Trojan program monitoring methods, devices, computing equipment, and storage media

Abstract

This invention discloses a method, apparatus, computing device, and storage medium for monitoring Trojan programs. The method is executed on the computing device and includes: detecting whether a critical file path of the operating system has changed; if so, obtaining the caller process that triggered the change of the critical file path as a first abnormal process; obtaining the process with the highest system resource consumption from one or more processes running on the operating system as a second abnormal process; and performing feature matching on the first and second abnormal processes to determine whether the first and second abnormal processes are Trojan programs. According to the technical solution of this invention, rapid response and alerts can be achieved for Trojan programs, including mining programs.

Description

Technical Field

[0001] This invention relates to the field of computer and operating system technology, and in particular to a method, monitoring device, computing device and storage medium for monitoring Trojan programs. Background Technology

[0002] Currently, due to the development of technologies and products such as virtual currency and blockchain, as well as the continuous increase in the value of virtual currencies, some companies' internal hosts are often maliciously implanted with mining trojans, which consume server resources to mine cryptocurrency, making it difficult to defend against.

[0003] Existing technical solutions rely heavily on manual troubleshooting because mining programs typically consume significant system and network resources. This involves manually checking for anomalies on internal servers, such as multiple servers lag, excessive fan noise, frequent unresponsiveness of online services, and internal network congestion. Furthermore, if repeated restarts and attempts to rule out system and program issues fail to resolve the problem, malicious mining program infection should be considered. These existing manual troubleshooting methods are overly dependent on human experience and are extremely time-consuming.

[0004] Therefore, a method for monitoring Trojan programs is needed to solve the problems existing in the above solutions. Summary of the Invention

[0005] Therefore, the present invention provides a method and device for monitoring Trojan programs to solve or at least alleviate the problems mentioned above.

[0006] According to one aspect of the present invention, a method for monitoring Trojan programs is provided, executed in a computing device, wherein the computing device runs an operating system, the method comprising: detecting whether a critical file path of the operating system has changed; if so, obtaining the caller process that triggered the change of the critical file path as a first abnormal process; obtaining the process with the highest system resource usage from one or more processes running on the operating system as a second abnormal process; and performing feature matching on the first abnormal process and the second abnormal process to determine whether the first abnormal process and the second abnormal process are Trojan programs.

[0007] Optionally, in the Trojan program monitoring method according to the present invention, obtaining the process with the highest system resource usage from one or more processes running on the operating system includes: obtaining the process with the highest system resource usage from one or more processes running on the operating system based on a predetermined time interval.

[0008] Optionally, in the Trojan program monitoring method according to the present invention, obtaining the process with the highest system resource consumption as the second abnormal process includes: determining whether the resource consumption rate of the process with the highest system resource consumption has reached a predetermined resource consumption rate; if so, then the process with the highest system resource consumption is designated as the second abnormal process.

[0009] Optionally, in the Trojan program monitoring method according to the present invention, obtaining the process with the highest system resource usage includes: obtaining the process with the highest CPU resource usage or the process with the highest storage resource usage.

[0010] Optionally, in the Trojan program monitoring method according to the present invention, the method further includes: obtaining the critical file path of the operating system; calculating the digest value of the critical file path and backing up the digest value.

[0011] Optionally, in the Trojan program monitoring method according to the present invention, feature matching is performed on the first abnormal process and the second abnormal process to determine whether the first abnormal process and the second abnormal process are Trojan programs, including: determining whether the first abnormal process and the second abnormal process initiate an abnormal network connection; if an abnormal network connection is initiated, determining whether the abnormal network connection is encrypted using a predetermined protocol, and determining whether the certificate exchanged during the encryption process is a certificate in the Trojan program feature library; if so, determining that the first abnormal process and the second abnormal process are Trojan programs.

