Process whitelist generation method

Abstract

The present invention provides a process whitelist generation method, comprising: S1, obtaining an initial process list group P = (P1, P2, ..., Pi, ..., Pm) corresponding to an initial device under a working condition; S2, for Pi, obtaining P ij The corresponding initial process status list PS ij ; S3, traverse PS ij , if PS ij Medium PS r ij If it is an abnormal state, obtain the PS in the first preset time period ij PS occurs r ij The number of time intervals C ij and C ij The number of occurrences corresponding to each time interval in; execute S4; S4, if C ij ≥C0, execute S5; otherwise, execute S6; S5, if PS ij PS occurs r ij The total number of D ij <D1, execute S6; otherwise, execute S7; S6, PS ij as a whitelist process; obtain the whitelist process table of the i-th initial device; S7, PS ij As a process other than the whitelist process, the present invention can improve the accuracy and applicability of the acquired whitelist process.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a process whitelist generation method. Background Art

[0002] At present, industrial control systems will be interconnected in an industrial control network environment. In an industrial control network environment, multiple monitored devices will communicate and connect with the master control device of the network monitoring platform. The master control device monitors each monitored device through the proxy package installed on each device to ensure that the network data in the industrial control network environment is safe, stable and does not leak. The network monitoring platform will play a corresponding role for each monitored device in the working environment. To ensure the safe implementation of the role function, each monitored device will set the identity of the role execution program, that is, the process, and only trustworthy whitelist processes are allowed to execute. The current whitelist process setting method is to manually select and set it through a preset whitelist process table. This setting method is because each device selects and generates the corresponding whitelist process according to the established whitelist process table. This whitelist process table has not been verified by time, which will cause some whitelist processes to be inapplicable to certain devices, and there will be security risks. In addition, in the existing industrial control network environment, when the proxy package needs to be updated, a time will be randomly selected for update. Due to limited network bandwidth and large data traffic, network congestion will cause abnormal data transmission. Summary of the invention

[0003] In view of the above technical problems, an embodiment of the present invention provides a process whitelist recommendation method, which is used to solve at least one of the above technical problems.

[0004] The technical solution adopted by the present invention is:

[0005] An embodiment of the present invention provides a method for generating a process whitelist, the method comprising the following steps:

[0006] S1, obtain the initial process list group P corresponding to the initial equipment under the working condition environment = (P1, P2, ..., Pi, ..., Pm), where the initial process list Pi of any initial equipment i = (P i1 , P i2 ,…,P ij ,…,P if(i) ), P ij is the jth initial process corresponding to the initial device i, i ranges from 1 to m, m is the number of initial devices; j ranges from 1 to f(i), f(i) is the number of initial processes corresponding to the initial device i;

[0007] S2, for Pi, get P ij The corresponding initial process status list PS ij=(PS 1 ij , P.S. 2 ij ,…,PS r ij ,…,PS n ij ), PS r ij is the P corresponding to the rth time interval in the first preset time period ij The initial process state of r is 1 to n, and n is the number of time intervals in the first preset time period;

[0008] S3, traverse PS ij , if PS ij Medium PS r ij If it is an abnormal state, obtain the PS in the first preset time period ij PS occurs r ij The number of time intervals C ij and C ij The number of occurrences corresponding to each time interval in; execute S4;

[0009] S4, if C ij ≥C0, execute S5; otherwise, execute S6; C0 is the preset abnormal time interval number threshold;

[0010] S5, if PS ij PS occurs r ij The total number of D ij <D1, execute S6; otherwise, execute S7; d s ij C ij The number of occurrences corresponding to the s-th time interval in , D1 is the preset first abnormal number threshold;

[0011] S6, PS ij As a whitelist process; get the whitelist process table of the i-th initial device;

[0012] S7, PS ij As a non-whitelisted process.

[0013] The present invention has at least the following beneficial effects:

[0014] The process whitelist generation method provided by the embodiment of the present invention sets the process to the blacklist when the number of times a process in an initial device appears abnormal state within a set time period is greater than a set number threshold or the number of days the process appears in the same abnormal state is greater than a set number threshold. Otherwise, it is set to the whitelist, that is, all whitelist processes are obtained through actual operation, that is, they are obtained through time verification, which makes the whitelist processes more accurate and can reduce security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 A flowchart of a process whitelist generation method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0018] The embodiment of the present invention provides a method for generating a process whitelist. Figure 1 As shown, the method may include the following steps:

[0019] S1, obtain the initial process list group P corresponding to the initial equipment under the working condition environment = (P1, P2, ..., Pi, ..., Pm), where the initial process list Pi of any initial equipment i = (P i1 , P i2 ,…,P ij ,…,P if(i) ), P ij is the jth initial process corresponding to the initial device i, i ranges from 1 to m, m is the number of initial devices; j ranges from 1 to f(i), f(i) is the number of initial processes corresponding to the initial device i.

