Windows-based process interception method and system

Abstract

The present invention discloses a process interception method and system based on Windows, the method comprising: creating and initializing a process information table; registering a kernel process notification callback and a thread notification callback; judging whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, the current process is recorded in the process information table; judging whether the process of the current startup thread is a process that needs to be intercepted based on the thread notification callback; wherein, when the process of the current startup thread is a process that needs to be intercepted, the process of the current startup thread is intercepted, and the process of the current startup thread is terminated. Through the processing scheme disclosed in the present invention, the system is ensured to run stably, be compatible with all versions of the system, and protect the system from the attack threat of malicious virus processes.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security defense, and in particular to a Windows-based process interception method and system. Background Art

[0002] With the continuous development of computers, information security has been paid more and more attention. In the operating system, all data exchange operations are initiated by processes. Therefore, in the field of information security, monitoring process startup and operation is the top priority of information security. Therefore, major security companies are trying to intercept processes before or at the beginning of the process, screen various information and program files carried by the process, and ensure that the started program is safe.

[0003] However, due to the large number of Windows system versions, the kernel has been continuously optimized and protected from the early days to the present (2022). The interfaces provided in the kernel have been constantly changing, and users use various versions of the system. In order to be compatible with old system versions and support new versions of the system and ensure that future system versions can be supported, major security companies continue to try, and the technical solutions for process interception have different implementation characteristics.

[0004] There are many similar process startup interception solutions on the market. Each security vendor has related process startup monitoring and interception technology in antivirus software or other system protection solutions. The effects achieved by each company are similar, but each company has its own characteristics in the specific implementation technology.

[0005] In order to ensure the stability of the system kernel and not affect users, most security companies use process interception methods at the application layer to avoid the impact of using drivers on users, but this method cannot guarantee 100% monitoring of all processes and solve user security issues. Because all system versions need to be supported and the system must be stable, the startup program is injected and hooked at the application layer to implement process startup interception. This method has obvious disadvantages. Once the process cannot be injected and hooked, the monitoring of this process will be missed.

[0006] In early system versions, such as XP and WIN7, security vendors usually use kernel hooking methods, such as HOOKSSDT, to monitor and intercept all processes started by the system in the kernel. This method can intercept all started processes, but the system compatibility is poor. On high-version systems, because the system kernel has undergone major updates, hooking operations on the kernel are no longer allowed, resulting in this technical solution not supporting high-version systems. Some manufacturers have solved the problem of kernel protection and still use kernel hooking technology, but it cannot guarantee the stable operation of the system, and serious problems such as blue screens often occur. This technology is also unable to be compatible with other products that also use kernel hooks, and it is easy to cause conflicts, resulting in blue screen problems.

[0007] Some manufacturers cannot provide compatible support due to system kernel version issues, so they adopt the process monitoring and interception solution at the application layer. This technology is to inject all processes at the application layer, hook the API to create the process, and trigger this API when the process starts a new process to achieve the purpose of monitoring and interception. Because this technology is a monitoring method at the application layer, it can be bypassed by a large number of methods to release the monitoring and interception of the process, which will not achieve the protection effect.

[0008] In order to solve the compatibility and difference issues of various versions, some security vendors have used a variety of technical means to implement process startup interception. For example, in low-version systems, they still use the hook method, and in high-version systems, they use the monitoring notification interface newly provided by the system kernel to intercept process startup.

[0009] In order to ensure the universality of the implemented technology, some security vendors directly use a process startup notification callback provided by the lower version system kernel. This interface provided by the system cannot directly end the process. If the process being started is stopped, an error window will pop up to the user to inform the user that a process failed to start. Obviously, this is not what the security vendors want, so some security vendors use this early callback interface while still hooking the pop-up window on the desktop. When a process is ended and the system pops up an error window, it will directly close the pop-up error window, which is imperceptible to the user. However, in fact, it is just closed at the moment the window pops up, and the error window still exists.

[0010] Although the above-mentioned process interception method can ensure computer security to a certain extent, it is found that there are still several shortcomings in the method in actual use, so it fails to achieve the best use effect. The shortcomings can be summarized as follows:

[0011] 1) It is easy to be bypassed, causing security risks;

[0012] 2) The system has poor compatibility and conflicts easily occur, resulting in blue screen problems.

[0013] It can be seen that the above-mentioned existing process interception method still has inconveniences and defects in use, and is in urgent need of further improvement. How to create a new process interception method has become a goal that the industry urgently needs to improve. Summary of the invention

[0014] In view of this, an embodiment of the present disclosure provides a windows-based process interception method, which at least partially solves the problems existing in the prior art.