[0012] Optionally, in the Trojan program monitoring method according to the present invention, the Trojan program is a mining program. Determining whether the certificate exchanged during the encryption process is a known certificate in the Trojan program signature database includes: determining whether the certificate exchanged during the encryption process is a mining pool certificate in the mining program signature database, and determining whether the target mining pool IP that establishes an abnormal network connection with the mining program belongs to the mining pool IP address pool in the mining program signature database; if so, then the first abnormal process and the second abnormal process are determined to be mining programs.

[0013] Optionally, in the Trojan program monitoring method according to the present invention, performing feature matching on the first abnormal process and the second abnormal process to determine whether the first abnormal process and the second abnormal process are Trojan programs further includes: performing file feature matching on the calling files of the first abnormal process and the second abnormal process to determine whether the calling files contain Trojan program feature files; if the calling files contain Trojan program feature files, then the first abnormal process and the second abnormal process are determined to be Trojan programs.

[0014] According to one aspect of the present invention, a monitoring device is provided, residing in a computing device, wherein an operating system runs in the computing device. The device comprises: a detection module, adapted to detect whether a critical file path of the operating system has changed; if so, acquiring the caller process that triggered the change of the critical file path as a first abnormal process; an acquisition module, adapted to acquire, from one or more processes running on the operating system, the process with the highest system resource usage as a second abnormal process; and a feature matching module, adapted to perform feature matching on the first abnormal process and the second abnormal process to determine whether the first abnormal process and the second abnormal process are Trojan programs.

[0015] According to one aspect of the present invention, a computing device is provided, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, the program instructions including instructions for performing the Trojan program monitoring method as described above.

[0016] According to one aspect of the present invention, a readable storage medium storing program instructions is provided, which, when read and executed by a computing device, causes the computing device to perform the Trojan program monitoring method as described above.

[0017] According to the technical solution of the present invention, a method for monitoring Trojan programs is provided. This method involves detecting changes to critical file paths in the operating system, identifying the caller process that triggered the change as an abnormal process, and identifying the process with the highest system resource consumption as an abnormal process. For abnormal processes that may be Trojan programs, a feature matching module is used to perform feature matching to determine whether the abnormal process is a Trojan program, so as to issue an alert for the Trojan program. Thus, the present invention only needs to detect file paths and process resource consumption; by performing feature matching, it can quickly identify Trojan programs, including mining programs. This enables automatic monitoring of Trojan programs, including mining programs, with minimal system resource consumption, and provides rapid response and alerts for such programs.

[0018] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0019] To achieve the foregoing and related objectives, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings. These aspects indicate various ways in which the principles disclosed herein may be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The foregoing and other objectives, features, and advantages of this disclosure will become more apparent from the following detailed description, taken in conjunction with the accompanying drawings. Throughout this disclosure, the same reference numerals generally refer to the same parts or elements.

[0020] Figure 1 A schematic diagram of a computing device 100 according to an embodiment of the present invention is shown;

[0021] Figure 2 , Figure 3 The flowcharts of a Trojan program monitoring method 200 according to an embodiment of the present invention are shown respectively;

[0022] Figure 4 A schematic diagram of a monitoring device 400 according to an embodiment of the present invention is shown. Detailed Implementation

[0023] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0024] Figure 1 A schematic diagram of a computing device 100 according to an embodiment of the present invention is shown. Figure 1 As shown, in a basic configuration, computing device 100 includes at least one processing unit 102 and system memory 104. According to one aspect, depending on the configuration and type of the computing device, the processing unit 102 may be implemented as a processor. System memory 104 includes, but is not limited to, volatile memory (e.g., random access memory), non-volatile memory (e.g., read-only memory), flash memory, or any combination of such memories. According to one aspect, system memory 104 includes an operating system 105.

[0025] According to one aspect, operating system 105 is, for example, suitable for controlling the operation of computing device 100. Furthermore, examples are practiced in conjunction with graphics libraries, other operating systems, or any other applications, and are not limited to any particular application or system. Figure 1The basic configuration is illustrated by the components within the dashed lines. According to one aspect, the computing device 100 has additional features or functions. For example, according to one aspect, the computing device 100 includes additional data storage devices (removable and / or non-removable), such as disks, optical discs, or magnetic tapes. This additional storage... Figure 1 The middle part is shown by removable storage device 109 and non-removable storage device 110.

