An executable file interception method, system and storage medium based on Ring3 layer query

Abstract

The application provides an executable file interception method based on Ring3 layer query, and the monitoring and communication between an application layer and a driver layer are established by creating a process monitoring callback function; communication data is acquired for cleaning and assembling, and the communication data is sent to the application layer through a MiniFilter; executable file information in the communication information is acquired, and a data set is matched according to the executable file information; and it is judged whether the executable file information meets a release standard according to the matching condition of the executable file information and the data set, and a release or rejection instruction is sent. According to the application, the interception or release of the driver to the executable file is determined according to the query result, the interception process is efficient and safe, the stability of the native machine is reduced as much as possible, the problem of system crash caused by errors is avoided, and the application can be applied to the fields of subdivided industrial control network security and consumer host security.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and more specifically, relates to an executable file interception method, system, and storage medium based on Ring3 layer query. Background Technology

[0002] China has developed into a country with the world's most comprehensive industrial sectors, and its industrial manufacturing is gradually moving towards intelligence and automation. However, while product quality and production efficiency are constantly improving, the industrial control systems supporting industrial manufacturing are facing increasingly serious security problems, such as SQL injection, worm viruses, web vulnerabilities, hacker attacks, DDoS attacks, and cross-site scripting. Once these attacks take effect, they can cause anything from mechanical failures and production line shutdowns to severely impacting national industrial manufacturing, paralyzing information networks, and threatening national defense and people's livelihoods. Malicious attacks are often accompanied by the execution of malicious executable files, so timely detection and successful blocking of malicious executable behavior is an important means of ensuring the stable operation of the system.

[0003] Traditional executable file interception methods use hooking techniques, which modify critical memory locations. This involves retrieving data and loading it into memory during driver startup, allowing both user-mode applications and kernel-mode drivers to read and write it. While memory operations can offer some performance improvements, inconsistencies, especially when the application and driver layers can read and write simultaneously, can easily lead to security issues. For example, on 64-bit machines, Microsoft added PatchGuard, a kernel patch protection feature that checks for unsupported modifications to core Windows operating system components and the kernel. Unauthorized modification of PatchGuard triggers a defect check and a blue screen crash, shutting down the system. While there are ways to bypass PatchGuard, this can cause system instability, impacting industrial control systems with extremely stringent stability requirements. Furthermore, traditional driver interception stores data in a single memory location for both application and driver layers, raising the issue of read / write consistency. This can easily cause driver crashes and blue screens, and since most industrial control systems don't have ideal hardware, insufficient memory may be available if the data volume is too large. Summary of the Invention

[0004] In view of this, this application provides an executable file interception method, system and storage medium based on Ring3 layer query, which solves the problems of unstable process interception, low interception efficiency and easy system crash in the field of network security.

[0005] The specific technical solution of this application is as follows:

[0006] The first aspect of this application provides an executable file interception method based on Ring3 layer query, comprising the following steps:

[0007] Create a process monitoring callback function to establish monitoring and communication between the application layer and the driver layer. The process monitoring callback function is set through PsSetCreateProcessNotifyRoutineEx.

[0008] The communication data is acquired, cleaned, and assembled, and then sent to the application layer through MiniFilter;

[0009] Obtain executable file information from communication messages, and match the dataset based on the executable file information;

[0010] The system determines whether the executable file information meets the release criteria based on the matching of the dataset information, and issues a release or rejection command.

[0011] Preferably, the process of acquiring, cleaning, and assembling the communication data specifically involves:

[0012] Obtain the PEPROCESS information of the currently started process through the input parameter Process;

[0013] The PID parameter of the currently started process can be obtained through the input parameter ProcessId;

[0014] Additional information about the currently started process can be obtained through the input parameter PPS_CREATE_NOTIFY_INFO CreateInfo;

[0015] The additional information includes command-line instructions, process name, thread ID, and parent process PID.