[0015] In a first aspect, an embodiment of the present disclosure provides a Windows-based process interception method, the method comprising the following steps:

[0016] Create and initialize the process information table;

[0017] Register kernel process notification callback and thread notification callback;

[0018] Determining whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, recording the current process in the process information table;

[0019] Based on the thread notification callback, it is determined whether the process of the currently started thread is a process that needs to be intercepted; wherein, when the process of the currently started thread is a process that needs to be intercepted, the process of the currently started thread is intercepted and the process of the currently started thread is terminated.

[0020] According to a specific implementation of the embodiment of the present disclosure, the method further includes:

[0021] Create a process and open the process space of the process object;

[0022] Initializing a process kernel object and a thread kernel object of the process;

[0023] Load the executable file of the process into the memory, and load all dependent dynamic libraries of the process;

[0024] Creating a thread object of the process in the kernel and initializing the thread object; wherein the thread object is the main thread of the process;

[0025] Find the entry point of the program in the main thread through the execution file;

[0026] The location of the entry point is called, execution is handed over to the process, the process starts executing, and begins to run normally.

[0027] According to a specific implementation of the embodiment of the present disclosure, the method further includes:

[0028] Call kernel process and thread to create notification callback;

[0029] Obtaining the creation action of the process and thread based on the notification callback;

[0030] When the process or thread is created, it is determined whether the process is a process that needs to be intercepted and is recorded in the process information table.

[0031] According to a specific implementation of the embodiment of the present disclosure, the method further includes:

[0032] When the process is a process that needs to be intercepted and is recorded in the process information table, a kernel process termination API is called in the kernel to terminate the process.

[0033] According to a specific implementation of an embodiment of the present disclosure, the determining whether the current process needs to be intercepted based on the process notification callback includes the following steps:

[0034] Acquiring the process information based on the process notification callback, matching the process information to see if it matches a preset interception strategy, and determining that the process is a process that needs to be intercepted if it matches; and

[0035] The process information is added to the process information table.

[0036] According to a specific implementation of an embodiment of the present disclosure, the step of judging whether the process of the currently started thread is a process that needs to be intercepted based on the thread notification callback includes the following steps:

[0037] The process information is obtained based on the thread notification callback, and it is determined whether the process information table contains the process information; wherein, when the process information table contains the process information, it is determined that the process needs to be intercepted.

[0038] In a second aspect, an embodiment of the present disclosure provides a windows-based process interception system, the system comprising:

[0039] An initialization module is configured to create and initialize a process information table; and register a kernel process notification callback and a thread notification callback;

[0040] A process interception module is configured to determine whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, the current process is recorded in the process information table; and

[0041] Based on the thread notification callback, it is determined whether the process of the currently started thread is a process that needs to be intercepted; wherein, when the process of the currently started thread is a process that needs to be intercepted, the process of the currently started thread is intercepted and the process of the currently started thread is terminated.

[0042] According to a specific implementation of the embodiment of the present disclosure, the system further includes:

[0043] The kernel interception module is configured to call the kernel process and thread creation notification callback; obtain the creation action of the process and thread based on the notification callback; when the process and thread have a creation action, perform a processing action on the process; and when the process is a process that needs to be intercepted recorded in the process information table, call the kernel end process API in the kernel to end the process.

[0044] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0045] at least one processor; and,

[0046] a memory communicatively connected to the at least one processor; wherein,

[0047] The memory stores instructions that can be executed by the at least one processor. When the instructions are executed by the at least one processor, the at least one processor implements the windows-based process interception method described in any one of the first aspect or any one of the implementations of the first aspect.

[0048] In a fourth aspect, an embodiment of the present disclosure further provides a non-transitory computer-readable storage medium, which stores computer instructions, and when the computer instructions are executed by at least one processor, the at least one processor executes the Windows-based process interception method in the aforementioned first aspect or any implementation of the first aspect.

[0049] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the Windows-based process interception method in the aforementioned first aspect or any implementation of the first aspect.