[0026] As stated above, according to one aspect, a program module 103 is stored in system memory 104. According to one aspect, program module 103 may include one or more applications. The invention does not limit the type of application; for example, applications may include: email and contact applications, word processing applications, spreadsheet applications, database applications, slideshow applications, drawing or computer-aided applications, web browser applications, etc. In an embodiment of the invention, the applications in program module 103 may include a monitoring device 400, which is configured to execute the Trojan program monitoring method 200 of the invention.

[0027] According to one aspect, examples can be practiced on circuits including discrete electronic components, packaged or integrated electronic chips containing logic gates, circuits utilizing microprocessors, or on a single chip containing electronic components or a microprocessor. For example, it can be practiced via wherein... Figure 1 Each or many of the components shown can be implemented as an example by integrating a System-on-a-Chip (SOC) on a single integrated circuit. According to one aspect, such an SOC device may include one or more processing units, graphics units, communication units, system virtualization units, and various application functions, all integrated (or “burned in”) as a single integrated circuit onto a chip substrate. When operating via the SOC, the functions described herein can be operated via dedicated logic integrated on a single integrated circuit (chip) with other components of the computing device 100. Embodiments of the invention can also be implemented using other techniques capable of performing logical operations (e.g., AND, OR, and NOT), including but not limited to mechanical, optical, fluid, and quantum technologies. Additionally, embodiments of the invention can be implemented within a general-purpose computer or in any other circuit or system.

[0028] According to one aspect, computing device 100 may also have one or more input devices 112, such as a keyboard, mouse, pen, voice input device, touch input device, etc. It may also include output devices 114, such as a display, speaker, printer, etc. The foregoing devices are examples and other devices may also be used. Computing device 100 may include one or more communication connections 116 that allow communication with other computing devices 118. Examples of suitable communication connections 116 include, but are not limited to: RF transmitter, receiver and / or transceiver circuitry; Universal Serial Bus (USB), parallel and / or serial ports.

[0029] As used herein, the term computer-readable medium includes computer storage medium. Computer storage medium can include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information (e.g., computer-readable instructions, data structures, or program module 103). System memory 104, removable storage device 109, and non-removable storage device 110 are examples of computer storage media (i.e., memory storage). Computer storage media can include random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape, magnetic tape, disk storage or other magnetic storage devices, or any other article of manufacture that can be used to store information and is accessible by computer device 100. According to one aspect, any such computer storage medium can be part of computing device 100. Computer storage media does not include carrier waves or other transmitted data signals.

[0030] According to one aspect, the communication medium is implemented by computer-readable instructions, data structures, program modules 103, or other data in a modulated data signal (e.g., a carrier wave or other transmission mechanism), and includes any information transmission medium. According to one aspect, the term "modulated data signal" describes a signal having one or more sets of characteristics or altered in a manner that encodes information in the signal. By way of example and not limitation, the communication medium includes wired media such as wired networks or direct wired connections, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0031] In an embodiment of the present invention, a computing device 100 is configured to execute a Trojan program monitoring method 200 according to the present invention. The computing device 100 includes one or more processors and one or more readable storage media storing program instructions, which, when configured to be executed by one or more processors, cause the computing device to execute the Trojan program monitoring method 200 of the present invention.

[0032] According to one embodiment of the present invention, the monitoring device 400 of the computing device 100 is configured to execute the Trojan program monitoring method 200 according to the present invention. The monitoring device 400 includes multiple program instructions for executing the Trojan program monitoring method 200 of the present invention, which can instruct the processor to execute the Trojan program monitoring method 200 according to the present invention.

[0033] Figure 2 , Figure 3 Flowcharts of a Trojan program monitoring method 200 according to an embodiment of the present invention are shown. Method 200 is adapted to be executed in a monitoring device 400 of a computing device (the aforementioned computing device 100), the computing device running an operating system.