[0020] In the embodiment of the present invention, the initial device may be a monitored device connected to the master control device in the working network environment. The initial process is all processes in the initial device, including trustworthy normal processes and untrustworthy abnormal processes.

[0021] S2, for Pi, get P ij The corresponding initial process status list PS ij =(PS 1 ij , P.S. 2 ij ,…,PS r ij ,…,PS n ij ), PS r ij is the P corresponding to the rth time interval in the first preset time period ij The initial process state of r is 1 to n, and n is the number of time intervals in the first preset time period.

[0022] In an embodiment of the present invention, the initial process state may include a normal state and an abnormal state. A process being in a normal state means that the execution of the process will not pose a threat to the security of the working network environment. A process being in an abnormal state means that the execution of the process will pose a threat or potential threat to the security of the working network environment.

[0023] In an embodiment of the present invention, the status of each process can be obtained based on an existing method. The first preset time period is a time period set for obtaining the whitelist process, and can be set based on actual needs. In a non-limiting exemplary embodiment, the first preset time period can be 7 days to 30 days, preferably 30 days, so that the process running time is as long as possible, so that the obtained whitelist process is more accurate. The time interval can also be set based on actual needs. In an exemplary embodiment, the unit of the time interval can be 1 day.

[0024] S3, traverse PS ij , if PS ij Medium PS r ij If it is an abnormal state, the PS that occurs within the first preset time period is obtained. r ij The number of time intervals C that are abnormal ij and C ij The number of occurrences corresponding to each time interval is the number of abnormal states occurring in each time interval; and S4 is executed.

[0025] In an exemplary embodiment of the present invention, the time interval may be 1 day, so that C ij PS in the first preset time period r ij The number of days in abnormal state. ij When d is 1 time interval, ij is the number of occurrences within this time interval.ij When the time interval is greater than 1, d ij C ij In the embodiment of the present invention, whether the state of the process is an abnormal state can be obtained based on the existing process abnormal state detection method.

[0026] S4, if C ij ≥C0, output the first mark, the first mark is used to characterize PS r ij The number of days in abnormal state is relatively large, so it can be determined that PS r ij If the process is abnormal, the first flag may be, for example, 0 or 1, and S5 is executed; otherwise, a second flag is output, which is used to characterize the PS r ij The number of days in the abnormal state is relatively small, which may be an accidental event, and S6 is executed; C0 is a preset threshold value of the number of abnormal time intervals. The second identifier can be set to a value different from the first identifier, for example, when the first identifier is 1, the second identifier can be 0, and vice versa.

[0027] S5, if PS ij PS occurs r ij The total number of D ij <D1, execute S6; otherwise, execute S7; d s ij C ij The number of occurrences corresponding to the s-th time interval in ; D1 is the preset first abnormal number threshold.

[0028] S6, PS ij As a whitelist process; get the whitelist process table of the i-th initial device;

[0029] S7, PS ij As a non-whitelist process, that is, a blacklist process.

[0030] The process whitelist generation method provided by the embodiment of the present invention sets the process to the blacklist if the number of times a process in the initial device appears abnormal within a set time period is greater than a set number threshold, otherwise, it is set to the whitelist, that is, all whitelist processes are obtained through actual operation, that is, they are obtained through time verification, which makes the whitelist process more accurate and can reduce security risks.

[0031] In another embodiment of the present invention, S4 is replaced by:

[0032] S42, if C is satisfied ijThe number of initial devices with ≥C0 is less than C1, and the third identifier is output. The third identifier is used to indicate that PS only appears in a few initial devices. r ij In the case of abnormal status, it is not enough to determine PS r ij If it is an abnormal process, S6 is executed. Otherwise, a fourth flag is output. The fourth flag is used to indicate that PS has appeared in a large number of initial devices. r ij In the case of abnormal state, it can be determined that PS r ij For an abnormal process, S7 is executed; C1 is a first set threshold. The third identifier can be set to, for example, 00 or 11, and the fourth identifier can be set to a value different from the third identifier. For example, when the third identifier is 11, the fourth identifier can be 00, and vice versa.

