A process detection method and device based on local rules

Abstract

The present invention provides a process detection method and device based on local rules. The method includes: obtaining callback information based on the behavior information of a target process, where the target process is created based on a target file; selecting a matching process based on local rules according to the connection status between the current client network and the cloud, and different matching processes based on local rules are selected according to different connection statuses between the current client network and the cloud; matching the callback information based on the selected matching process based on local rules, and if the match is successful, detecting the target process. When the cloud detection ability of the local client network is limited, the present invention provides some cloud capabilities for the isolated network environment of the local client network by sinking some cloud rules to build local rules, enhancing the detection ability of the isolated network environment of the local client network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to a method and device for detecting processes based on local rules. Background Art

[0002] The earliest prototype of the existing cloud query was to associate the hash of a file with its level in the cloud, and describe the risk level of the file through the level. Later, it evolved to report the behavior of an application as a query field to the cloud for matching, and return to the cloud to report suspicious behaviors after discovery, such as the cloud query of QiAnXin TianQin. However, no matter which mechanism is used, it cannot get rid of the heavy dependence on the cloud. In the isolated network environment commonly found in government and enterprise users, due to limited networking capabilities, its detection capabilities and operation capabilities are greatly limited, and it cannot meet the security needs of customers in the corresponding environment. Summary of the Invention

[0003] The present invention provides a method, device, electronic device, and storage medium for detecting processes based on local rules, to solve the problem that the existing security detection mechanism is too dependent on the cloud, and improve the security capabilities and operation capabilities of the isolated network by adopting the form of sinking a part of the key cloud rules to the local.

[0004] The present invention provides a method for detecting processes based on local rules, including:

[0005] Obtaining callback information based on the obtained behavior information of the target process, where the target process is created based on a target file;

[0006] Selecting a matching process based on local rules according to the connection status of the current client network with the cloud, where different connection statuses of the current client network with the cloud result in different selected matching processes based on local rules;

[0007] Matching the callback information based on the selected matching process based on local rules, and detecting the target process if the match is successful.

[0008] According to the method for detecting processes based on local rules provided by the present invention, the step of selecting a matching process based on local rules according to the connection status of the current client network with the cloud includes:

[0009] In the case where the current client network cannot be connected to the cloud, selecting a Crule matching process, where the Crule matching process is to match the callback information using the first matching rule stored locally;

[0010] When the current client network can be connected to the cloud, but no other queries can be executed on the cloud except for the level cloud query, the Locallev matching process is selected. The Locallev matching process is to match the callback information using the second matching rule stored locally when the level cloud query determines a non-risk event.

[0011] According to the process detection method based on local rules provided by the present invention, when the Crule matching process is selected, the matching process based on the selected local rules for matching the callback information includes:

[0012] Based on the callback information, determine the grouping information corresponding to the callback information;

[0013] Find the corresponding rule list according to the grouping information;

[0014] Traverse the rule list to determine the rule that matches the object. The callback information includes at least one object;

[0015] Traverse each sub-rule of the rule that matches the object to determine the sub-rule that matches the value of the object.

[0016] According to the process detection method based on local rules provided by the present invention, if the matching is successful, the target process is detected, including:

[0017] Use a Boolean expression to match the values of the sub-rules that match the value of the object;

[0018] If the Boolean expression is true, it is determined that the matching is successful, and the target process is detected.

[0019] According to the process detection method based on local rules provided by the present invention, when the Locallev matching process is selected, the matching process based on the selected local rules for matching the callback information includes:

[0020] Based on the callback information, obtain the rule ID;

[0021] Judge whether the rule ID matches the corresponding configuration in the second matching rule. If the matching is successful, judge whether the relevant process level of the target process matches the corresponding level information in the second matching rule. If the matching is successful, the target process is detected.

