Application identification method, device, equipment, storage medium and program product

Abstract

The present application relates to an application identification method, apparatus, device, storage medium, and program product, and relates to the field of network security. The method obtains process information of any process in a target application when it is in a running state, constructs an application identification of the target application based on the process information, and finally updates the initial application identification of the target application based on the application identification. The initial application identification is constructed when the target application is installed in the operating system but not running. This method can improve the accuracy of application identification.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an application identification method, apparatus, device, storage medium, and program product. Background Art

[0002] With the rapid development of information technology, the applications in operating systems are becoming more and more diverse. At the same time, maintaining the security of operating systems is becoming more and more important.

[0003] Taking the Windows operating system as an example, when maintaining the security of the operating system, the relevant technology monitors the application programs of the operating system by identifying the application identifiers of each application in the operating system to maintain the security of the operating system.

[0004] However, the accuracy of the application identification determined by the related art is low. Summary of the Invention

[0005] Based on this, it is necessary to provide an application identification method, device, equipment, storage medium and program product to address the above technical problems, which can improve the accuracy of application identification of applications.

[0006] In a first aspect, an embodiment of the present application provides an application identification method, the method comprising:

[0007] When any process in the target application is in a running state, obtain the process information of the process;

[0008] Construct an application identifier of the target application based on the process information of the process;

[0009] The initial application ID of the target application is updated according to the application ID. The initial application ID is constructed when the target application is installed in the operating system but is not running.

[0010] In one embodiment, constructing an application identifier of a target application based on process information of a process includes:

[0011] Get all executable files and process executable file names of the target application according to the process information of the process;

[0012] Construct the application ID of the target application based on all executable files and process executable file names of the target application.

[0013] In one embodiment, the process information includes a process path and a parent-child relationship of the process; and all executable files of the target application are obtained based on the process information of the process, including:

[0014] Obtain the executable file of the process according to the process path in the process information; and obtain the executable files of other processes in the target application except the process according to the process parent-child relationship in the process information;

[0015] Aggregate the executable files of the process and the executable files of other processes to obtain all the executable files of the target application.

[0016] In one embodiment, the process information includes a process handle; obtaining the process executable file name of the target application according to the process information includes:

[0017] Determine the target application's process executable file name based on the process handle in the process information.

[0018] In one embodiment, constructing an application identifier of a target application based on all executable files and process executable file names of the target application includes:

[0019] Parse all executable files of the target application to obtain the dynamic feature information of the target application;

[0020] An application identifier of each target application is constructed according to the application dynamic feature information of the target application and the process executable file name of the target application.

[0021] In one embodiment, constructing an application identifier of each target application based on the application dynamic feature information of the target application and the process executable file name of the target application includes:

[0022] In the case where the target application includes a process, combining the process executable file name of the target application and the application dynamic feature information to obtain an application identifier of the target application;

[0023] When the target application includes multiple processes, the process executable file name of the target application is determined as the main process executable file name of the application, and the application identifier of the target application is obtained based on the main process executable file name of the application and the application dynamic feature information.

[0024] In one embodiment, updating the initial application identifier of the target application according to the application identifier includes:

[0025] Obtaining the initial application identifier of the target application from the local application data relationship library of the operating system;

[0026] The application ID of the target application is merged with the initial application ID to update the initial application ID of the target application.

[0027] In one embodiment, the method further comprises:

[0028] By running the process monitoring program in the operating system, the process running status of each application in the operating system is monitored;

[0029] If any process in the target application is in a running state, executing the step of obtaining process information of the process;

[0030] If the target application is in a state of being installed and all processes in the target application are in a non-running state, an initial application identifier of the target application is constructed.

[0031] In one embodiment, constructing an initial application identifier of a target application includes:

[0032] Obtain the file installation information of the target application and the name of the initial process executable file of the target application;

[0033] An initial application identifier of the target application is constructed according to the file installation information of the target application and the initial process executable file name of the target application.

[0034] In one embodiment, obtaining file installation information of a target application includes:

[0035] Get the target application's file installation information from the operating system's registry.

[0036] In one embodiment, obtaining the name of the initial process executable file of the target application includes:

[0037] In the case where the target application includes a process, obtaining the initial process executable file name of the target application from the registry of the operating system;

[0038] In the case that the target application includes multiple processes, the initial main process executable file name of the target application is obtained by executing the main process executable file path scanning strategy.

[0039] In one embodiment, the main process executable file path scanning strategy is executed to obtain the initial main process executable file name of the target application, including:

[0040] In accordance with a preset order, query the registry, the operating system startup items, and the operating system shortcuts to see if the name of the initial main process executable file of the target application exists;

[0041] If it exists, get the name of the target application's initial main process executable file;

[0042] If it does not exist, the name of the initial main process executable file of the target application is obtained according to the file installation information.