[0033] Compared with the previous embodiment, in this embodiment, if there are multiple devices in which the process has the same abnormal state for more than a set number of days, the process is set to the blacklist; otherwise, it is set to the whitelist, which can also make the whitelist process more accurate and reduce security risks.

[0034] In another embodiment of the present invention, it also includes:

[0035] S8, based on S6, obtain the whitelist process list PW=(PW1, PW2, ..., PWi, ..., PWm) of the initial device, where PWi=(PWi1, PWi2, ..., PWi u , …, PWi h(i) ), PWi u is the u-th whitelist process in the whitelist process table PWi corresponding to the i-th initial device, the value of u is 1 to h(i), and h(i) is the number of processes in PWi.

[0036] S9, when a new target device is detected to be added in the current working environment, a corresponding whitelist process is recommended to the target device based on the PW.

[0037] Furthermore, S9 specifically includes:

[0038] S91, obtain the target process list PB corresponding to the target device = (PB1, PB2, ..., PBv, ..., PBx), PBv is the vth target process corresponding to the target device, the value of v is 1 to x, and x is the number of target processes corresponding to the target device.

[0039] S92, based on PW, obtain a similarity list F=(F1, F2, ..., Fi, ..., Fm) corresponding to PB, where Fi is the similarity between the target device and the i-th initial device.

[0040] S92 may specifically include:

[0041] S921, obtain the process characteristic vector CPBv of PBv=(CPBv1, CPBv2, ..., CPBv h , …, CPBv z ), and P ij The process characteristic vector CP ij =(CP ij1 , CP ij2 , …, CP ijh , …, CP ijz ), CPBv h and CP ijh CPB and CP respectively ij The hth process feature in , where h is 1-z and z is the number of process features.

[0042] In the embodiment of the present invention, the process feature may include at least one of the MD5 value, digital signature and address of the process. Preferably, the process feature may include the MD5 value, digital signature and address of the process.

[0043] S922, based on CPB and CP ij Get PBv and P ij The similarity between F h v-ij CPBv h and CP ijh The similarity between h v-ij is the weight of the h-th process feature.

[0044] In the embodiment of the present invention, the similarity between two process features can be obtained by using an existing similarity algorithm, for example, an existing string similarity calculation method.

[0045] In an embodiment of the present invention, the weight of the process feature can be set based on actual conditions. In one example, the weight of the MD5 value of the process can be greater than the weight of the digital signature of the process, and the weight of the digital signature of the process can be greater than the weight of the address of the process.

[0046] S923, if max(F v-i1 , F v-i2 , …, F v-ij , …, F v-if(i) ,)≥S2, set the counter C=C+1, and execute S924; otherwise, execute S925; the initial value of C is 0, S2 is the second preset similarity threshold, which can be set based on actual conditions, for example, 1>S2≥0.95.

[0047] S924, set v=v+1, if v≤x, execute S922; otherwise, execute S925.

[0048] S925, obtain Fi=C / f(i).

[0049] S93, if maxF≥S1, recommend the whitelist process corresponding to maxF to the target device and mark the corresponding process in PB based on the recommended whitelist process. S1 is the first preset similarity threshold, which can be set based on actual conditions. S1 can be greater than S2.

[0050] The technical effect of S91 to S93 is that, since the corresponding whitelist process is recommended based on the similarity between the target device and the initial device, the recommended whitelist process is verified over time, making the recommended whitelist process more suitable for the target device and reducing security risks.

[0051] Furthermore, another embodiment of the present invention provides a method, further comprising:

[0052] S94, obtaining processes in the PB except those marked as whitelist processes as candidate processes.

[0053] S95, intersect any candidate process with the whitelist process table of each initial device respectively, if the number of intersections that are not Null is greater than C2, output a fifth identifier, the fifth identifier is used to indicate that the candidate process exists in more devices and is trustworthy, then recommend the candidate process as a whitelist process to the target device; C2 is the second set threshold, which can be set based on actual needs. The fifth identifier can be 01 or 10.

[0054] The technical effect of S94 to S95 is that, compared with S91 to S93, the recommended whitelist process can be made more accurate.

[0055] In the embodiment of the present invention, the MD5 value of any process of any device is obtained by the following steps:

[0056] S9220, for any process P of any initial device, if the size G of P is less than G0, obtain the MD5 value of A; if G≥G0, store A in the list of pending processes L; G0 is a preset byte threshold, which can be set based on actual needs, for example, it can be 1KB~2KB.