[0034] According to one embodiment of the present invention, a Trojan program may include, for example, a mining program, but the present invention is not limited to the specific type of Trojan program.

[0035] like Figure 2 and Figure 3 As shown, method 200 includes steps 210 to 230.

[0036] In step 210, it is detected whether the critical file path of the operating system has changed. If so, the caller process that triggered the change of the critical file path is obtained and designated as the first abnormal process. Here, the critical file path of the system may include one or more.

[0037] It's important to note that Trojan programs, including those used for cryptocurrency mining, typically generate special configuration files or perform file replacements in critical operating system file paths. For example, mining programs might add system startup tasks to the operating system's cron jobs, or add startup tasks to directories like ` / etc / init.d / `, ` / etc / rc.local`, and ` / etc / systemd / system / `, or add SSH public key login functionality. Another example is the replacement of system commands in critical file paths, including `netstat`, `ps`, and `ls`, hiding the virus files as system commands. Additionally, common storage-based mining programs generate numerous temporary files in the ` / tmp` directory, including characteristic files for the corresponding mining pool.

[0038] Since Trojan programs can generate special configuration files or perform file replacements on critical file paths in the operating system, these critical file paths will inevitably change. Therefore, in this embodiment of the invention, by detecting whether the critical file paths of the operating system have changed, when a change is detected, the caller process that triggered the change may be a Trojan program. Thus, the caller process that triggered the change can be considered the first abnormal process, and further verification using a feature matching module is needed to confirm whether this first abnormal process (caller process) is a Trojan program.

[0039] In one embodiment, before performing step 210, after starting the operating system, the critical file paths of the operating system can be obtained, the digest value of the critical file paths can be calculated, and the digest value of the critical file paths can be backed up, thereby realizing digital fingerprint backup of the critical file paths of the operating system.

[0040] Specifically, a digest value for the critical file path can be calculated based on a digest algorithm, and this digest value can be backed up and stored. It's understandable that when the critical file path changes, its digest value will also change.

[0041] In one implementation, the digest algorithm can be implemented as MD5, and the digest value of the critical file path can be the MD5 value of the critical file path (also known as a "digital fingerprint").

[0042] In one embodiment, critical operating system files include, for example, the / etc / hosts file, commonly used system files in the / usr / bin directory, the / etc / crontab scheduled task file, and the / root / .ssh / authorized_keys public key file.

[0043] In step 210, when it is detected that the / etc / hosts file has been modified, or when it is detected that an auto-run task has been added to the / etc / crontab scheduled task file, it can be determined that the critical file path of the operating system has been changed, and the caller process that triggered the change of the critical file path and the content of the change can be recorded. The caller process that triggered the change of the critical file path is designated as the first abnormal process.

[0044] In step 220, the process with the highest system resource consumption is obtained from one or more processes running on the operating system, and the process with the highest system resource consumption is designated as the second abnormal process.

[0045] Specifically, based on predetermined time intervals, the process with the highest system resource consumption can be selected from one or more processes running on the operating system. Here, the process with the highest system resource consumption could be, for example, the process with the highest CPU resource consumption or the process with the highest storage resource consumption. The process with the highest storage resource consumption is also the process that makes the most frequent disk I / O calls.

[0046] It should be noted that because Trojan programs, including mining programs, consume a large amount of system computing power or storage capacity, when these Trojan programs run on the operating system, they will manifest as the abnormal process occupying a large amount of system CPU resources or storage resources for a long time.

[0047] Based on this, in one embodiment of the present invention, the process with the highest system resource usage in each predetermined time interval is sampled and statistically analyzed at regular intervals. The process with the highest system resource usage determined by the statistics may be a Trojan program. Therefore, the process with the highest system resource usage in each predetermined time interval can be regarded as the second abnormal process. It is necessary to further verify whether the second abnormal process (the process with the highest system resource usage) is a Trojan program through the feature matching module.