[0016] Preferably, sending communication data to the application layer via MiniFilter specifically involves:

[0017] A communication port is created using FltCreateCommunicationPort, communication data is actively sent to the application layer using FltSendMessage, and communication data is received from the MiniFilter using FilterGetMessage.

[0018] Preferably, the step of matching the dataset based on the executable file information specifically involves:

[0019] Retrieve the blacklist dataset from the database;

[0020] Determine if the executable file information exists in the blacklist dataset in the database. If it exists, the match fails; otherwise, the match succeeds.

[0021] Preferably, the dataset is stored in an SQLite database and a Redis database, wherein the SQLite database is encrypted using AES-ECB mode.

[0022] Preferably, the step of determining whether the release criteria are met based on the matching of the executable file information and the dataset, and issuing a release or rejection instruction, specifically involves:

[0023] When the release criteria are met, a release flag is set for the executable file information;

[0024] Assign a value to the input parameter CreateInfo->CreationStatus based on the release flag;

[0025] Create a pass or deny command based on the assigned value.

[0026] Preferably, setting a release flag for executable file information specifically involves:

[0027] The MiniFilter also sets the ReplyBuffer to receive the returned data;

[0028] The release flag is recorded in the ReplyBuffer, and the ReplyBuffer is returned to the driver layer.

[0029] Preferably, returning the ReplyBuffer to the driver layer specifically involves:

[0030] The communication port is connected via FilterConnectCommunicationPort, and FilterReplyMessage is used to actively send ReplyBuffer to the driver layer. MessageCallBack is used to receive communication data from the application layer.

[0031] A second aspect of this application provides an executable file interception system based on Ring3 layer querying, including a memory and a processor. The memory includes an executable file interception program based on Ring3 layer querying. When the executable file interception program based on Ring3 layer querying is executed by the processor, it performs the following steps:

[0032] Create a process monitoring callback function to establish monitoring and communication between the application layer and the driver layer. The process monitoring callback function is set through PsSetCreateProcessNotifyRoutineEx.

[0033] The communication data is acquired, cleaned, and assembled, and then sent to the application layer through MiniFilter;

[0034] Obtain executable file information from communication messages, and match the dataset based on the executable file information;

[0035] The system determines whether the executable file information meets the release criteria based on the matching of the dataset information, and issues a release or rejection command.

[0036] Preferably, the process of acquiring, cleaning, and assembling the communication data specifically involves:

[0037] Obtain the PEPROCESS information of the currently started process through the input parameter Process;

[0038] The PID parameter of the currently started process can be obtained through the input parameter ProcessId;

[0039] Additional information about the currently started process can be obtained through the input parameter PPS_CREATE_NOTIFY_INFO CreateInfo;

[0040] The additional information includes command-line instructions, process name, thread ID, and parent process PID.

[0041] Preferably, sending communication data to the application layer via MiniFilter specifically involves:

[0042] A communication port is created using FltCreateCommunicationPort, communication data is actively sent to the application layer using FltSendMessage, and communication data is received from the MiniFilter using FilterGetMessage.

[0043] Preferably, the step of matching the dataset based on the executable file information specifically involves:

[0044] Retrieve the blacklist dataset from the database;

[0045] Determine if the executable file information exists in the blacklist dataset in the database. If it exists, the match fails; otherwise, the match succeeds.

[0046] Preferably, the dataset is stored in an SQLite database and a Redis database, wherein the SQLite database is encrypted using AES-ECB mode.

[0047] Preferably, the step of determining whether the release criteria are met based on the matching of the executable file information and the dataset, and issuing a release or rejection instruction, specifically involves:

[0048] When the release criteria are met, a release flag is set for the executable file information;

[0049] Assign a value to the input parameter CreateInfo->CreationStatus based on the release flag;

[0050] Create a pass or deny command based on the assigned value.

[0051] Preferably, setting a release flag for executable file information specifically involves:

[0052] The MiniFilter also sets the ReplyBuffer to receive the returned data;

[0053] The release flag is recorded in the ReplyBuffer, and the ReplyBuffer is returned to the driver layer.