[0057] S9221, based on L, obtain the number of processes in each of N intervals, where N intervals are obtained by dividing the process size between the minimum process size and the maximum process size in L into N equal parts, that is, the range of the first interval is [G min ,G min +△G1), the range of the Nth interval is [G min+(N-1)*△G1,G max ], the range of the kth interval is [G min +(k-1)*△G1,G max ), G min and G max are the minimum process size and the maximum process size in L, respectively, ΔG1 is the first set step size, and the value of k is 1 to N-1. ΔG1 can be set based on actual needs, preferably, ΔG1=G0.

[0058] S9222, for any interval c, obtain data of size q from all processes in interval c and perform MD5 processing on the obtained data to obtain the corresponding MD5 value; the value of c is 1 to N, the initial value of q is R1, R1 is the preset initial process size, which can be set based on actual needs. In an example, R1 can be equal to G0.

[0059] S9223, obtaining the similarity of any two MD5 values ​​corresponding to the MD5 values ​​of the data of size q in interval c, if the similarity of any two MD5 values ​​is less than a third preset similarity threshold, taking q as the benchmark size for obtaining the process data in interval c, and executing S9225; otherwise, executing S9225. The third preset similarity threshold can be set based on actual needs, for example, greater than 95%.

[0060] S9224, set q=q+△G2, if q<Rg, execute S9222; otherwise, execute S9225; △G2 is the second set step size, which can be set based on actual needs. In one example, G2=G0; Rg is the set process size threshold, Rg=R1+E*△G2, E is an integer ≥2.

[0061] S9225, obtain max(Q1, Q2, ..., Qf, ..., Q E+1 ) that is, Q1, Q2, …, Qf, …, Q E+1 The process size corresponding to the largest one is used as the benchmark size for obtaining the process data in interval c, where Qf is the number of similarities in the similarity set formed by the similarity of any two MD5 values ​​corresponding to the MD5 values ​​of the data with a size of R1+(f-1)△G2 in the obtained interval c that are less than the third preset similarity threshold, and the value of f is 1 to E+1; execute S9226.

[0062] S9226, set c=c+1, if c≤N, execute S9222; otherwise, exit the control program.

[0063] The technical effect of S9220 to S9226 is that, for a process with a larger process size, process data of an appropriate size can be selected for MD5 processing, rather than processing the entire process data for MD5 processing, which can reduce computing time and save computing resources.

[0064] Furthermore, in another embodiment of the present invention, the method provided further includes:

[0065] S10, when a new target device is detected to be added in the current working environment, if there are parent and child processes in the target process corresponding to the target device, and when the parent process belongs to PW, it is determined whether the child process of the target device is a whitelist process.

[0066] Further, S10 specifically includes: executing only the child processes corresponding to the parent processes of all whitelist processes in the target device in the second preset time period, and obtaining the number of abnormalities of each child process during the execution; if the number of abnormalities corresponding to a child process is less than D2, the child process is used as a whitelist process, and D2 is a preset second abnormality threshold, which can be set based on actual needs. In an exemplary embodiment, D2 = D1. The duration of the second preset time period is less than the duration of the first preset time period, for example, it can be 7 days.

[0067] Furthermore, S10 also includes:

[0068] When the parent process does not belong to the PW, it is determined that the child process corresponding to the parent process is a process other than the whitelist process.

[0069] The technical effect of S10 is that when a device has a parent-child process, when the parent process is a process in the whitelist, it is necessary to determine whether the child process is a process in the whitelist, thereby ensuring that the whitelist process is more accurate.

[0070] Furthermore, in another embodiment of the present invention, the method provided further includes:

[0071] S11, if the whitelist process tables of the designated devices with the same set function label in the initial device are different, each whitelist process table of the designated device is set as a reference whitelist process table.

[0072] In the embodiment of the present invention, the same set function label refers to a label indicating the execution of the same function. Each function can be set with a corresponding label.

[0073] Furthermore, S11 specifically includes:

[0074] S111, obtaining a whitelist process table of a specified device, a whitelist process list H = (H1, H2, ..., He, ..., Hg), wherein the whitelist process table of the e-th device He = (He1, He2, ..., He b , …, He n(e) ), the value of e ranges from 1 to g, g is the number of specified devices, He b For the bth process of the eth device;

[0075] S112, if Determine He b It is an isolated process; H1 is the intermediate whitelist process table whitelist process list formed by the whitelist process table of H except He.

[0076] S113, if including He b If the number of whitelist processes of the reference device is greater than the set number threshold, He b Determine that it is a whitelist process; otherwise, execute S114; the reference device is a device other than the specified device in the initial device. The set quantity threshold can be set based on actual needs, for example, it can be more than 60% of the number of reference devices.