[0043] In one embodiment, obtaining the name of the initial main process executable file of the target application according to the file installation information includes:

[0044] Get the installation location of the target application based on the file installation information;

[0045] According to the installation location of the target application, multiple executable files are obtained under the installation location;

[0046] The name of the executable file with the largest storage capacity is determined as the initial main process executable file name of the target application.

[0047] In one embodiment, constructing an initial application identifier of a target application based on file installation information of the target application and the name of the initial process executable file of the target application includes:

[0048] Get all executable files in the target application's file installation information;

[0049] Parsing all executable files in the file installation information of the target application to obtain application static feature information of the target application;

[0050] An initial application identifier of the target application is constructed according to the application static feature information of the target application and the initial process executable file name of the target application.

[0051] In one embodiment, constructing an initial application identifier of the target application based on application static feature information of the target application and the name of the initial process executable file of the target application includes:

[0052] In the case where the target application includes one process, combining the initial process executable file name of the target application and the application static feature information to obtain an application identifier of the target application;

[0053] When the target application includes multiple processes, the main process executable file name of the target application is obtained according to the process executable file name of the target application, and the main process executable file name of the application and the application static feature information are combined to obtain the initial application identification of the target application.

[0054] In one embodiment, obtaining all executable files in the file installation information of the target application includes:

[0055] According to the file installation information of the target application, obtain the application identification data in the file installation information;

[0056] According to the application identification data, executable files identical to the application identification data are obtained from a preset data collection library as all executable files in the file installation information of the target application.

[0057] In one embodiment, obtaining all executable files in the file installation information of the target application includes:

[0058] According to the file installation information of the target application, obtain the installation location in the file installation information;

[0059] Get multiple folders under the installation directory at the installation location;

[0060] According to the version number of each folder, the executable file in the folder with the highest version number is obtained as all the executable files in the file installation information of the target application.

[0061] In one embodiment, obtaining all executable files in the file installation information of the target application includes:

[0062] According to the file installation information of the target application, obtain the installation directory at the installation location in the file installation information;

[0063] Get multiple folders in the non-installation directory in the operating system registry;

[0064] Include executable files in multiple folders other than the installation directory as all executable files in the target application's file installation information.

[0065] In one embodiment, the method further comprises:

[0066] The initial application identifier of the target application is stored in a local application data relationship database; the local application data relationship database is used to store the application identifiers of all applications in the operating system.

[0067] In a second aspect, an embodiment of the present application further provides an application identification device, the device comprising:

[0068] An acquisition module, for acquiring process information of any process in a target application program when the process is in a running state;

[0069] A construction module, for constructing an application identifier of a target application based on process information of the process;

[0070] The update module is used to update the initial application identification of the target application according to the application identification; the initial application identification is constructed when the target application is installed in the operating system but is not running.

[0071] In a third aspect, embodiments of the present application further provide a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method in any one of the embodiments of the first aspect.

[0072] In a fourth aspect, embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in any one of the embodiments of the first aspect.

[0073] In a fifth aspect, embodiments of the present application further provide a computer program product, comprising a computer program that, when executed by a processor, implements the steps of the method in any one of the embodiments of the first aspect.

[0074] The above-mentioned application identification method, apparatus, device, storage medium and program product obtain the process information of a process when any process in the target application is in a running state, and construct the application identification of the target application based on the process information, and finally update the initial application identification of the target application based on the application identification. The initial application identification is constructed when the target application is installed in the operating system but not running. In this method, the initial application identification is constructed when the target application is installed and not running, and then the application identification is constructed based on the process information when any process of the target application is running, so as to update the initial application identification. This is equivalent to first statically collecting the application identification and then dynamically collecting the application identification for applications in different states, which improves the correlation between the application identification and the application state to a certain extent, and thus improves the accuracy of the application identification. This determination method can ensure the uniqueness and accuracy of the application identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 is a diagram of the internal structure of a computer device in one embodiment;

[0076] Figure 2 Schematic diagram of a flow chart of an application identification method in one embodiment;

[0077] Figure 3 A flowchart of the application identification construction step in one embodiment;

[0078] Figure 4 A flowchart of a file acquisition step in one embodiment;

[0079] Figure 5 A flowchart of an application identification construction step in another embodiment;

[0080] Figure 6 A flowchart of an application identification construction step in another embodiment;

[0081] Figure 7 A schematic diagram of an application identifier for a multi-process application in one embodiment;

[0082] Figure 8 A flowchart of an application identification construction step in another embodiment;

[0083] Figure 9 A flowchart of an application identification construction step in another embodiment;