[0022] According to the process detection method based on local rules provided by the present invention, before obtaining the rule ID based on the callback information, it further includes:

[0023] Determine whether the target process is a risk event. If it is determined not to be a risk event, determine whether the target process is a synchronization event; wherein, the synchronization event refers to an event that needs to be suspended in the kernel and waits for the application layer to determine whether to continue.

[0024] If the target process is a synchronization event, based on the callback information, transfer to execute the step of obtaining the rule ID.

[0025] According to the process detection method based on local rules provided by the present invention, the relevant process levels include the source level, the target level, the source parent process level, and the process chain level. Determine whether the relevant process level of the target process matches the corresponding level information in the local rules. If the match is successful, detect the target process, including:

[0026] Determine whether the source level of the target process conforms to the source cloud network level in the second matching rule;

[0027] If the source level of the target process conforms to the source cloud network level in the second matching rule, determine whether the target level of the target process conforms to the target cloud network level in the second matching rule;

[0028] If the target level of the target process conforms to the target cloud network level in the second matching rule, determine whether the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule;

[0029] If the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule, obtain the level of the process chain of the target process;

[0030] Determine whether the level of the process chain conforms to the cloud network process chain level in the second matching rule;

[0031] If the level of the process chain conforms to the cloud network process chain level in the second matching rule, detect the target process.

[0032] The present invention also provides a process detection device based on local rules, including:

[0033] A callback information acquisition module, configured to obtain callback information based on the acquired behavior information of the target process, wherein the target process is created based on a target file;

[0034] A matching process determination module, configured to select a matching process based on local rules according to the connection status between the current client network and the cloud, wherein different connection statuses between the current client network and the cloud result in different selected matching processes based on local rules;

[0035] The detection module is used to match the callback information based on the matching process of the selected local rule. If the match is successful, it is detected that the target process matches successfully.

[0036] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the process detection method based on local rules as described in any one of the above.

[0037] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the process detection method based on local rules as described in any one of the above.

[0038] The process detection method, device, electronic device, and storage medium based on local rules provided by the present invention obtain callback information by based on the behavior information of the target process, where the target process is created based on a target file; according to the connection status of the current client network to the cloud, a matching process based on local rules is selected, where different connection statuses of the current client network to the cloud result in different selected matching processes based on local rules; based on the selected matching process of the local rule, the callback information is matched, and if the match is successful, the target process is detected. When the cloud detection ability of the local client network is limited, the present invention provides some cloud capabilities for the isolated network environment of the local client network by sinking some cloud rules to build local rules, enhancing the detection ability of the isolated network environment of the local client network. Description of the Drawings

[0039] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0040] Figure 1 It is a flowchart of the process detection method based on local rules provided by the present invention;

[0041] Figure 2 It is a structural diagram of the process detection device based on local rules provided by the present invention;

[0042] Figure 3 It is a structural diagram of the electronic device provided by the present invention. Detailed Embodiments

[0043] To make the objectives, technical solutions, and advantages of the present invention more clear, the following will describe the technical solutions in the present invention clearly and completely in conjunction with the accompanying drawings in the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without creative efforts fall within the protection scope of the present invention.

[0044] The following will describe in conjunction with Figures 1 - 3 the method, device, electronic device, and storage medium for process detection based on local rules of the present invention.

[0045] Figure 1 is a flowchart of the method for process detection based on local rules provided by the present invention. As Figure 1 shown, in a specific embodiment, a method for process detection based on local rules provided by the present invention includes the following steps:

[0046] S110. Obtain callback information based on the obtained behavior information of the target process, where the target process is created based on a target file;

[0047] S120. Select a matching process based on local rules according to the connection status of the current client network with the cloud, where different connection statuses of the current client network with the cloud result in different selected matching processes based on local rules;

[0048] S130. Based on the selected matching process of the local rules, match the callback information. If the match is successful, detect the target process.

[0049] In this embodiment, the local rules are a rule library formed by sinking a part of the key cloud rules to the local or some risk detection rules customized according to their own needs. The rules stored locally are used to detect the target process as the detection object for corresponding detection.