[0077] S114, delete He from the whitelist process and HC b , HC=(H1∪H2∪…∪He∪…∪Hg).

[0078] S115, using the HC with the isolated process deleted as the benchmark whitelist process table.

[0079] The technical effect of S111 to S115 is to ensure that the process whitelists in devices playing the same role (i.e., performing the same function) are the same, so that when adding devices playing the same role, a more suitable and accurate whitelist process can be recommended.

[0080] Furthermore, in another embodiment of the present invention, it also includes:

[0081] When an agent package that needs to be upgraded is detected within the first preset time period, the corresponding upgrade operation is performed.

[0082] In an embodiment of the present invention, when an agent package that needs to be upgraded is detected within a first preset time period, a corresponding upgrade operation is performed, which may specifically include the following steps:

[0083] S200, obtain the sending data packet size list A = (A1, A2, ..., Ai, ..., Am) and the version list V = (V1, V2, ..., Vi, ..., Vm), Ai is the size of a single data packet sent by the initial device i, and Vi is the current version corresponding to the initial device i.

[0084] The size of a single data packet sent by the initial device may be stored in the memory in advance. Generally, each initial device sends data packets of the same size according to a set period.

[0085] S210, based on A, B, the current network bandwidth K and the size of the proxy packet required for each initial device upgrade, obtain an upgrade information table corresponding to the set time period. The unit of K is bit / s. Further, S210 may specifically include:

[0086] S212, obtaining the total amount of data packets R that need to be sent in the current working environment within the set time period T0, and the size of the proxy packet C required for the initial device i upgrade i =(Bi*A0); Bi is the version number between Vi and the version corresponding to the agent package that needs to be upgraded. For example, if Vi is v.0 and the version corresponding to the agent package that needs to be upgraded is v.1, then Bi=1.

[0087] In the embodiment of the present invention, the set time period can be set based on actual needs, for example, it can be 1 hour or 1 day.

[0088] In an embodiment of the present invention, △Ti is the time interval for the initial device i to send data packets, in seconds, Indicates rounding down. TS0 is the duration corresponding to T0, in seconds.

[0089] In the embodiment of the present invention, A0 is the size of the proxy package that needs to be sent to each initial device to upgrade to the version corresponding to the proxy package. In this embodiment, if the current version of each initial device is the same, then A0 is equal to the size of the proxy package required for any device to upgrade. If the current versions of the initial devices are different, then A0 = max(C1, C2, ..., C i , …, C m ), which is the maximum size of the agent package required to upgrade all devices.

[0090] S214, if Output a sixth identifier, which is used to indicate that the traffic in T0 other than the traffic of sending data packets is sufficient to upgrade m initial devices, and execute S216. The sixth identifier can be represented by 000 or 0001, for example.

[0091] S216, obtaining any set time interval T0 within the set time period T0 sc Any time slice TH sc The number of initial devices that can be upgraded within Execute S218.

[0092] Among them, T0 sc ∈(T01, T02, …, T0sc , …, T0 sq ), sc ranges from 1 to sq, sq is the number of set time intervals in TO, TS01 = TS02 = ... = TS0 sc =…=TS0 sq =△t1, △t1 is the first set time interval, TS0 sc T0 sc The corresponding duration, in seconds. THP0 sc TH sc Duration included, THP0 s c = △t2, in seconds, H ranges from 1 to X, X is T0 sc The number of time slices obtained by dividing according to the second set time interval Δt2. n(sc, H) is the number of initial devices that are not currently upgraded.

[0093] In the embodiment of the present invention, Δt1 and Δt2 can be set based on actual needs. In one example, Δt1 can be equal to 0.5 hours, or equal to 1 hour, etc., Δt2 = Δt1 / J, where J is an integer greater than 1. Preferably, Δt2 = ΔT max -△T min , △T max =max(△T1,△T2,…,△T i ,…,△T m ), △T min =min(△T1,△T2,...,△T i ,…,△T m ).

[0094] Those skilled in the art know that when n(sc, H)=0, the current upgrade control program is exited.

[0095] S218, get T0 sc The corresponding upgrade information table, the Hth row of the upgrade information table includes (TH sc , NCscH). Execute S220.

[0096] S220: Based on the current upgrade instruction identifier, execute a corresponding upgrade operation according to the upgrade information table.

[0097] In an embodiment of the present invention, the upgrade instruction may include a first upgrade instruction and a second upgrade instruction, which may be identified by different identifiers. The first upgrade instruction is used to indicate the execution of an automatic upgrade operation, and the second upgrade instruction is used to indicate the execution of a manual upgrade operation. The first upgrade instruction identifier may be represented by AT, for example, and the second upgrade instruction identifier may be represented by H0, for example.

