with the program running instructions corresponding to the startup process, so that the startup process starts and runs in a specified namespace; the specified namespace is used to isolate the accessible resources in the host machine where the startup process is located; monitoring the behavior of the unknown process running in the specified namespace, and controlling the unknown process running in the specified namespace based on the monitoring results. This solution can achieve effective control of unknown processes in a weak control state.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of security technology, and in particular to a terminal weak control method, device, electronic device, and storage medium. Background Art

[0002] Trusted control technology is the primary method used for strong endpoint control, preventing threats by directly blocking the execution of unknown processes. However, strong control has many drawbacks, such as significant system performance loss, poor stability, and user inconvenience. Therefore, a weak control method is needed to effectively control unknown processes. Summary of the Invention

[0003] Embodiments of the present invention provide a terminal weak control method, device, electronic device, and storage medium, which can effectively control unknown processes in a weak control state.

[0004] In a first aspect, an embodiment of the present invention provides a terminal weak management and control method, including:

[0005] In response to monitoring a program startup behavior, determining whether a startup process in the program startup behavior is a known trusted process;

[0006] When it is determined that the startup process is not a known trusted process, the startup process is determined to be an unknown process, and the program execution instruction corresponding to the startup process is tampered with so that the startup process is started and run in a specified namespace; the specified namespace is used to isolate accessible resources in the host machine where the startup process is located;

[0007] Behavior monitoring is performed on the unknown process running in the specified namespace, and the unknown process running in the specified namespace is managed and controlled based on the monitoring results.

[0008] In one possible implementation, determining whether the startup process in the program startup behavior is a known trusted process includes:

[0009] Matching the startup process in the program startup behavior with the trusted processes in the trusted whitelist;

[0010] If there is a trusted process matching the startup process, then the startup process is determined to be a known trusted process; otherwise, it is determined that the startup process is not a known trusted process.

[0011] In a possible implementation, the number of the designated namespaces is one or more, and one unknown process runs in one designated namespace;

[0012] Before tampering with the program execution instruction corresponding to the startup process, the method further includes: obtaining a first register parameter of a default namespace in which the startup process runs, and determining a second register parameter of a designated namespace allocated to the startup process;

[0013] The tampering with the program running instruction corresponding to the startup process includes: changing the first register parameter in the ESI register to the second register parameter.

[0014] In one possible implementation, the monitoring of the behavior of the unknown process running in the specified namespace includes:

[0015] Based on the process information of the unknown process, a process startup chain of the unknown process is determined, and behavior monitoring is performed on each process on the process startup chain.

[0016] In a possible implementation, the content of the behavior monitoring of the process includes at least one of resource occupation, file operation, network request, and system configuration change.

[0017] In one possible implementation, controlling the unknown process running in the specified namespace according to the monitoring result includes:

[0018] When the running time of the unknown process does not reach the preset time, but the unknown process is monitored to have abnormal behavior, the unknown process is determined to be an untrusted process, and an abnormality assessment is performed on the unknown process based on the preset abnormal behavior analysis rules and the abnormal behavior in the monitoring results, and the unknown process is controlled according to the control method corresponding to the abnormality assessment result;

[0019] The control mode includes: not taking control operation, controlling process network access behavior, controlling file operation behavior, controlling process startup behavior, suspending process operation and ending process.

[0020] A possible implementation method further includes: when the running time of the unknown process reaches a preset time and no abnormal behavior is detected in the unknown process, determining that the unknown process is a trusted process and updating the unknown process to a trusted whitelist.

[0021] In a second aspect, an embodiment of the present invention further provides a terminal weak control device, including:

[0022] a determining unit, configured to, in response to monitoring a program startup behavior, determine whether a startup process in the program startup behavior is a known trusted process;

[0023] an instruction tampering unit configured to, when determining that the startup process is not a known trusted process, determine that the startup process is an unknown process, and tamper with a program execution instruction corresponding to the startup process so that the startup process is started and executed in a specified namespace; the specified namespace is used to isolate accessible resources in the host machine where the startup process is located;

[0024] The monitoring and control unit is used to monitor the behavior of the unknown process running in the specified namespace and control the unknown process running in the specified namespace based on the monitoring results.