[0050] In this embodiment, the driver obtains the behavior information of the target process created based on the target file and generates callback information; according to the connection relationship between the current client network and the cloud, and in accordance with the user settings, select different matching processes based on local rules; based on the callback information, in combination with the selected matching process, match the callback information corresponding to the target process. If the match is successful, detect the corresponding target process.

[0051] The method for process detection based on local rules provided in this embodiment provides some cloud capabilities for the isolated network environment of the local client network by sinking some cloud rules to build local rules when the cloud detection capabilities of the local client network are limited, enhancing the detection capabilities of the isolated network environment of the local client network.

[0052] In a specific embodiment, according to the method for detecting processes based on local rules provided by the present invention, the selection of the matching process based on local rules according to the connection situation between the current client network and the cloud includes:

[0053] In the case where the current client network cannot be connected to the cloud, the Crule matching process is selected, and the Crule matching process is to match the callback information using the first matching rule stored locally;

[0054] In the case where the current client network can be connected to the cloud, but no other queries can be executed on the cloud except for level cloud queries, the Locallev matching process is selected, and the Locallev matching process is to match the callback information using the second matching rule stored locally when the level cloud query determines a non-risk event.

[0055] In this embodiment, the local rules include the Crule rule library, i.e., the first matching rule, and the Locallev rule library, i.e., the second matching rule. The Crule matching process is the matching process based on the Crule rule library, and the Locallev matching process is the matching process based on the Locallev rule library.

[0056] In this embodiment, in the case where the current client network is completely disconnected from the cloud, in combination with the user settings, it is determined whether to enter the Crule matching process of the local rules; when the current client network can only perform level cloud queries on the cloud, in combination with the user settings, it is determined whether to enter the locallev matching process of the local rules.

[0057] The method for detecting processes based on local rules provided by this embodiment effectively enhances the detection ability of the local client network in an isolated network environment by further explaining the matching processes of local rules in different situations.

[0058] In a specific embodiment, according to the method for detecting processes based on local rules provided by the present invention, when the Crule matching process is selected, the matching process based on the selected local rules for matching the callback information includes:

[0059] Based on the callback information, determine the grouping information corresponding to the callback information;

[0060] Find the corresponding rule list according to the grouping information;

[0061] Traverse the rule list to determine the rule that matches the object, and the callback information includes at least one object;

[0062] Traverse each sub - rule of the rule that matches the object to determine the sub - rule that matches the value of the object.

[0063] Further, if the match is successful, detect the target process, including:

[0064] Use a boolean expression to match the value of the sub - rule that matches the value of the object. If the boolean expression is true, it is determined that the match is successful, and the target process is detected.

[0065] In this embodiment, based on the callback information, determine the grouping information of the Crule rule library corresponding to the callback information; according to the grouping information of the Crule rule library, find the corresponding rule list. If the rule list corresponding to the callback information cannot be found, it means that the callback information does not match the Crule rule library, and the matching process ends; when there is a rule list corresponding to the callback information in the Crule rule library, traverse the rule list to determine the rule that matches the object. The callback information includes at least one object; traverse each sub - rule of the rule that matches the object to determine the sub - rule that matches the value of the object. Use a boolean expression to judge the value of the sub - rule that matches the value of the object. If all boolean expressions are true, the target process is detected. That is to say, the value of the sub - rule is a family, there are many of them, and all need to be judged by the boolean expression. If the boolean expression is false, further judge whether the traversal of the rule list is over. If it is not over, continue to traverse from the beginning and execute the subsequent search and judgment steps. If it is over, it means that there is no match, that is, the target process is okay and is a safe and normal process.