[0098] Further, S220 may specifically include:

[0099] S2201: If the current upgrade instruction identifier is the first upgrade instruction identifier, upgrade operations are performed on a corresponding number of devices in each time slice of each time interval of a set time period in sequence according to the upgrade information table.

[0100] In the embodiment of the present invention, the corresponding upgrade operation may be performed at a fixed time in each time slice, for example, the corresponding upgrade operation may be performed at the start time, end time or middle time of each time slice.

[0101] In the embodiment of the present invention, the upgrade operation can be performed in order from small to large according to the device number of the initial device. Each initial device is provided with a corresponding device number.

[0102] S2202, if the current upgrade instruction identifier is the second upgrade instruction identifier, then in accordance with the upgrade information table, in each time slice of each time interval of the set time period, prompt information for prompting to upgrade a corresponding number of devices in the sub-time slice is generated, for example, prompt information similar to "During the period of XXX-YYY, you can upgrade X devices". Preferably, prompt information similar to "During the period of XXX-YYY, you can upgrade X devices, and the device numbers include..." can be generated.

[0103] In the embodiment of the present invention, corresponding prompt information may be generated at a fixed time in each sub-time slice. For example, a corresponding upgrade operation may be performed at the start time, end time, or middle time of each time slice.

[0104] In this embodiment, when it is detected that the initial device needs to be upgraded, the number of devices that can be upgraded in each sub-time interval of each time interval within the set time period is obtained based on the network bandwidth, the proxy packet size, the size and version of a single data packet sent by the initial device, and then the corresponding upgrade operation is performed based on the corresponding upgrade instruction identifier. Since the network bandwidth is taken into consideration when upgrading the device, the impact of the upgrade on the network bandwidth can be avoided, that is, the impact on the sending of data packets can be avoided.

[0105] In another embodiment of the present invention, when an agent package that needs to be upgraded is detected within a first preset time period, a corresponding upgrade operation is performed, which may specifically include the following steps:

[0106] S300, obtaining a list of sizes of sent data packets A = (A1, A2, ..., Ai, ..., Am), where Ai is the size of a single data packet sent by the initial device i.

[0107] The size of a single data packet sent by the initial device may be stored in the memory in advance. Generally, each initial device sends data packets of the same size according to a set period.

[0108] S310, acquiring an upgrade information table corresponding to a set time period based on A, the current network bandwidth K, and the size of the proxy packet required for each initial device upgrade.

[0109] Further, S310 may specifically include:

[0110] S312, obtaining the total number R of data packets that need to be sent under the current working condition within the set time period T0.

[0111] In the embodiment of the present invention, the set time period can be set based on actual needs, for example, it can be 1 hour or 1 day.

[0112] In an embodiment of the present invention, △Ti is the time interval for the initial device i to send data packets, in seconds, Indicates rounding down. TS0 is the duration corresponding to T0, in seconds.

[0113] S314, if (TS0*KR)≥m*A0, output a sixth flag, which is used to indicate that the traffic in T0 other than the traffic of sending data packets is enough to upgrade m initial devices, and execute S216. The sixth flag can be represented by 000 or 0001, for example.

[0114] In this embodiment, A0 is the size of the proxy package sent to each initial device to upgrade to the version corresponding to the proxy package. In this embodiment, the current version of each initial device is the same, that is, the size of the proxy package sent to each device is A0.

[0115] S316, obtaining any set time interval T0 within the set time period T0 sc The number of initial devices that can be upgraded within NC sc =max(NC sc 1, NC sc 2, ..., NC sc H, ..., NC sc X). Execute S318.

[0116] Among them, T0 sc ∈(T01, T02, …, T0 sc , …, T0 sq ), sc ranges from 1 to sq, sq is the number of set time intervals in TO, TS01 = TS02 = ... = TS0 sc =…=TS0 sq =△t1, △t1 is the first set time interval, TS0 sc T0 sc The corresponding duration, in seconds. NCscH is T0 sc The Hth sub-time interval TH insc The initial number of devices that can be upgraded within , of which, THS0 sc TH sc Corresponding duration, THS0 sc =△t2*60*H, the unit is seconds, H ranges from 1 to X, X is T0 sc The number of sub-time intervals obtained by dividing the second set time interval Δt2. max(NC sc 1, NC sc 2, ..., NC sc H, ..., NC sc X) means take NC sc 1, NC sc 2, ..., NC sc H, ..., NC sc The maximum value in X.