[0050] The windows-based process interception method in the disclosed embodiment uses a kernel-level monitoring and interception technical solution, so that any bypass means at the application layer cannot truly bypass the kernel's monitoring of the process, thereby satisfying a stable and complete process monitoring and interception effect. Through the interception technology of the present invention, compatible and stable interception protection of various versions of systems can be achieved, without the need to hook the desktop pop-up window, and the system will not pop up an error window after intercepting and ending the process, and there is no need to add the hiding and elimination logic of the error window. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0052] Figure 1 A flowchart of a windows-based process interception method provided by an embodiment of the present disclosure;

[0053] Figure 2 A flowchart of a process interception method based on Windows provided in an embodiment of the present disclosure;

[0054] Figure 3 A schematic diagram of a process startup principle provided by an embodiment of the present disclosure;

[0055] Figure 4 A schematic diagram of a kernel monitoring and interception method provided by an embodiment of the present disclosure;

[0056] Figure 5 A schematic diagram of a windows-based process interception system structure provided by an embodiment of the present disclosure; and

[0057] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0058] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0059] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0060] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement a device and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0061] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0062] The present invention does not use the kernel HOOK and other technologies in the prior art to implement interception, will not affect system stability, will not destroy the system protection mechanism, will not trigger the system blue screen, will not conflict with the technology using the kernel HOOK, and achieves compatibility. The existing technology only provides a normal process / thread creation notification method, but does not provide a corresponding interception method, and the known interception solution cannot achieve compatibility with low-version systems.

[0063] The embodiment of the present invention provides a process interception method based on Windows, which monitors the startup of the intercepted process through Windows kernel process creation and thread creation notification callback technology, and intercepts the process in the thread startup of the process by utilizing the characteristics of the next process startup loading and running in Windows. The key point of the present invention is to monitor and intercept the started process under the Windows kernel, and only use the conventional process thread notification means under Windows, without using the kernel HOOK and application layer HOOK injection mode, to ensure the stable operation of the system and stably monitor and intercept all processes.

[0064] The Windows process interception main defense technology uses kernel driver technology, utilizes the process creation and thread creation notification callback interface provided by the system, registers the process creation and thread creation notification callback function through the system kernel API, monitors all started process programs in the callback, monitors process startup and thread startup, obtains process information when the process starts, determines whether the process needs to be intercepted, and then intercepts the thread of this process when it starts, and uses the kernel API to end this process.

[0065] Process: A program running on the system.

[0066] Thread: A task running in a process.

[0067] Notification callback: Windows provides a notification registration interface for process startup and thread startup. Through this interface, you can register a notification callback and be notified through the callback when the process starts or the thread starts.

[0068] Figure 1 A schematic diagram of the process flow of a Windows-based process interception method provided in an embodiment of the present disclosure.

[0069] Figure 2 For Figure 1 The corresponding flow chart of the windows-based process interception method.

[0070] like Figure 1 As shown, at step S110, a process information table is created and initialized.

[0071] More specifically, a process information table is created and initialized, and this information table is used to store the startup process information that needs to be intercepted.

[0072] More specifically, the process proceeds to step S120.

[0073] At step S120 , a kernel process notification callback and a thread notification callback are registered.

[0074] More specifically, register the kernel notification callback, call the system operation to register the process and thread notification callback, and obtain the process and thread creation action;

[0075] Next, go to step S130.

[0076] At step S130, it is determined whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, the current process is recorded in the process information table.

[0077] More specifically, whether the process needs to be intercepted is detected in the process notification callback, and if interception is required, the process information is recorded in the process information table.

[0078] In an embodiment of the present invention, judging whether the current process needs to be intercepted based on the process notification callback includes the following steps:

[0079] Acquiring the process information based on the process notification callback, matching the process information to see if it matches a preset interception strategy, and determining that the process is a process that needs to be intercepted if it matches; and

[0080] The process information is added to the process information table.

[0081] More specifically, the driver maintains a set of interception strategies issued by the application layer. This strategy can be regarded as a blacklist. When the process obtained in the process notification callback matches the interception strategy, it is the process that needs to be intercepted. The process information will be recorded in the process information table, which is the list of processes that need to be intercepted.

[0082] Next, go to step S140.

[0083] At step S140, it is determined whether the process of the currently started thread is a process that needs to be intercepted based on the thread notification callback; wherein, when the process of the currently started thread is a process that needs to be intercepted, the process of the currently started thread is intercepted and the process of the currently started thread is terminated.

[0084] More specifically, in the thread notification callback, a comparison is made to see whether the process of the currently started thread is a process that needs to be intercepted; if the process is a process that needs to be intercepted, it will be intercepted in this logic, and the system process termination interface will be called to terminate the current process.

[0085] In an embodiment of the present invention, judging whether the process of the currently started thread is a process that needs to be intercepted based on the thread notification callback includes the following steps:

[0086] The process information is obtained based on the thread notification callback, and it is determined whether the process information table contains the process information; wherein, when the process information table contains the process information, it is determined that the process needs to be intercepted.