[0066] The process detection method based on local rules provided in this embodiment, when selecting the Crule matching process based on local rules, enriches the specific implementation path by further expanding the specific implementation steps of the Crule matching process, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0067] In a specific embodiment, according to the process detection method based on local rules provided by the present invention, when selecting the Locallev matching process, the matching process based on the selected local rules for the callback information includes:

[0068] Based on the callback information, obtain the rule ID;

[0069] Judge whether the rule ID matches the corresponding configuration in the second matching rule. If the match is successful, judge whether the relevant process level of the target process matches the corresponding level information in the second matching rule. In the case of a successful match, detect the target process.

[0070] In this embodiment, the Locallev matching process is for the local client network environment that can obtain levels through hash cloud search but cannot perform behavior cloud search. It makes more detailed discrimination and detection based on the cloud network levels of different objects (such as SRC, DST, etc.). The rule ID refers to the rule ID corresponding to the target process.

[0071] In this embodiment, based on the callback information, obtain the rule ID corresponding to the target process; determine whether the rule ID matches the corresponding configuration in the second matching rule. If the match is unsuccessful, end the matching process. If the match is successful, determine whether the relevant process level of the target process matches the corresponding level information in the second matching rule. If the match is successful, detect the target process; otherwise, end the Locallev matching process.

[0072] The process detection method based on local rules provided in this embodiment, when selecting the Locallev matching process based on local rules, enriches the specific implementation path by further expanding the specific implementation steps of the Locallev matching process, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0073] In a specific embodiment, according to the process detection method based on local rules provided by the present invention, before obtaining the rule ID based on the callback information, it further includes:

[0074] Determine whether the target process is a risk event. If it is determined not to be a risk event, determine whether the target process is a synchronization event; wherein, the synchronization event refers to an event that needs to be suspended in the kernel and waits for the application layer to determine whether to continue.

[0075] If the target process is a synchronization event, based on the callback information, transfer to execute the step of obtaining the rule ID.

[0076] In this embodiment, the synchronization event refers to an event that needs to be suspended in the kernel and waits for the application layer to determine whether to continue the process.

[0077] In this embodiment, determine whether the target process is a risk event. If it is not a risk event, determine whether the target process is a synchronization event. If it is a risk event, end the Locallev matching process; if the target process is a synchronization event, based on the callback information, obtain the event type and the rule ID. If the target process is not a synchronization event, end the Locallev matching process.

[0078] The process detection method based on local rules provided in this embodiment further explains the pre - steps of the Locallev matching process, enriches the specific implementation path, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0079] In a specific embodiment, according to the process detection method based on local rules provided by the present invention, the relevant process levels include source level, target level, source parent process level, and process chain level. To determine whether the relevant process level of the target process matches the corresponding level information in the local rules, and when the match is successful, detecting the target process includes:

[0080] Determine whether the source level of the target process conforms to the source cloud network level in the second matching rule;

[0081] When the source level of the target process conforms to the source cloud network level in the second matching rule, determine whether the target level of the target process conforms to the target cloud network level in the second matching rule;

[0082] When the target level of the target process conforms to the target cloud network level in the second matching rule, determine whether the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule;

[0083] When the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule, obtain the level of the process chain of the target process;

[0084] Determine whether the level of the process chain conforms to the cloud network process chain level in the second matching rule;

[0085] When the level of the process chain conforms to the cloud network process chain level in the second matching rule, detect the target process.

[0086] In this embodiment, it is determined whether the source level of the target process conforms to the source cloud network level in the second matching rule; if the source level of the target process does not conform to the source cloud network level in the second matching rule, the Locallev matching process ends; if the source level of the target process conforms to the source cloud network level in the second matching rule, it is determined whether the target level of the target process conforms to the target cloud network level in the second matching rule; if the target level of the target process does not conform to the target cloud network level in the second matching rule, the Locallev matching process ends; if the target level of the target process conforms to the target cloud network level in the second matching rule, it is determined whether the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule; if the source parent process level of the target process does not conform to the source parent process cloud network level in the second matching rule, the Locallev matching process ends; if the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule, the level of the process chain of the target process is obtained; it is determined whether the level of the process chain conforms to the cloud network process chain level in the second matching rule; if the level of the process chain conforms to the cloud network process chain level in the second matching rule, the Locallev matching process ends; if the level of the process chain conforms to the cloud network process chain level in the second matching rule, the target process is detected.