[0054] Preferably, returning the ReplyBuffer to the driver layer specifically involves:

[0055] The communication port is connected via FilterConnectCommunicationPort, and FilterReplyMessage is used to actively send ReplyBuffer to the driver layer. MessageCallBack is used to receive communication data from the application layer.

[0056] A third aspect of this application provides a computer-readable storage medium including an executable file interception program based on Ring3 layer query, wherein when the executable file interception program based on Ring3 layer query is executed by a processor, it implements the steps of the executable file interception method based on Ring3 layer query.

[0057] In summary, this application provides an executable file interception method based on Ring3 layer query. It establishes monitoring and communication between the application layer and the driver layer by creating a process monitoring callback function; it acquires, cleans, and assembles communication data, and sends the communication data to the application layer through a MiniFilter; it obtains executable file information from the communication information and matches the dataset based on the executable file information; it determines whether the data meets the allowance criteria based on the matching of the executable file information and the dataset, and issues an allow or deny command. This method can be applied to specific fields such as industrial control network security and consumer host security.

[0058] Compared with the prior art, the beneficial effects of this application are:

[0059] 1. Utilizing the MiniFilter driver deployed on the Windows operating system, key behaviors of executable files are collected and summarized by analyzing specified IRP operations. These summaries are then sent to the application layer for software analysis via driver communication technology. Upon receiving the behavioral data, the application layer software further refines it and queries a local sample library. Based on the query results, it decides whether the driver should block or allow the executable file, thus streamlining and ensuring the interception process is efficient and secure, minimizing the impact on local stability and preventing system crashes due to errors.

[0060] 2. Through Minifilter communication technology and database queries, query results can be easily obtained, and the local sample library can be dynamically and quickly expanded, facilitating sample library backup and migration operations. The application-layer database-based search method does not cause serious kernel errors, and because it uses disk space, it does not require high memory. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a flowchart illustrating an executable file interception method based on Ring3 layer querying according to this application;

[0063] Figure 2 This is a block diagram of an executable file interception system based on Ring3 layer query according to this application. Detailed Implementation

[0064] To make the objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application are clearly and completely described. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0065] Glossary: ​​MiniFilter: A file filter framework provided by Microsoft that allows users to filter file system and IRP data.

[0066] IRP (I / O request packets): A kernel-mode structure used by Microsoft for communication between drivers and the operating system. It is a data structure that describes I / O requests.

[0067] Ring 3: The CPU's instruction execution privilege level. In the common x64 architecture, there are two levels: Ring 0 has the highest privilege and is used by the kernel mode, while Ring 3 is used by the user mode.

[0068] SQLite: A high-performance relational database.

[0069] Redis: An open-source, network-enabled, distributed, in-memory relational database.

[0070] Please refer to Figure 1 , Figure 1 This is a flowchart of an executable file interception method based on Ring3 layer query according to this application.

[0071] The first aspect of this application provides an executable file interception method based on Ring3 layer query, comprising the following steps:

[0072] S102: Create a process monitoring callback function to establish monitoring and communication between the application layer and the driver layer. The process monitoring callback function is set through PsSetCreateProcessNotifyRoutineEx.

[0073] S104: Acquire communication data, clean and assemble it, and send the communication data to the application layer through MiniFilter;

[0074] S106: Obtain executable file information from communication information, and match the dataset based on the executable file information;

[0075] S108: Determine whether the release criteria are met based on the matching of executable file information and dataset, and issue a release or rejection instruction.

[0076] It should be noted that the monitoring and communication between the application layer and driver layer in S102 is based on the MiniFilter driver, and can be applied to Vista and Windows operating systems. Because it has a complete communication interface between the application layer and driver layer, the two can be combined to achieve efficient monitoring and communication between applications and drivers.

[0077] In S104, by acquiring communication data and analyzing IRP operations, the key behavioral information of the collected executable file is organized and sent to the application layer, which can eliminate some interfering behavioral information and improve operating efficiency.