[0025] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0026] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0027] The embodiment of the present invention provides a terminal weak control method, device, electronic device and storage medium. When the startup process is an unknown process, the program running instructions corresponding to the startup process are tampered with so that the startup process is started in a specified namespace. Since the specified namespace is used to isolate the accessible resources in the host machine where the startup process is located, the unknown process running in the specified namespace will not cause environmental pollution to the host machine. In addition, the behavior of the unknown process running in the specified namespace is further monitored, and then the unknown process running in the specified namespace is controlled based on the monitoring results. It can be seen that this solution can achieve effective control of unknown processes in a weak control state. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] Figure 1 This is a flow chart of a terminal weak control method provided by one embodiment of the present invention;

[0030] Figure 2 This is a hardware architecture diagram of an electronic device provided by one embodiment of the present invention;

[0031] Figure 3This is a structural diagram of a terminal weak control device provided by an embodiment of the present invention;

[0032] Figure 4 This is a structural diagram of another terminal weak control device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0034] As mentioned previously, strong control directly shuts down unknown processes to prevent them from posing threats to terminal devices while they are running. However, strong control has many drawbacks. Effectively controlling unknown processes in a weak control state could address these issues.

[0035] Based on this, the inventive concept of the present invention is that unknown processes will not be closed directly, but the unknown processes will be isolated and run using namespaces, so that the unknown processes are isolated from host resources to prevent host environment pollution, and the isolated unknown processes are continuously monitored to further determine whether the unknown processes are safe.

[0036] The specific implementation of the above concept is described below.

[0037] Please refer to Figure 1 , an embodiment of the present invention provides a terminal weak control method, the method comprising:

[0038] Step 100, in response to monitoring a program startup behavior, determining whether a startup process in the program startup behavior is a known trusted process;

[0039] Step 102: When it is determined that the startup process is not a known trusted process, the startup process is determined to be an unknown process, and a program execution instruction corresponding to the startup process is tampered with so that the startup process is started and executed in a designated namespace; the designated namespace is used to isolate accessible resources in the host computer where the startup process is located;

[0040] Step 104: Monitor the behavior of the unknown process running in the specified namespace, and manage and control the unknown process running in the specified namespace based on the monitoring results.

[0041] In an embodiment of the present invention, when the startup process is an unknown process, the program execution instructions corresponding to the startup process are tampered with so that the startup process is started in a designated namespace. Since the designated namespace is used to isolate the accessible resources in the host machine where the startup process is located, the unknown process running in the designated namespace will not cause environmental pollution to the host machine. In addition, the behavior of the unknown process running in the designated namespace is further monitored, and then the unknown process running in the designated namespace is controlled based on the monitoring results. It can be seen that this solution can achieve effective control of unknown processes in a weak control state.

[0042] Described below Figure 1 How to perform the steps shown.

[0043] First, with respect to step 100 , in response to monitoring a program startup behavior, it is determined whether the startup process in the program startup behavior is a known trusted process.

[0044] In the embodiment of the present invention, each startup process needs to be monitored to ensure that safe intervention can be performed when the process is started.

[0045] In one implementation, LSM (Linux Security Modules) technology, the kretprobe framework, and the like can be used to monitor program startup behavior. The LSM security module is a lightweight, universal access control framework for the Linux kernel. It enables various security access control models to be implemented as Linux loadable kernel modules. Users can select the appropriate security module to load into the Linux kernel based on their needs, significantly improving the flexibility and usability of the Linux security access control mechanism. Therefore, preferably, LSM technology is used in this embodiment to monitor program startup behavior.

[0046] In one embodiment of the present invention, when it is necessary to determine whether the startup process is a known trusted process, it can include: matching the startup process in the program startup behavior with the trusted processes in the trusted whitelist; if there is a trusted process that matches the startup process, then determining that the startup process is a known trusted process; otherwise, determining that the startup process is not a known trusted process.

[0047] The trusted whitelist is pre-generated. Specifically, the trusted whitelist may be generated by collecting and detecting operating system processes and adding processes that are found to be normal to the trusted whitelist.

[0048] When a startup process is detected, it is matched against the trusted whitelist. If the startup process exists in the trusted whitelist, it is considered a known trusted process. If the startup process does not exist in the feasible whitelist, it is not a known trusted process. If the startup process is a trusted process, it is directly released and allowed to use system resources.