[0087] The process detection method based on local rules provided in this embodiment further elaborates on whether the relevant process levels of the target process in the Locallev matching process match the corresponding level information in the local rules, enriching the specific implementation path and effectively enhancing the detection ability of the local client network in the isolated network environment.

[0088] Next, a process detection device based on local rules provided by the present invention will be described. The process detection device based on local rules described below can be correspondingly referred to the process detection method based on local rules described above.

[0089] Figure 2 is the structural diagram of the process detection device based on local rules provided by the present invention, as Figure 2 shown. In a specific embodiment, the process detection device based on local rules provided by the present invention includes:

[0090] A callback information acquisition module 210, configured to obtain callback information based on the acquired behavior information of the target process, where the target process is created based on a target file;

[0091] A matching process determination module 220, configured to select a matching process based on local rules according to the connection status of the current client network with the cloud, where different connection statuses of the current client network with the cloud result in different selected matching processes based on local rules;

[0092] A detection module 230, configured to perform matching on the callback information based on the matching process of the selected local rule, and if the matching is successful, it is detected that the target process matches successfully.

[0093] The process detection device based on local rules provided in this embodiment, in the case where the cloud detection capability of the local client network is limited, by setting a callback information acquisition module, a matching process determination module, and a detection module, sinks some cloud rules, constructs local rules, and provides some cloud capabilities for the isolated network environment of the local client network, enhancing the detection capability of the isolated network environment of the local client network.

[0094] In a specific embodiment, for the process detection device based on local rules provided by the present invention, the matching process determination module 220 includes:

[0095] A matching process determination unit, configured to select a Crule matching process in the case where the current client network is unable to connect to the cloud, and the Crule matching process is to perform matching on the callback information using the first matching rule stored locally;

[0096] In the case where the current client network can connect to the cloud, but other queries cannot be executed on the cloud except for level cloud checking, select a Locallev matching process, and the Locallev matching process is to perform matching on the callback information using the second matching rule stored locally in the case where the level cloud check determines a non-risk event.

[0097] The process detection device based on local rules provided in this embodiment, by setting a matching process determination unit, further explains the matching process of local rules in different situations, and effectively enhances the detection capability of the local client network in the isolated network environment.

[0098] In a specific embodiment, for the process detection device based on local rules provided by the present invention, when the Crule matching process is selected, the detection module 230 includes a first detection sub-module, and the first detection sub-module includes:

[0099] A search unit, configured to determine grouping information corresponding to the callback information based on the callback information; search for a corresponding rule list according to the grouping information; traverse the rule list to determine a rule that matches the object, and the callback information includes at least one object; traverse each sub-rule of the rule that matches the object to determine a sub-rule that matches the value of the object.

[0100] Further, the first detection sub-module further includes a Boolean expression judgment unit, which is used to match the values of sub-rules that match the value of the object by using a Boolean expression; if the Boolean expression is true, it is determined that the match is successful, and the target process is detected.

[0101] The process detection device based on local rules provided in this embodiment, when selecting the Crule matching process based on local rules, further expands the specific implementation steps of the Crule matching process by setting up a search unit and a Boolean expression judgment unit, enriches the specific implementation path, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0102] In a specific embodiment, for the process detection device based on local rules provided by the present invention, when selecting the Locallev matching process, the detection module 230 includes a second detection sub-module, and the second detection sub-module includes:

[0103] An acquisition unit, which is used to acquire a rule ID based on the callback information;

[0104] A process level judgment unit, which is used to judge whether the rule ID matches the corresponding configuration in the second matching rule. If the match is successful, it is judged whether the relevant process level of the target process matches the corresponding level information in the second matching rule. In the case of a successful match, the target process is detected.