[0078] In step S106, the acquired communication information is further refined and transformed into executable file information. This executable file information is then queried and matched against a pre-defined dataset to determine whether to block or allow the executable file. The executable file information includes the filename, path, extension, MD5 value, and time.

[0079] In S108, if the executable file information successfully matches the dataset, the release criterion is met, and a release command is issued, allowing the executable file to run, modify, delete, or perform other operations. Conversely, if the executable file information fails to match the dataset, the release criterion is not met, and a denial command is issued, restricting the execution of the executable file and its impact on the system.

[0080] The executable file interception method based on Ring3 layer query in this embodiment utilizes the MiniFilter driver to determine whether to intercept or allow the executable file based on the query results of the Ring3 layer in the dataset. It has the advantages of high efficiency and security, reduces the impact on the stability of the local machine, and avoids the problem of system crash due to errors.

[0081] According to the embodiments of this application, the specific steps of acquiring, cleaning, and assembling communication data are as follows:

[0082] Obtain the PEPROCESS information of the currently started process through the input parameter Process;

[0083] The PID parameter of the currently started process can be obtained through the input parameter ProcessId;

[0084] Additional information about the currently started process can be obtained through the input parameter PPS_CREATE_NOTIFY_INFO CreateInfo;

[0085] The additional information includes command-line instructions, process name, thread ID, and parent process PID.

[0086] It should be noted that by analyzing key IRP operation behaviors by acquiring PEPROCESS information, PID parameters, and other information, interference information can be initially filtered out.

[0087] According to an embodiment of this application, sending communication data to the application layer via MiniFilter specifically involves:

[0088] A communication port is created using FltCreateCommunicationPort, communication data is actively sent to the application layer using FltSendMessage, and communication data is received from the MiniFilter using FilterGetMessage.

[0089] According to an embodiment of this application, the specific steps of matching the dataset based on the executable file information are as follows:

[0090] Retrieve the blacklist dataset from the database;

[0091] Determine if the executable file information exists in the blacklist dataset in the database. If it exists, the match fails; otherwise, the match succeeds.

[0092] It should be noted that the application already possesses a dataset containing blacklists and whitelists of executable files, which can be stored in text or database format. Data querying and matching via a database allows for convenient retrieval of results, dynamic and rapid expansion of the local sample library, and facilitates sample library backup and migration operations without causing serious kernel errors, while also eliminating the need for demanding high memory requirements.

[0093] According to an embodiment of this application, the dataset is stored in an SQLite database and a Redis database, wherein the SQLite database is encrypted using AES-ECB mode.

[0094] It should be noted that SQLite and Redis are used for data storage to ensure efficient read and write operations. SQLite provides data preservation after power failure, while Redis provides runtime data read and write capabilities. Furthermore, because the common format of SQLite databases is easily readable, AES-ECB mode is used for high-strength encryption to prevent malicious third-party programs from reading, analyzing, or tampering with our data.

[0095] According to an embodiment of this application, the step of determining whether the release criteria are met based on the matching of executable file information and dataset, and issuing a release or rejection instruction, specifically involves:

[0096] When the release criteria are met, a release flag is set for the executable file information;

[0097] Assign a value to the input parameter CreateInfo->CreationStatus based on the release flag;

[0098] Create a pass or deny command based on the assigned value.

[0099] It should be noted that if the executable file information successfully matches the dataset, it meets the release criteria. After obtaining the release flag stored in the ReplyBuffer, the MiniFilter driver assigns a value to the input parameter CreateInfo->CreationStatus based on this flag. Specifically, CreateInfo->CreationStatus = STATUS_ACCESS_DENIED indicates a creation rejection instruction, while not assigning a value or CreateInfo->CreationStatus = STATUS_SUCCESSFUL indicates a creation release instruction.