[0117] In the embodiment of the present invention, Δt1 and Δt2 can be set based on actual needs. In one example, Δt1 can be equal to 0.5 hours, or equal to 1 hour, etc., Δt2 = Δt1 / J, where J is an integer greater than 1. Preferably, Δt2 = ΔT max -△T min , △T max =max(△T1,△T2,…,△T i ,…,△T m ), △T min =min(△T1,△T2,...,△T i ,…,△T m ).

[0118] S318, obtaining an upgrade information table corresponding to the set time period T0, wherein the hcth row of the upgrade information table includes (T0 sc , N.C. sc ). Execute S320.

[0119] S320: Based on the current upgrade instruction identifier, execute a corresponding upgrade operation according to the upgrade information table.

[0120] In an embodiment of the present invention, the upgrade instruction may include a first upgrade instruction and a second upgrade instruction, which may be identified by different identifiers. The first upgrade instruction is used to indicate the execution of an automatic upgrade operation, and the second upgrade instruction is used to indicate the execution of a manual upgrade operation. The first upgrade instruction identifier may be represented by AT, for example, and the second upgrade instruction identifier may be represented by H0, for example.

[0121] Further, S320 may specifically include:

[0122] S3201: If the current upgrade instruction identifier is the first upgrade instruction identifier, upgrade operations are performed on a corresponding number of devices in each time interval of a set time period in sequence according to the upgrade information table.

[0123] In the embodiment of the present invention, the corresponding upgrade operation may be performed at a fixed time in each time interval, for example, the corresponding upgrade operation may be performed at the start time, the end time, or the middle time of each time interval.

[0124] In the embodiment of the present invention, the upgrade operation can be performed in order from small to large according to the device number of the initial device. Each initial device is provided with a corresponding device number.

[0125] S3202, if the current upgrade instruction identifier is the second upgrade instruction identifier, then in each time interval of the set time period, prompt information for prompting to upgrade a corresponding number of devices in the time interval is generated in sequence according to the upgrade information table, for example, prompt information similar to "During the period of XXX-YYY, you can upgrade X devices". Preferably, prompt information similar to "During the period of XXX-YYY, you can upgrade X devices, and the device numbers include..." can be generated.

[0126] In the embodiment of the present invention, corresponding prompt information may be generated at a fixed time in each time interval. For example, a corresponding upgrade operation may be performed at the start time, end time, or middle time of each time interval.

[0127] Furthermore, in the embodiment of the present invention, after S314, the following steps are also included:

[0128] S315: if (TS0*KR)<m*A0, output the seventh flag and obtain the number of set time periods that need to be upgraded The seventh identifier is used to indicate that the traffic in T0 other than the traffic of sending data packets is insufficient to upgrade all the m initial devices. The seventh identifier may be different from the sixth identifier and may be represented by 001 or 000.

[0129] S317, obtaining any set time interval T0 in any set time period T0 among the S set time periods. sc The number of initial devices that can be upgraded within NC sc =max(NC sc 1, NC sc 2, ..., NC sc H, ..., NC sc X). Execute S319.

[0130] S319, obtaining an upgrade information table corresponding to each set time period T0, wherein the hcth row of the upgrade information table includes (T0 sc , N.C. sc ). Execute S320.

[0131] In this embodiment, when it is detected that the initial device needs to be upgraded, the maximum number of devices that can be upgraded in each time interval within the set time period is obtained based on the network bandwidth, the proxy packet size and the size of a single data packet sent by the initial device, and then the corresponding upgrade operation is performed based on the corresponding upgrade instruction identifier. Since the network bandwidth is taken into consideration when upgrading the device, it is possible to avoid affecting the network bandwidth due to the upgrade, that is, it is possible to avoid affecting the sending of the data packet. Since the time interval is used as the upgrade reference time, compared with the previous embodiment in which the sub-time interval is used as the upgrade reference time, the upgrade operation can be reduced.

[0132] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0133] An embodiment of the present invention further provides an electronic device, comprising a processor and the aforementioned non-transitory computer-readable storage medium.