[0048] In one embodiment, a configuration file can be generated to pre-configure information such as a predetermined resource utilization rate and a predetermined resource utilization duration for abnormal resource usage. At predetermined intervals, among one or more processes running on the operating system, the process with the highest system resource utilization is identified. Based on the configuration file, it can be determined whether the resource utilization rate of this process reaches the predetermined resource utilization rate. If it does, the process with the highest resource utilization is identified as the second abnormal process. Furthermore, it can be further determined whether the resource utilization duration of this process reaches the predetermined duration. If both the resource utilization rate and duration of this process reach the predetermined resource utilization rate and duration, the process with the highest resource utilization is identified as the second abnormal process.

[0049] In step 230, the feature matching module can be used to perform feature matching on the abnormal processes (the first abnormal process and the second abnormal process) to determine whether they are Trojan programs. Here, the abnormal processes can include the caller process (the first abnormal process) that triggered the change of the critical file path, and the process with the highest system resource consumption (the second abnormal process). In other words, for both the aforementioned first and second abnormal processes, step 230 can be executed to perform feature matching to determine whether they are Trojan programs.

[0050] If the feature matching module determines that the first and second abnormal processes are Trojan programs, it can issue an alert for the Trojan programs, thereby enabling a rapid response and alert for Trojan programs, including mining programs.

[0051] In one embodiment, feature matching of abnormal processes (first abnormal process and second abnormal process) can be performed on file feature matching of the calling files of the abnormal processes (first abnormal process and second abnormal process) to determine whether the calling files contain Trojan program feature files (binary feature files). If the calling files of the abnormal processes (first abnormal process and second abnormal process) contain Trojan program feature files, then the abnormal processes (first abnormal process and second abnormal process) can be determined to be Trojan programs.

[0052] Furthermore, network connections made by trojan programs, including mining programs, are typically encrypted, meaning they use encrypted communication. This encryption can be achieved using predefined protocols, such as TLS (Transport Layer Security) to establish an encrypted data channel. For instance, a mining program needs to connect to a mining pool to share computing power for collaborative mining. The encrypted communication between the mining program and the mining pool uses a TLS certificate, and the IP address of the public mining pool is also fixed.

[0053] Based on this, in one embodiment, feature matching of abnormal processes can also be performed on encrypted communication feature matching of abnormal programs. Specifically, feature matching of abnormal processes (first abnormal process, second abnormal process) can be performed by: determining whether the abnormal processes (first abnormal process, second abnormal process) initiate abnormal network connections; if the abnormal processes (first abnormal process, second abnormal process) initiate abnormal network connections, determining whether the abnormal network connection process is encrypted using a predetermined protocol, and determining whether the certificates exchanged during the encryption process are certificates known in the Trojan program signature database. Here, the predetermined protocol is, for example, the TLS protocol, that is, it can be determined whether the abnormal network connection process is encrypted using the TLS protocol.

[0054] If the abnormal network connection process is encrypted using a predetermined protocol, and the certificate exchanged during the encryption process is a certificate known in the Trojan signature database, then the abnormal process (first abnormal process, second abnormal process) can be identified as a Trojan program.

[0055] In one embodiment, the Trojan program is, for example, a cryptocurrency mining program, and correspondingly, the Trojan program signature database can be implemented as a cryptocurrency mining program signature database. The cryptocurrency mining program can establish an abnormal network connection with the target mining pool.

[0056] Determining whether the certificate exchanged during the encryption process is a known certificate in the Trojan program's signature database can be implemented as follows: First, determine if the certificate exchanged during the encryption process is a known mining pool certificate in the mining program's signature database. Second, determine if the target mining pool IP that established the abnormal network connection with the mining program belongs to the mining pool IP address pool in the mining program's signature database. If the exchanged certificate is a known mining pool certificate in the mining program's signature database, and the target mining pool IP that established the abnormal network connection with the mining program belongs to the mining pool IP address pool in the mining program's signature database, then the abnormal process (first abnormal process, second abnormal process) is determined to be a mining program.