[0100] According to the embodiments of this application, setting a release flag for executable file information specifically involves:

[0101] The MiniFilter also sets the ReplyBuffer to receive the returned data;

[0102] The release flag is recorded in the ReplyBuffer, and the ReplyBuffer is returned to the driver layer.

[0103] It's important to note that while actively sending communication data to the application layer using FltSendMessage, a ReplyBuffer is also set to store the tag information returned to the driver layer, ensuring accurate and rapid transmission of the judgment result. Additionally, to avoid potential system lag, the last parameter, Timeout, needs to be set when using FltSendMessage in the driver. Setting this parameter to NULL indicates indefinite waiting for the application layer's return result. If the application layer's return data is delayed due to unforeseen circumstances, it will cause system lag.

[0104] According to the embodiments of this application, returning the ReplyBuffer to the driver layer specifically involves:

[0105] The communication port is connected via FilterConnectCommunicationPort, and FilterReplyMessage is used to actively send ReplyBuffer to the driver layer. MessageCallBack is used to receive communication data from the application layer.

[0106] In another embodiment of this application, after obtaining the executable file information from the communication information and before matching the dataset based on the executable file information, the method further includes:

[0107] Obtain the security information of the executable file, including the security level and permissions;

[0108] Executable file information is grouped according to security level and permission strength, and each group uses a different association function when matching with the dataset.

[0109] It should be noted that different association functions are set for matching datasets based on the security level and permission strength of the executable file. For example, for files with high security level and permissions, in order to enhance the interception effect and improve security performance, the range of associated data can be expanded using association functions. This can avoid the illusion of a successful match caused by data tampering. The association function can be determined based on the common data transformation types in this field.

[0110] In another embodiment of this application, the step of matching the dataset based on executable file information further includes:

[0111] Retrieve the whitelist dataset from the database;

[0112] Check if the executable file information exists in the whitelist dataset in the database; if it does, the match is successful.

[0113] If it does not exist, the algorithm function calculates the correlation between the executable file information and the blacklist / whitelist dataset. If the correlation exceeds the threshold, it is determined that it exists in the corresponding dataset.

[0114] It should be noted that the blacklists and whitelists in the dataset can be determined based on data calculated in this field. The blacklist and whitelist datasets can directly filter executable file information. If direct identification is not possible, algorithmic functions can be used to perform correlation analysis between the information and the corresponding list datasets. This allows for the identification and classification of ambiguous, missing, or abnormal data, further improving the accuracy of file interception. The algorithmic functions can be determined by introducing conventional correlation analysis algorithms based on the file information data type.

[0115] Please refer to Figure 2 , Figure 2 This is a block diagram of an executable file interception system based on Ring3 layer query according to this application.

[0116] A second aspect of this application provides an executable file interception system 2 based on Ring 3 layer query, including a memory 21 and a processor 22. The memory 21 includes an executable file interception program based on Ring 3 layer query. When the executable file interception program based on Ring 3 layer query is executed by the processor 22, it performs the following steps:

[0117] Create a process monitoring callback function to establish monitoring and communication between the application layer and the driver layer. The process monitoring callback function is set through PsSetCreateProcessNotifyRoutineEx.

[0118] The communication data is acquired, cleaned, and assembled, and then sent to the application layer through MiniFilter;

[0119] Obtain executable file information from communication messages, and match the dataset based on the executable file information;

[0120] The system determines whether the executable file information meets the release criteria based on the matching of the dataset information, and issues a release or rejection command.

[0121] It should be noted that monitoring and communication between the application layer and the driver layer are based on the MiniFilter driver. By acquiring communication data and analyzing IRP operations, the key behavioral information of the collected executable files is organized and sent to the application layer, which can eliminate some interfering behavioral information and improve operating efficiency. The acquired communication information is further refined and transformed into executable file information, and then queried and matched against a preset dataset to determine whether to block or allow the executable file. The executable file information includes the filename, path, extension, MD5 value, and time. If the executable file information successfully matches the dataset, it meets the release criteria, and a release command is issued, allowing the executable file to run, modify, delete, etc.