[0087] In an embodiment of the present invention, the method further includes:

[0088] Create a process and open the process space of the process object;

[0089] Initializing a process kernel object and a thread kernel object of the process;

[0090] Load the executable file of the process into the memory, and load all dependent dynamic libraries of the process;

[0091] Creating a thread object of the process in the kernel and initializing the thread object; wherein the thread object is the main thread of the process;

[0092] Find the entry point of the program in the main thread through the execution file;

[0093] The location of the entry point is called, execution is handed over to the process, the process starts executing, and begins to run normally.

[0094] More specifically, if Figure 3 The figure shows the execution flow of a process startup in the kernel in the Windows operating system, describing how a process is created and started in the kernel.

[0095] When a process is started by the user, the system will switch to the kernel through a call and implement the process startup in the kernel. That is, when a process is started, the operating system will switch from ring3 to ring0 through system interrupts to actually create and start the process. This operation is the behavior of the operating system and does not require driver intervention.

[0096] Create a process object, open its own process space for this process, initialize the process kernel object and thread kernel object required by the process, etc.

[0097] Load the program file, load the process's executable file into memory, and load all dependent dynamic libraries for the process, providing the program with all the environments it depends on at runtime.

[0098] Create a thread object for this process in the kernel and initialize the thread object. This thread is the main thread of the process.

[0099] In the main thread, according to the program file loaded in the second step, the entry point of the program (main function) is found. After a series of operating environment initializations, the entry point location is called, the execution right is handed over to the program, the program starts to execute, and the process starts to run normally.

[0100] In an embodiment of the present invention, the method further includes:

[0101] Call kernel process and thread to create notification callback;

[0102] Obtaining the creation action of the process and thread based on the notification callback;

[0103] When the process or thread is created, it is determined whether the process is a process that needs to be intercepted and is recorded in the process information table.

[0104] When the process is a process that needs to be intercepted and is recorded in the process information table, a kernel process termination API is called in the kernel to terminate the process.

[0105] More specifically, if Figure 4 The following is a schematic diagram of the kernel monitoring and interception method, which includes the following steps:

[0106] Step 1: Call the kernel-level process and thread creation notification callback to obtain the system's process thread creation action;

[0107] Step 2: Get the creation action of the system process and thread in the kernel process space. In other words, when the creation action is obtained, you can perform processing actions on the process.

[0108] Step 3: When you need to end the process, call the kernel process end API in the kernel to end the process. If you need to release the process, just release it directly.

[0109] The process interception method based on Windows proposed in the present invention protects the system from the kernel layer and intercepts malicious processes through the kernel-level monitoring and interception technology, thereby raising the technical threshold and preventing functional failure due to bypassing and countermeasure technology at the application layer. The universal interception technical solution achieves an interception technical solution that is compatible with all system versions, does not require a combination of multiple interception technologies to form a complex interception solution, has simple code, and clear implementation logic, making kernel protection easy to use, the system stable, and the functions easy to maintain.

[0110] The present invention achieves kernel-level monitoring while ensuring that all process starts are monitored and intercepted, and will not cause monitoring and interception failure due to adversarial technologies such as bypassing the application layer. It also ensures stable system operation and compatibility with all version systems, protecting the system from attack threats from malicious virus processes.

[0111] Figure 5The Windows-based process interception system 500 provided by the present invention is shown, including an initialization module 510 and a process interception module 520 .

[0112] Initialization module 510 creates and initializes a process information table; and registers a kernel process notification callback and a thread notification callback;

[0113] The process interception module 520 is used to determine whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, the current process is recorded in the process information table; and

[0114] Based on the thread notification callback, it is determined whether the process of the currently started thread is a process that needs to be intercepted; wherein, when the process of the currently started thread is a process that needs to be intercepted, the process of the currently started thread is intercepted and the process of the currently started thread is terminated.

[0115] In an embodiment of the present invention, the system further includes:

[0116] The kernel interception module is configured to call the kernel process and thread creation notification callback; obtain the creation action of the process and thread based on the notification callback; when the process and thread have a creation action, perform a processing action on the process; and when the process needs to be ended, call the kernel end process API in the kernel to end the process.

[0117] See also Figure 6 The embodiment of the present disclosure further provides an electronic device 60, the electronic device comprising:

[0118] at least one processor; and,

[0119] a memory communicatively connected to the at least one processor; wherein,

[0120] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the windows-based process interception method in the aforementioned method embodiment.

[0121] The embodiment of the present disclosure also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the Windows-based process interception method in the aforementioned method embodiment.