[0049] Then, for step 102, when it is determined that the startup process is not a known trusted process, the startup process is determined to be an unknown process, and the program running instructions corresponding to the startup process are tampered with so that the startup process is started and run in a specified namespace; the specified namespace is used to isolate the accessible resources in the host machine where the startup process is located.

[0050] Namespaces are a form of code organization used in many programming languages. They categorize and distinguish different code functions, preventing conflicts caused by the same variable names when different code snippets (often used by different people to collaborate or call existing code snippets) are used simultaneously. A namespace is a virtual space whose internal virtual resources are isolated from the host's accessible resources.

[0051] When the startup process is not a known trusted process, it is determined that the startup process is an unknown process. An unknown process running on a host machine may cause environmental pollution to the host machine. Therefore, a namespace can be created in advance to isolate the namespace from accessible resources in the host machine where the startup process is located, and the startup process can be started and run in the specified namespace, thereby preventing untrusted processes from polluting the host machine's environment.

[0052] In an embodiment of the present invention, the number of designated namespaces can be one or more, and when an unknown process is monitored, the unknown process is placed in a designated namespace and started, with only one unknown process running in a designated namespace. That is, each time an unknown process is monitored, a namespace is selected from the remaining namespaces in which no unknown processes are running, and the monitored unknown process is placed in the selected namespace and started. After an unknown process in a namespace is paused, the namespace can continue to be available for selection as a namespace in which no unknown processes are running.

[0053] In one embodiment of the present invention, to modify the namespace of an unknown process, before tampering with the corresponding program execution instruction, the following steps may be performed: obtaining a first register parameter of a default namespace in which the startup process is running, and determining a second register parameter of a designated namespace assigned to the startup process. The default namespace in which the startup process is running is the host machine, and the designated namespace assigned to the startup process is a namespace selected from namespaces in which no unknown process is running.

[0054] Tampering with the program execution instruction corresponding to the startup process may include changing the first register parameter in the ESI register to the second register parameter. The ESI register is a type of CPU segment register in a computer, typically used as a "source address pointer" in memory operation instructions and capable of being loaded with any value. By changing the first register parameter in the ESI register to the second register parameter, the execution instruction is modified, causing the startup process to be launched in the specified namespace corresponding to the second register parameter.

[0055] Finally, with respect to step 104 , the behavior of the unknown process running in the specified namespace is monitored, and the unknown process running in the specified namespace is managed and controlled based on the monitoring result.

[0056] In the embodiment of the present invention, although the weak control method does not directly suspend the unknown process like the strong control method, but starts and runs it in the specified namespace, it is still necessary to monitor the behavior of the unknown process running in the specified namespace in order to further adopt the corresponding control method for control.

[0057] In this step, based on the process information of the unknown process, only the behavior of the unknown process can be monitored. Furthermore, since the process startup in the terminal device may involve a process startup chain, that is, the parent process starts the child process, and the child process starts another child process, etc., and there may be a parent process that does not have abnormal behavior, but the child process it starts has abnormal behavior. Therefore, in one embodiment of the present invention, this step of monitoring the behavior of the unknown process running in the specified namespace may include: based on the process information of the unknown process, determining the process startup chain of the unknown process, and monitoring the behavior of each process on the process startup chain. By determining the process startup chain of the unknown process and then monitoring the behavior of each process on the process startup chain, it is possible to achieve integrity monitoring of the unknown process and reduce the impact of abnormal behavior of the parent process and / or child process other than the unknown process on the process startup chain on the terminal device.

[0058] The process information may include at least one of: a process name, a path, parent process information, a process user name, and whether a process entity exists.

[0059] In an embodiment of the present invention, in order to ensure wide coverage of process behavior monitoring and improve accurate control of processes, the content of the behavior monitoring may include: at least one of resource usage, file operations, network requests and system configuration changes.

[0060] Furthermore, behavior monitoring content can be pre-labeled, such as which behaviors are abnormal and which are normal. For example, if a process is a fileless entity process, a name tampering process, a system disguised process, a hidden process, or an unauthorized process, it indicates that the process is performing abnormal behavior.