[0057] Figure 4 A schematic diagram of a monitoring device 400 according to an embodiment of the present invention is shown. The monitoring device 400 resides in a computing device (e.g., the aforementioned computing device 100), and an operating system runs on the computing device. The monitoring device 400 is adapted to execute the Trojan program monitoring method 200 of the present invention.

[0058] like Figure 4 As shown, the monitoring device 400 includes a detection module 410, an acquisition module 420, and a feature matching module 430 that are connected in series.

[0059] The detection module 410 is adapted to detect whether the critical file path of the operating system has changed. If so, it obtains the caller process that triggered the change of the critical file path as the first abnormal process. The acquisition module 420 is adapted to obtain the process with the highest system resource consumption from one or more processes running on the operating system as the second abnormal process. The feature matching module 430 is adapted to perform feature matching on the first abnormal process and the second abnormal process to determine whether the first abnormal process and the second abnormal process are Trojan programs.

[0060] It should be noted that the detection module 410 is used to perform the aforementioned step 210, the acquisition module 420 is used to perform the aforementioned step 220, and the feature matching module 430 is used to perform the aforementioned step 230. Here, the specific execution logic of the detection module 410, the acquisition module 420, and the feature matching module 430 is described in the previous method 200 for steps 210 to 230, and will not be repeated here.

[0061] According to the Trojan program monitoring method of the present invention, by detecting whether the critical file path of the operating system has changed, the caller process that triggered the change of the critical file path is identified as an abnormal process, and the process with the highest system resource consumption is also identified as an abnormal process. For abnormal processes that may be Trojan programs, a feature matching module is used to perform feature matching on the abnormal processes to determine whether the abnormal processes are Trojan programs, so as to issue an alert for the Trojan program. In this way, the present invention only needs to detect the file path and the resource consumption of the process, and can quickly identify Trojan programs, including mining programs, through feature matching. This enables automatic monitoring of Trojan programs, including mining programs, with minimal consumption of system resources, and provides rapid response and alerts for Trojan programs, including mining programs.

[0062] The various techniques described herein can be implemented in combination with hardware or software, or a combination thereof. Thus, the methods and apparatus of the present invention, or certain aspects or portions thereof, can take the form of program code (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, USB flash drive, floppy disk, CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into and executed by a machine such as a computer, the machine becomes an apparatus for practicing the present invention.

[0063] When the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a processor-readable storage medium (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store program code; the processor is configured to execute the Trojan program monitoring method of the present invention according to instructions in the program code stored in the memory.

[0064] By way of example, and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer-readable instructions, data structures, program module 103, or other data. Communication media generally embodies computer-readable instructions, data structures, program module 103, or other data in the form of modulated data signals such as a carrier wave or other transmission mechanism, and includes any information transmission medium. Any combination of the above is also included within the scope of readable media.

[0065] In the specification provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with the examples of this invention. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0066] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0067] Similarly, it should be understood that, in order to streamline this disclosure and aid in understanding one or more aspects of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this method of disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the invention.

[0068] Those skilled in the art will understand that modules, units, or components of the devices disclosed in the examples herein can be arranged in the devices described in this embodiment, or alternatively, can be located in one or more devices different from the devices in this example. The modules in the foregoing examples can be combined into a single module or further divided into multiple sub-modules.

[0069] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0070] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0071] Furthermore, some of the embodiments described herein are methods or combinations of method elements that can be implemented by a processor of a computer system or by other means of performing the functions. Therefore, a processor having the necessary instructions for implementing the methods or method elements forms means for implementing the methods or method elements. Furthermore, the elements described herein in the apparatus embodiments are examples of means for implementing the functions performed by elements for the purposes of carrying out the invention.

[0072] As used herein, unless otherwise specified, the use of ordinal numbers such as “first,” “second,” “third,” etc., to describe ordinary objects merely indicates different instances of similar objects and is not intended to imply that the objects being described must have a given order in time, space, ordering, or any other manner.