[0084] Figure 10 A flowchart of an application identification construction step in another embodiment;

[0085] Figure 11 is a flowchart of an application identification method according to another embodiment;

[0086] Figure 12 A flowchart of an application identification construction step in another embodiment;

[0087] Figure 13 A flowchart of a name acquisition step in one embodiment;

[0088] Figure 14 A flowchart of a name acquisition step in another embodiment;

[0089] Figure 15 A flowchart of a name acquisition step in another embodiment;

[0090] Figure 16 A flowchart of an application identification construction step in another embodiment;

[0091] Figure 17 A flowchart of an application identification construction step in another embodiment;

[0092] Figure 18 A flowchart of a file acquisition step in another embodiment;

[0093] Figure 19 A flowchart of a file acquisition step in another embodiment;

[0094] Figure 20 A flowchart of a file acquisition step in another embodiment;

[0095] Figure 21 A flowchart of a file acquisition step in another embodiment;

[0096] Figure 22 A flowchart of an application identification construction step in another embodiment;

[0097] Figure 23 A flowchart of an application identification construction step in another embodiment;

[0098] Figure 24 FIG. 1 is a structural block diagram of an application identification device in an embodiment. DETAILED DESCRIPTION

[0099] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0100] The application identification method provided in the embodiment of the present application can be applied to a computer device, which can be a terminal. Its internal structure diagram can be as follows: Figure 1 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an application identification method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0101] Those skilled in the art will understand that Figure 1The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0102] With the rapid development of information technology, applications in operating systems are becoming increasingly diverse, making the security of operating systems increasingly important. By identifying application identifiers, we can monitor applications and, in turn, maintain operating system security. Therefore, establishing comprehensive and accurate application identifiers is crucial to operating system security.

[0103] Based on this, an embodiment of the present application provides an application identification method, which updates the initial application identification of the target application according to the process information of any process in the target application in the running state to construct an accurate application identification.

[0104] The following describes the application identification method provided in the embodiment of the present application.

[0105] In one embodiment, Figure 2 As shown, a method for identifying an application is provided, the method comprising:

[0106] S201 , when any process in the target application is in a running state, obtain process information of the process.

[0107] The target application refers to a single-process application or a multi-process application stored in an operating system. The operating system may be a Windows system, a Linux system, etc. This embodiment does not limit the type of operating system.

[0108] When any process in the target application is running, obtain process information. Process information is a series of information created after a process starts, such as the process path, process handle, and process parent-child relationships.

[0109] Optionally, when any process is in a running state, the process information is reported to a process information repository of the operating system. In this case, the process information of the process can be obtained from the process information repository.

[0110] S202: Construct an application identifier of the target application program according to the process information of the process.

[0111] Application identification refers to a set of information that can reflect the characteristics of the target application, including a series of identification data such as the application name, version, publisher, hash value, etc.

[0112] In the embodiment of the present application, the application identifier of the target application is constructed based on the process information of the process. The specific construction process can be to determine the target application to which the process belongs based on the process information of the process, and then obtain the application identifier of the target application.

[0113] Optionally, the process information of the process is encoded using a hash algorithm to obtain an application identifier of the target application.

[0114] Optionally, the process information of the process is input into the identification generation model, and the process information is semantically analyzed by the identification generation model to obtain the process identification of the process. Then, the process identification and the process identification of other processes in the target application except this process are aggregated to obtain the application identification of the target application.

[0115] S203: Update the initial application identifier of the target application according to the application identifier; the initial application identifier is constructed when the target application is installed in the operating system but is not running.

[0116] Among them, the initial application identifier refers to the identifier generated when the application is first installed in the operating system. The initial application identifier in the embodiment of the present application can be stored in the local application data relationship library where the operating system is located.

[0117] Optionally, a corresponding update method is determined based on the type of the target application.

[0118] If the target application is a single-process application, the initial application identifier of the target application may be replaced with the application identifier of the target application to obtain the application identifier of the target application.

[0119] If the target application is a multi-process application, the target application's application identifier can be merged with the initial application identifier based on the application identifier data to obtain the target application's application identifier. For example, an application identifier with the same application name, publisher, and product version can be merged with the initial application identifier to obtain a unique target application's application identifier.

[0120] In an embodiment of the present application, when any process in the target application is in a running state, the process information of the process is obtained, and based on the process information of the process, the application identifier of the target application is constructed, and finally the initial application identifier of the target application is updated based on the application identifier. The initial application identifier is constructed when the target application is installed in the operating system but is not running. In this method, when the target application is installed and not running, the initial application identifier is constructed, and then when any process of the target application is running, the application identifier is constructed based on the process information to update the initial application identifier. This is equivalent to first statically collecting the application identifier and then dynamically collecting the application identifier for applications in different states, which improves the correlation between the application identifier and the application state to a certain extent, and thus improves the accuracy of the application identifier. This determination method can ensure the uniqueness and accuracy of the application identifier.