[0061] In order to further improve the effective control of unknown processes, in one embodiment of the present invention, the monitored abnormal behaviors can be correlated and analyzed. Specifically, the control of the unknown process running in the specified namespace based on the monitoring results may include: when the running time of the unknown process does not reach the preset time, but abnormal behavior of the unknown process is detected, the unknown process is determined to be an untrusted process, and according to the preset abnormal behavior analysis rules and the abnormal behavior in the monitoring results, the unknown process is evaluated for abnormalities, and the unknown process is controlled in accordance with the control method corresponding to the abnormal evaluation result.

[0062] The control method may include: not taking any control operation, controlling the network access behavior of the process, controlling the file operation behavior, controlling the process startup behavior, suspending the process operation and ending the process.

[0063] Specifically, when performing anomaly assessment on the unknown process, a weighted scoring method may be used, and the anomaly assessment result of the unknown process may be determined based on the corresponding relationship between the weighted score value and the anomaly assessment result. For example, the anomaly assessment result may be: normal, moderately abnormal, or severely abnormal.

[0064] For normal assessment results, the control methods implemented can be: no control operation;

[0065] For general abnormality assessment results, the control method implemented can be: controlling at least one of the following: controlling process network access behavior, controlling file operation behavior, controlling process startup behavior, and suspending process operation; and monitoring and analysis can continue until no abnormal behavior is found;

[0066] For severe anomaly assessment results, the control method implemented can be: terminate the process. Further, the process can be added to the process blacklist and its parent and child processes can be weighted for anomalies to directly terminate potential threats.

[0067] In one embodiment of the present invention, the following may also be included: when the unknown process has been running for a preset duration and no abnormal behavior is detected in the unknown process, the unknown process is determined to be a trusted process and the unknown process is updated to the trusted whitelist. For example, the preset duration is 7*24 hours. If there is no abnormal behavior, it indicates that the process is a safe process. By updating it to the trusted whitelist, the process will not need namespace isolation when it is started next time and can directly use system resources to run.

[0068] In this embodiment, by combining namespace isolation and process behavior monitoring, user interaction can be reduced, convenience of use can be provided, there is no need for synchronous blocking, resource usage is also lower, the management and control requirements of unknown processes can be met, and better stability and compatibility can be achieved.

[0069] like Figure 2 、 Figure 3 As shown, the embodiment of the present invention provides a terminal weak control device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, such as Figure 2 As shown in FIG. 1 , a hardware architecture diagram of an electronic device where a terminal weak control device is provided in an embodiment of the present invention is provided. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it. This embodiment provides a terminal weak control device, including:

[0070] The determining unit 301 is configured to determine, in response to monitoring a program startup behavior, whether a startup process in the program startup behavior is a known trusted process;

[0071] The instruction tampering unit 302 is configured to, when determining that the startup process is not a known trusted process, determine that the startup process is an unknown process, and tamper with the program execution instructions corresponding to the startup process so that the startup process is started and executed in a specified namespace; the specified namespace is used to isolate accessible resources in the host machine where the startup process is located;

[0072] The monitoring and control unit 303 is used to monitor the behavior of the unknown process running in the specified namespace, and control the unknown process running in the specified namespace according to the monitoring results.

[0073] In one embodiment of the present invention, the determination unit is specifically used to match the startup process in the program startup behavior with the trusted processes in the trusted whitelist; if there is a trusted process that matches the startup process, the startup process is determined to be a known trusted process; otherwise, the startup process is determined to be not a known trusted process.

[0074] In one embodiment of the present invention, the number of the designated namespaces is one or more, and one unknown process runs in one designated namespace;

[0075] The instruction tampering unit 302 is further configured to obtain a first register parameter of a default namespace for the startup process to run, and determine a second register parameter of a specified namespace allocated to the startup process, before tampering with the corresponding program execution instruction;

[0076] When tampering with the corresponding program running instruction, the instruction tampering unit 302 is specifically used to change the first register parameter in the ESI register to the second register parameter.

[0077] In one embodiment of the present invention, when the monitoring and control unit 303 performs behavior monitoring on an unknown process running in the specified namespace, it is specifically used to: determine the process startup chain of the unknown process based on the process information of the unknown process, and perform behavior monitoring on each process on the process startup chain.

[0078] In one embodiment of the present invention, the content of the behavior monitoring of the process includes at least one of resource occupation, file operation, network request and system configuration change.