[0134] An embodiment of the present invention further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0135] Although some specific embodiments of the present invention have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A process whitelist generation method, characterized in that: The method comprises the following steps: S1, obtain the initial process list group P = (P1, P2, ..., Pi, ..., Pm) corresponding to the initial equipment under the working condition, where the initial process list Pi of any initial equipment i = (P i1 , P i2 ,…,P ij ,…,P if（i） ), P ij is the jth initial process corresponding to the initial device i, i ranges from 1 to m, m is the number of initial devices; j ranges from 1 to f(i), f(i) is the number of initial processes corresponding to the initial device i; S2, for Pi, get P ij The corresponding initial process status list PS ij =(PS 1 ij , P.S. 2 ij ,…,PS r ij , …, PS n ij ), PS r ij is the P corresponding to the rth time interval in the first preset time period ij The initial process state of r is 1 to n, and n is the number of time intervals in the first preset time period; S3, traverse PS ij , if PS ij Medium PS r ij If it is an abnormal state, obtain the PS in the first preset time period ij PS occurs r ij The number of time intervals C ij and C ij The number of occurrences corresponding to each time interval in; execute S4; S4, if C ij ≥C0, execute S5; otherwise, execute S6; C0 is the preset abnormal time interval number threshold; S5, if PS ij PS occurs r ij The total number of D ij <D1, execute S6; otherwise, execute S7; , d s ij C ij The number of occurrences corresponding to the s-th time interval in , D1 is the preset first abnormal number threshold; S6, PS ij As a whitelist process; get the whitelist process table of the i-th initial device; S7, PS ij As a non-whitelisted process; S8, based on S6, obtain the whitelist process list PW=(PW1, PW2, ..., PWi, ..., PWm) of the initial device, where PWi=(PWi1, PWi2, ..., PWi u , …, PWi h（i） ), PWi u is the u-th whitelist process in the whitelist process table PWi corresponding to the i-th initial device, where u ranges from 1 to h(i), and h(i) is the number of processes in PWi; S9, when a new target device is detected to be added to the current working environment, the corresponding whitelist process is recommended to the target device based on the PW; S9 specifically includes: S91, obtaining a target process list PB=(PB1, PB2, ..., PBv, ..., PBx) corresponding to the target device, where PBv is the vth target process corresponding to the target device, and the value of v ranges from 1 to x, where x is the number of target processes corresponding to the target device; S92, based on PW, obtain a similarity list F=(F1, F2, ..., Fi, ..., Fm) corresponding to PB, where Fi is the similarity between the target device and the i-th initial device; S93, if maxF ≥ S1, recommend the whitelist process corresponding to maxF to the target device and mark the corresponding process in PB based on the recommended whitelist process, where S1 is a first preset similarity threshold; S94, obtaining processes other than those marked as whitelist processes in the PB as candidate processes; S95, intersecting any candidate process with the whitelist process table of each initial device, if the number of intersections that are not 0 is greater than C2, recommending the candidate process as a whitelist process to the target device; C2 is a second set threshold; Also includes: S10, when a new target device is detected to be added in the current working environment, if there are parent and child processes in the target process corresponding to the target device, and when the parent process belongs to the PW, it is determined whether the child process of the target device is a whitelist process; S10 specifically includes: executing only the child processes corresponding to the parent processes that are whitelist processes in the target device in the second preset time period, and obtaining the number of abnormal times of each child process occurring abnormally during the execution; if the number of abnormal times corresponding to a child process is less than D2, then the child process is used as a whitelist process, D2 is the preset second abnormal number threshold, and the second preset time period is less than the first preset time period.

2. The method according to claim 1, characterized in that S4 is replaced by: S42, if C is satisfied ij If the number of initial devices ≥ C0 is less than C1, execute S6, otherwise, execute S7; C1 is the first set threshold.

3. The method according to claim 1, characterized in that: S92 specifically includes: S921, obtain the process characteristic vector CPBv = (CPBv1, CPBv2, ..., CPBv h , …, CPBv z（v） ), and P ij The process characteristic vector CP ij =(CP ij1 , CP ij2 , …, CP ijh1 , …, CP ijz（i，j） ), CPBv h is the hth process feature in CPBv, where h ranges from 1 to z(v), and z(v) is the number of process features in CPBv; ijh1 For CP ij The h1th process feature in the process, h1 ranges from 1 to z(i, j), z(i, j) is CP ij The number of process features in ; S922, based on CPBv and CP ij Get PBv and CP ij The similarity between v-ij = , CPBv h and CP ij The similarity between is the weight of the hth process feature; if CPBv h ∈CP ij ,but =1, otherwise, =0; S923, if max(F v-i1 , F v-i2 , …, F v-ij , …, F v-if（i） ,)≥S2, set the counter C=C+1, and execute S924; otherwise, execute S925; the initial value of C is 0; S2 is the second preset similarity threshold; S924, set v=v+1, if v≤x, execute S922; otherwise, execute S925; S925, obtain Fi=C / f(i).

Images