[0122] The executable file interception system based on Ring3 layer query in this application embodiment determines whether the driver should intercept or allow the executable file based on the query result, thereby making the interception process more efficient and secure, minimizing the impact on the stability of the local machine, and avoiding system crashes caused by errors. It can be applied to specific fields such as industrial control network security and consumer host security.

[0123] According to the embodiments of this application, the specific steps of acquiring, cleaning, and assembling communication data are as follows:

[0124] Obtain the PEPROCESS information of the currently started process through the input parameter Process;

[0125] The PID parameter of the currently started process can be obtained through the input parameter ProcessId;

[0126] Additional information about the currently started process can be obtained through the input parameter PPS_CREATE_NOTIFY_INFO CreateInfo;

[0127] The additional information includes command-line instructions, process name, thread ID, and parent process PID.

[0128] According to an embodiment of this application, sending communication data to the application layer via MiniFilter specifically involves:

[0129] A communication port is created using FltCreateCommunicationPort, communication data is actively sent to the application layer using FltSendMessage, and communication data is received from the MiniFilter using FilterGetMessage.

[0130] According to an embodiment of this application, the specific steps of matching the dataset based on the executable file information are as follows:

[0131] Retrieve the blacklist dataset from the database;

[0132] Determine if the executable file information exists in the blacklist dataset in the database. If it exists, the match fails; otherwise, the match succeeds.

[0133] According to an embodiment of this application, the dataset is stored in an SQLite database and a Redis database, wherein the SQLite database is encrypted using AES-ECB mode.

[0134] According to an embodiment of this application, the step of determining whether the release criteria are met based on the matching of executable file information and dataset, and issuing a release or rejection instruction, specifically involves:

[0135] When the release criteria are met, a release flag is set for the executable file information;

[0136] Assign a value to the input parameter CreateInfo->CreationStatus based on the release flag;

[0137] Create a pass or deny command based on the assigned value.

[0138] According to the embodiments of this application, setting a release flag for executable file information specifically involves:

[0139] The MiniFilter also sets the ReplyBuffer to receive the returned data;

[0140] The release flag is recorded in the ReplyBuffer, and the ReplyBuffer is returned to the driver layer.

[0141] According to the embodiments of this application, returning the ReplyBuffer to the driver layer specifically involves:

[0142] The communication port is connected via FilterConnectCommunicationPort, and FilterReplyMessage is used to actively send ReplyBuffer to the driver layer. MessageCallBack is used to receive communication data from the application layer.

[0143] In another embodiment of this application, after obtaining the executable file information from the communication information and before matching the dataset based on the executable file information, the method further includes:

[0144] Obtain the security information of the executable file, including the security level and permissions;

[0145] Executable file information is grouped according to security level and permission strength, and each group uses a different association function when matching with the dataset.

[0146] In another embodiment of this application, the step of matching the dataset based on executable file information further includes:

[0147] Retrieve the whitelist dataset from the database;

[0148] Check if the executable file information exists in the whitelist dataset in the database; if it does, the match is successful.

[0149] If it does not exist, the algorithm function calculates the correlation between the executable file information and the blacklist / whitelist dataset. If the correlation exceeds the threshold, it is determined that it exists in the corresponding dataset.

[0150] A third aspect of this application provides a computer-readable storage medium including an executable file interception program based on Ring3 layer query. When the executable file interception program based on Ring3 layer query is executed by a processor, it implements the steps of the executable file interception method based on Ring3 layer query.

[0151] In summary, this application provides an executable file interception method, system, and storage medium based on Ring3 layer query. It establishes monitoring and communication between the application layer and the driver layer by creating a process monitoring callback function; it acquires, cleans, and assembles communication data, and sends the communication data to the application layer through a MiniFilter; it obtains executable file information from the communication information and matches the dataset based on the executable file information; it determines whether the data meets the release criteria based on the matching of the executable file information and the dataset, and issues a release or rejection command.