[0079] In one embodiment of the present invention, when the monitoring and control unit 303 controls the unknown process running in the specified namespace according to the monitoring results, it is specifically used to: when the running time of the unknown process does not reach the preset time, but the unknown process is detected to have abnormal behavior, determine that the unknown process is an untrusted process, perform an abnormality assessment on the unknown process according to the preset abnormal behavior analysis rules and the abnormal behavior in the monitoring results, and control the unknown process according to the control method corresponding to the abnormal assessment result;

[0080] The control mode includes: not taking control operation, controlling process network access behavior, controlling file operation behavior, controlling process startup behavior, suspending process operation and ending process.

[0081] In one embodiment of the present invention, please refer to Figure 4 , the terminal weak control device may further include:

[0082] The updating unit 304 is configured to determine that the unknown process is a trusted process and update the unknown process to the trusted whitelist when the running time of the unknown process reaches a preset time and no abnormal behavior is detected for the unknown process.

[0083] It should be understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on a terminal weak control device. In other embodiments of the present invention, a terminal weak control device may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0084] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0085] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a terminal weak management and control method in any embodiment of the present invention is implemented.

[0086] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes a terminal weak management and control method according to any embodiment of the present invention.

[0087] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0088] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0089] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0090] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0091] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0092] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0093] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A terminal weak control method, characterized in that: include: In response to monitoring a program startup behavior, determining whether a startup process in the program startup behavior is a known trusted process; When it is determined that the startup process is not a known trusted process, the startup process is determined to be an unknown process, and the program execution instruction corresponding to the startup process is tampered with so that the startup process is started and run in a specified namespace; the specified namespace is used to isolate accessible resources in the host machine where the startup process is located; Behavior monitoring is performed on the unknown process running in the specified namespace, and the unknown process running in the specified namespace is managed and controlled based on the monitoring results.

2. The method according to claim 1, characterized in that Determining whether the startup process in the program startup behavior is a known trusted process includes: Matching the startup process in the program startup behavior with the trusted processes in the trusted whitelist; If there is a trusted process matching the startup process, then the startup process is determined to be a known trusted process; otherwise, it is determined that the startup process is not a known trusted process.

3. The method according to claim 1, characterized in that The number of the specified namespaces is one or more, and one unknown process runs in one specified namespace; Before tampering with the program execution instruction corresponding to the startup process, the method further includes: obtaining a first register parameter of a default namespace in which the startup process runs, and determining a second register parameter of a designated namespace allocated to the startup process; The tampering with the program running instruction corresponding to the startup process includes: changing the first register parameter in the ESI register to the second register parameter.

4. The method according to claim 1, wherein The monitoring of the behavior of the unknown process running in the specified namespace includes: Based on the process information of the unknown process, a process startup chain of the unknown process is determined, and behavior monitoring is performed on each process on the process startup chain.

5. The method according to claim 4, characterized in that The content of the behavior monitoring of the process includes at least one behavior selected from resource occupation, file operation, network request and system configuration change.

6. The method according to claim 1, characterized in that The controlling and managing the unknown processes running in the specified namespace according to the monitoring results includes: When the running time of the unknown process does not reach the preset time, but the unknown process is monitored to have abnormal behavior, the unknown process is determined to be an untrusted process, and an abnormality assessment is performed on the unknown process based on the preset abnormal behavior analysis rules and the abnormal behavior in the monitoring results, and the unknown process is controlled according to the control method corresponding to the abnormality assessment result; The control mode includes: not taking control operation, controlling process network access behavior, controlling file operation behavior, controlling process startup behavior, suspending process operation and ending process.

7. The method according to claim 6, characterized in that Also includes: When the running time of the unknown process reaches a preset time and no abnormal behavior is detected for the unknown process, the unknown process is determined to be a trusted process and the unknown process is updated to the trusted whitelist.

8. A terminal weak control device, characterized in that: include: a determining unit, configured to, in response to monitoring a program startup behavior, determine whether a startup process in the program startup behavior is a known trusted process; an instruction tampering unit configured to, when determining that the startup process is not a known trusted process, determine that the startup process is an unknown process, and tamper with a program execution instruction corresponding to the startup process so that the startup process is started and executed in a specified namespace; the specified namespace is used to isolate accessible resources in the host machine where the startup process is located; The monitoring and control unit is used to monitor the behavior of the unknown process running in the specified namespace and control the unknown process running in the specified namespace based on the monitoring results.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 7.

Images