[0105] The process detection device based on local rules provided in this embodiment, when selecting the Locallev matching process based on local rules, further expands the specific implementation steps of the Locallev matching process by setting up an acquisition unit and a process level judgment unit, enriches the specific implementation path, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0106] In a specific embodiment, the process detection device based on local rules provided by the present invention further includes:

[0107] An event judgment unit, which is used to judge whether the target process is a risk event. In the case of judging that it is not a risk event, it is judged whether the target process is a synchronization event; wherein, the synchronization event refers to an event that needs to be suspended in the kernel and waits for the application layer to judge whether to continue. In the case of the target process being a synchronization event, based on the callback information, it is transferred to execute the step of acquiring the rule ID.

[0108] The process detection device based on local rules provided in this embodiment further illustrates the pre - steps of the Locallev matching process by setting up an event judgment unit, enriches the specific implementation path, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0109] In a specific embodiment, for the process detection device based on local rules provided by the present invention, the relevant process levels include a source level, a target level, a source parent process level, and a process chain level. The process level judgment unit further includes:

[0110] A process level judgment subunit, configured to judge whether the source level of the target process conforms to the source cloud network level in the second matching rule; in the case where the source level of the target process conforms to the source cloud network level in the second matching rule, judge whether the target level of the target process conforms to the target cloud network level in the second matching rule; in the case where the target level of the target process conforms to the target cloud network level in the second matching rule, judge whether the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule; in the case where the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule, obtain the level of the process chain of the target process; judge whether the level of the process chain conforms to the cloud network process chain level in the second matching rule; in the case where the level of the process chain conforms to the cloud network process chain level in the second matching rule, detect the target process.

[0111] The process detection device based on local rules provided in this embodiment further elaborates on whether the relevant process levels of the target process in the Locallev matching process match the corresponding level information in the local rules by setting up a process level judgment subunit, enriches the specific implementation path, and effectively enhances the detection ability of the local client network in the isolated network environment.

[0112] Figure 3 An example of the schematic physical structure of an electronic device is as Figure 3 shown. The electronic device may include: a processor 310, a communication interface 320, a memory 330, and a communication bus 340. Among them, the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can call the logical instructions in the memory 330 to execute the process detection method based on local rules, and this method includes:

[0113] Obtaining callback information based on the obtained behavior information of the target process, where the target process is created based on a target file;

[0114] Based on the connection status of the current client network with the cloud, a matching process based on local rules is selected. Among them, when the connection status of the current client network with the cloud is different, the selected matching process based on local rules is different;

[0115] Based on the selected matching process of the local rules, match the callback information. If the match is successful, the target process is detected.

[0116] In addition, when the logical instructions in the above-mentioned memory 330 can be implemented in the form of software functional units and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0117] On the other hand, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is used to execute the process detection method based on local rules provided by the above-mentioned various methods. The method includes:

[0118] Based on the obtained behavior information of the target process, callback information is obtained, where the target process is created based on a target file;

[0119] Based on the connection status of the current client network with the cloud, a matching process based on local rules is selected. Among them, when the connection status of the current client network with the cloud is different, the selected matching process based on local rules is different;

[0120] Based on the selected matching process of the local rules, match the callback information. If the match is successful, the target process is detected.

[0121] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative work.

[0122] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments or perform equivalent replacements for some of the technical features. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A process detection method based on local rules, characterized in that Including: Obtaining callback information based on the acquired behavior information of the target process, where the target process is created based on a target file; Selecting a matching process based on local rules according to the connection status of the current client network with the cloud, where different connection statuses of the current client network with the cloud result in different selected matching processes based on local rules; Matching the callback information based on the selected matching process based on local rules, and detecting the target process if the match is successful; The step of selecting a matching process based on local rules according to the connection status of the current client network with the cloud includes: In the case where the current client network cannot be connected to the cloud, selecting the Crule matching process, and the Crule matching process is to match the callback information using the first matching rule stored locally; In the case where the current client network can be connected to the cloud, but no other queries can be executed on the cloud except for determining that the target process is a non-risk event, selecting the Locallev matching process, and the Locallev matching process is to match the callback information using the second matching rule stored locally in the case where the target process is determined to be a non-risk event.