[0152] This application utilizes a MiniFilter driver deployed on a Windows operating system. By analyzing specified IRP operations, it collects and summarizes key behaviors of executable files and sends them to the application layer for software analysis via driver communication technology. Upon receiving the behavioral data, the application layer software further refines it and queries a local sample library. Based on the query results, it decides whether the driver should block or allow the executable file, making the blocking process efficient and secure, minimizing the impact on local stability, and avoiding system crashes due to errors. Through MiniFilter communication technology and database queries, query results can be easily obtained, and the local sample library can be dynamically and quickly expanded, facilitating sample library backup and migration operations without causing serious kernel errors. Furthermore, since it uses disk space, it does not require high memory. It can be applied to specific fields such as industrial control network security and consumer host security.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0154] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0155] In addition, in the various embodiments of the present invention, each functional unit can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0156] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0157] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0158] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An executable file interception method based on Ring3 layer query, characterized in that, Includes the following steps: Create a process monitoring callback function to establish monitoring and communication between the application layer and the driver layer. The process monitoring callback function is set through PsSetCreateProcessNotifyRoutineEx. The communication data is acquired, cleaned, and assembled, and then sent to the application layer through MiniFilter; Obtain executable file information from communication messages, and match the dataset based on the executable file information; The system determines whether the executable file information meets the release criteria based on the matching of the dataset, and issues a release or rejection command accordingly. The specific steps for determining whether the release criteria are met based on the matching of executable file information with the dataset, and issuing a release or rejection command, are as follows: When the release criteria are met, a release flag is set for the executable file information; Assign a value to the input parameter CreateInfo->CreationStatus based on the release flag; Create a pass or deny command based on the assigned value; Setting the allow flag for executable file information specifically involves: The MiniFilter also sets the ReplyBuffer to receive the returned data; The release flag is recorded in the ReplyBuffer, and the ReplyBuffer is returned to the driver layer; Returning the ReplyBuffer to the driver layer specifically involves: The communication port is connected via FilterConnectCommunicationPort, and FilterReplyMessage is used to actively send ReplyBuffer to the driver layer. MessageCallBack is used to receive communication data from the application layer.

2. The executable file interception method based on Ring3 layer query according to claim 1, characterized in that, The specific steps of acquiring, cleaning, and assembling communication data are as follows: Obtain the PEPROCESS information of the currently started process through the input parameter Process; The PID parameter of the currently started process can be obtained through the input parameter ProcessId; Additional information about the currently started process can be obtained through the input parameter PPS_CREATE_NOTIFY_INFO CreateInfo; The additional information includes command-line instructions, process name, thread ID, and parent process PID.

3. The executable file interception method based on Ring3 layer query according to claim 1, characterized in that, The specific steps of sending communication data to the application layer via MiniFilter are as follows: A communication port is created using FltCreateCommunicationPort, communication data is actively sent to the application layer using FltSendMessage, and communication data is received from the MiniFilter using FilterGetMessage.

4. The executable file interception method based on Ring3 layer query according to claim 1, characterized in that, The specific steps of matching the dataset based on executable file information are as follows: Retrieve the blacklist dataset from the database; Determine if the executable file information exists in the blacklist dataset in the database. If it exists, the match fails; otherwise, the match succeeds.

5. The executable file interception method based on Ring3 layer query according to claim 1, characterized in that, The dataset is stored in an SQLite database and a Redis database, with the SQLite database being encrypted using AES-ECB mode.

6. An executable file interception system based on Ring3 layer query, characterized in that, The device includes a memory and a processor. The memory includes an executable file interception program based on Ring3 layer query. When the executable file interception program based on Ring3 layer query is executed by the processor, it implements the steps of the executable file interception method based on Ring3 layer query as described in any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes an executable file interception program based on Ring3 layer query. When the executable file interception program based on Ring3 layer query is executed by a processor, it implements the steps of the executable file interception method based on Ring3 layer query as described in any one of claims 1 to 5.

Images