[0073] Although the invention has been described with respect to a limited number of embodiments, those skilled in the art will understand from the foregoing description that other embodiments are conceivable within the scope of the invention described herein. Furthermore, it should be noted that the language used in this specification has been chosen primarily for readability and edibility purposes, and not for the purpose of interpreting or limiting the subject matter of the invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the invention is illustrative rather than restrictive, and the scope of the invention is defined by the appended claims.

Claims

1. A method for monitoring Trojan programs, executed in a computing device, wherein the computing device runs an operating system, and the Trojan program is a mining program, the method comprising: Detect whether the critical file path of the operating system has changed. If so, obtain the caller process that triggered the change of the critical file path as the first abnormal process. From one or more processes running on the operating system, obtain the process with the highest system resource consumption, determine whether the resource consumption rate of the process with the highest system resource consumption has reached the predetermined resource consumption rate, and if so, designate the process with the highest system resource consumption as the second abnormal process. The first abnormal process and the second abnormal process are subjected to feature matching to determine whether they are Trojan programs. This includes: performing file feature matching on the calling files of the first abnormal process and the second abnormal process to determine whether the calling files contain Trojan program feature files. If the calling files contain Trojan program feature files, then the first abnormal process and the second abnormal process are determined to be Trojan programs. Furthermore, it determines whether the first abnormal process and the second abnormal process initiate an abnormal network connection. If an abnormal network connection is initiated, it determines whether the abnormal network connection is encrypted using a predetermined protocol, and whether the certificate exchanged during the encryption process is a mining pool certificate in the mining program's signature database, and whether the target mining pool IP that establishes the abnormal network connection with the mining program belongs to the mining pool IP address pool in the mining program's signature database. If so, it determines that the first abnormal process and the second abnormal process are Trojan programs.

2. The method as described in claim 1, wherein, From one or more processes running on the operating system, identify the process consuming the most system resources, including: Based on a predetermined time interval, the process with the highest system resource consumption is obtained from one or more processes running on the operating system.

3. The method as described in claim 1, wherein, Get the processes consuming the most system resources, including: Get the process with the highest CPU or storage resource usage.

4. The method according to any one of claims 1-3, wherein, The method further includes: Obtain the key file paths of the operating system; Calculate the digest value of the critical file path and back up the digest value.

5. A monitoring device residing in a computing device, wherein the computing device runs an operating system and the Trojan program is a mining program, the device comprising: The detection module is adapted to detect whether the critical file path of the operating system has changed. If so, it obtains the caller process that triggered the change of the critical file path as the first abnormal process. The acquisition module is adapted to acquire the process with the highest system resource consumption from one or more processes running on the operating system, determine whether the resource consumption rate of the process with the highest system resource consumption has reached a predetermined resource consumption rate, and if so, designate the process with the highest system resource consumption as the second abnormal process. The feature matching module is adapted to perform feature matching on the first abnormal process and the second abnormal process to determine whether the first abnormal process and the second abnormal process are Trojan programs, including: performing file feature matching on the calling files of the first abnormal process and the second abnormal process to determine whether the calling files contain Trojan program feature files; if the calling files contain Trojan program feature files, then the first abnormal process and the second abnormal process are determined to be Trojan programs. Furthermore, it determines whether the first abnormal process and the second abnormal process initiate an abnormal network connection. If an abnormal network connection is initiated, it determines whether the abnormal network connection is encrypted using a predetermined protocol, and whether the certificate exchanged during the encryption process is a mining pool certificate in the mining program's signature database, and whether the target mining pool IP that establishes the abnormal network connection with the mining program belongs to the mining pool IP address pool in the mining program's signature database. If so, it determines that the first abnormal process and the second abnormal process are Trojan programs.

6. A computing device, comprising: At least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, the program instructions including instructions for performing the method as described in any one of claims 1-4.

7. A readable storage medium storing program instructions that, when read and executed by a computing device, cause the computing device to perform the method as described in any one of claims 1-4.

Images