2. The process detection method based on local rules according to claim 1, wherein When the Crule matching process is selected, the step of matching the callback information based on the selected matching process based on local rules includes: Determining grouping information corresponding to the callback information based on the callback information; Searching for a corresponding rule list according to the grouping information; Traversing the rule list to determine a rule that matches the object, and the callback information includes at least one object; Traversing each sub-rule of the rule that matches the object to determine a sub-rule that matches the value of the object.

3. The method for detecting a process based on local rules according to claim 2, wherein The step of detecting the target process if the match is successful includes: Matching the values of the sub-rules that match the value of the object using a Boolean expression; If the Boolean expression is true, determining that the match is successful and detecting the target process.

4. The process detection method based on local rules according to claim 1, characterized in that, When the Locallev matching process is selected, the step of matching the callback information based on the selected matching process based on local rules includes: Obtaining a rule ID based on the callback information; Determining whether the rule ID matches the corresponding configuration in the second matching rule. If the match is successful, determining whether the relevant process level of the target process matches the corresponding level information in the second matching rule, and detecting the target process in the case of a successful match; The relevant process level includes a source level, a target level, a source parent process level, and a process chain level.

5. The process detection method based on local rules according to claim 4, wherein, Before the step of obtaining a rule ID based on the callback information, it further includes: Determining whether the target process is a risk event. In the case where it is determined not to be a risk event, determining whether the target process is a synchronization event; where the synchronization event refers to an event that needs to be suspended in the kernel and waits for the application layer to determine whether to continue; In the case where the target process is a synchronization event, based on the callback information, transferring to execute the step of obtaining the rule ID.

6. The process detection method based on local rules according to claim 4, characterized in that, Determine whether the relevant process level of the target process matches the corresponding level information in the local rule. In the case of successful matching, detect the target process, including: Determine whether the source level of the target process conforms to the source cloud network level in the second matching rule; In the case where the source level of the target process conforms to the source cloud network level in the second matching rule, determine whether the target level of the target process conforms to the target cloud network level in the second matching rule; In the case where the target level of the target process conforms to the target cloud network level in the second matching rule, determine whether the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule; In the case where the source parent process level of the target process conforms to the source parent process cloud network level in the second matching rule, obtain the level of the process chain of the target process; Determine whether the level of the process chain conforms to the cloud network process chain level in the second matching rule; In the case where the level of the process chain conforms to the cloud network process chain level in the second matching rule, detect the target process.

7. A process detection device based on local rules, characterized in that Including: A callback information acquisition module, configured to obtain callback information based on the acquired behavior information of the target process, where the target process is created based on a target file; A matching process determination module, configured to select a matching process based on local rules according to the connection status between the current client network and the cloud, where different connection statuses between the current client network and the cloud result in different selected matching processes based on local rules; A detection module, configured to match the callback information based on the selected matching process based on local rules, and if the match is successful, detect that the target process match is successful; The matching process determination module is specifically configured to: In the case where the current client network is unable to connect to the cloud, select the Crule matching process, where the Crule matching process is to match the callback information using the first matching rule stored locally; In the case where the current client network can connect to the cloud, but no other queries can be performed on the cloud except to determine that the target process is a non-risk event, select the Locallev matching process, where the Locallev matching process is to match the callback information using the second matching rule stored locally in the case of determining that the target process is a non-risk event.

8. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, When the processor executes the program, it implements the process detection method based on local rules according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the process detection method based on local rules according to any one of claims 1 to 6.

Images