[0122] The embodiments of the present disclosure also provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the Windows-based process interception method in the aforementioned method embodiment.

[0123] Reference below Figure 6 , which shows a schematic diagram of the structure of an electronic device 60 suitable for implementing the embodiment of the present disclosure. The electronic device in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0124] like Figure 6 As shown, the electronic device 60 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 60 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0125] Typically, the following devices may be connected to the I / O interface 605: input devices 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 608 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 609. The communication device 609 may allow the electronic device 60 to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device 60 with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0126] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0127] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0128] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0129] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains at least two Internet Protocol addresses; sends a node evaluation request including the at least two Internet Protocol addresses to a node evaluation device, wherein the node evaluation device selects an Internet Protocol address from the at least two Internet Protocol addresses and returns it; receives the Internet Protocol address returned by the node evaluation device; wherein the obtained Internet Protocol address indicates an edge node in a content distribution network.

[0130] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: receives a node evaluation request including at least two Internet Protocol addresses; selects an Internet Protocol address from the at least two Internet Protocol addresses; and returns the selected Internet Protocol address; wherein the received Internet Protocol address indicates an edge node in a content distribution network.

[0131] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0132] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0133] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0134] It should be understood that various parts of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.

[0135] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A windows-based process interception method, characterized in that: The method comprises the following steps: Create and initialize the process information table; Register kernel process notification callback and thread notification callback; Determining whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, recording the current process in the process information table includes the following steps: Acquiring the process information based on the process notification callback, matching the process information to see if it matches a preset interception strategy, and determining that the process is a process that needs to be intercepted if it matches; and Adding the process information to the process information table; Based on the thread notification callback, determining whether the process of the current startup thread is a process that needs to be intercepted includes the following steps: Acquire the process information based on the thread notification callback, and determine whether the process information table contains the process information; wherein, when the process information table contains the process information, determine that the process needs to be intercepted; Wherein, when the process of the currently started thread needs to intercept the current process, the process of the currently started thread is intercepted, and the process of the currently started thread is terminated.

2. The windows-based process interception method according to claim 1, characterized in that: The method further comprises: Create a process and open the process space of the process object; Initializing a process kernel object and a thread kernel object of the process; Load the executable file of the process into the memory, and load all dependent dynamic libraries of the process; Creating a thread object of the process in the kernel and initializing the thread object; wherein the thread object is the main thread of the process; Find the entry point of the program in the main thread through the execution file; The location of the entry point is called, execution is handed over to the process, the process starts executing, and begins to run normally.

3. The windows-based process interception method according to claim 2, characterized in that: The method further comprises: Call kernel process and thread to create notification callback; Obtaining the creation action of the process and thread based on the notification callback; When the process or thread is created, it is determined whether the process is a process that needs to be intercepted and is recorded in the process information table.

4. The windows-based process interception method according to claim 3, characterized in that: The method further comprises: When the process is a process that needs to be intercepted and is recorded in the process information table, a kernel process termination API is called in the kernel to terminate the process.

5. A windows-based process interception system, characterized in that: The system comprises: An initialization module is configured to create and initialize a process information table; and register a kernel process notification callback and a thread notification callback; The process interception module is configured to determine whether the current process needs to be intercepted based on the process notification callback; wherein, when the current process needs to be intercepted, the current process is recorded in the process information table, including the following steps: Acquiring the process information based on the process notification callback, matching the process information to see if it matches a preset interception strategy, and determining that the process is a process that needs to be intercepted if it matches; and Adding the process information to the process information table; And judging whether the process of the currently started thread is a process that needs to be intercepted based on the thread notification callback, including the following steps: Acquire the process information based on the thread notification callback, and determine whether the process information table contains the process information; wherein, when the process information table contains the process information, determine that the process needs to be intercepted; Wherein, when the process of the currently started thread needs to intercept the current process, the process of the currently started thread is intercepted, and the process of the currently started thread is terminated.

6. The windows-based process interception system according to claim 5, characterized in that: The system further comprises: The kernel interception module is configured to call the kernel process and thread creation notification callback; obtain the creation action of the process and thread based on the notification callback; when the process and thread have a creation action, perform a processing action on the process; and when the process is a process that needs to be intercepted recorded in the process information table, call the kernel end process API in the kernel to end the process.

7. An electronic device, characterized in that: The electronic device includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor executes the windows-based process interception method as described in any one of claims 1 to 4.

8. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by at least one processor, cause the at least one processor to perform the windows-based process interception method according to any one of claims 1 to 4.

Images