[0121] On the basis of obtaining process information, there are multiple ways to construct application identification according to different actual needs. Based on this, an embodiment is used below to illustrate a feasible way to construct application identification.

[0122] In one embodiment, Figure 3 As shown, based on the process information of the process, the application identifier of the target application is constructed, including:

[0123] S301: Obtain all executable files of a target application and names of the executable files of the process according to process information of the process.

[0124] According to the process information of the process, determine the target application to which the process belongs, and obtain all executable files of the target application and the process executable file name.

[0125] Optionally, the process information includes all executable files of the target application to which the process belongs and the process executable file name. In this case, all executable files of the target application and the process executable file name can be obtained by scanning the process information.

[0126] It should be noted that for a single-process target application, the name of the executable file corresponding to the single process is the process executable file name; for a multi-process target application, including multiple executable files of multiple processes, then among the multiple executable files, the main process executable file name and other process executable file names in the target application can be further confirmed.

[0127] S302: Construct an application identifier of the target application according to the names of all executable files and process executable files of the target application.

[0128] According to the process executable file name of the target application, the header information of the public version of the application identifier is determined, and by processing all executable files of the target application, the intermediate information of the application identifier is determined. According to the header information and intermediate information of the application identifier, the complete application identifier of the target application is constructed.

[0129] In an embodiment of the present application, the application identifier of the target application is constructed based on obtaining the names of all executable files and process executable files. Different executable files or process executable file names reflect the information of the target application to different degrees, which is equivalent to comprehensively considering the information of multiple dimensions of the target application. The application identifier determined in this way is also comprehensive and accurate.

[0130] As can be seen from the above embodiments, the application identifier is determined based on all executable files and process executable files of the target application. Based on this, the steps for obtaining the names of the executable files and process executable files are described below.

[0131] The following describes the steps of obtaining all executable files of a target application program through an embodiment.

[0132] In one embodiment, Figure 4 As shown, the process information includes the process path and the parent-child relationship of the process; based on the process information of the process, all executable files of the target application are obtained, including:

[0133] S401, obtaining the executable file of the process according to the process path in the process information; and obtaining the executable files of other processes in the target application except the process according to the process parent-child relationship in the process information.

[0134] The installation location of the process executable file is determined according to the process path in the process information, and then the process executable file is obtained.

[0135] According to the process parent-child relationship in the process information, the installation location of the executable files of other processes related to the process in the target application where the process is located is obtained, and then the executable files of other processes are obtained.

[0136] S402: Aggregate the executable files of the process and the executable files of other processes to obtain all executable files of the target application.

[0137] The target application includes processes in a running state and other processes that are not in a running state. The executable files of the processes and the executable files of other processes are aggregated as all executable files of the target application.

[0138] In an embodiment of the present application, the process path and the process parent-child relationship can be directly obtained from the process information. Based on this, the speed of determining all executable files of the target application according to the process path and the process parent-child relationship is faster.

[0139] The following describes the steps for obtaining the name of the target application's process executable file through an embodiment.

[0140] In one embodiment, the process information includes a process handle; obtaining the process executable file name of the target application according to the process information includes:

[0141] Determine the target application's process executable file name based on the process handle in the process information.

[0142] For a single-process application, the process pointed to by the process handle is determined according to the process handle, and the installation location of the executable file of the determined process is used as the process executable file name of the target application.

[0143] For a multi-process application, the process pointed to by the process handle is determined based on the process handle, and the installation location of the executable file of the determined process is used as the main process executable file name of the target application, that is, the process executable file name of the target application.

[0144] In an embodiment of the present application, the process handle can be obtained directly from the process information. Based on this, the process executable file name of the target application can be quickly and accurately determined according to the process handle, thereby improving the speed of constructing the application identifier based on the process executable file.

[0145] When all executable files and process executable file names of the target application are obtained, the application identifier can be further constructed based on the obtained names. The following describes the steps of constructing the application identifier through an embodiment.

[0146] In one embodiment, Figure 5 As shown, the target application's application identifier is constructed based on the names of all executable files and process executable files of the target application, including:

[0147] S501: parse all executable files of a target application to obtain dynamic feature information of the target application.

[0148] The dynamic feature information of the target application includes the publisher, digital signature, product name, product version, and icon hash value of all process executable files in the target application.

[0149] All executable files of the target application are parsed respectively, dynamic feature information of each process executable file is extracted, and the information is summarized as the application dynamic feature information of the target application.

[0150] S502 : Constructing an application identifier of each target application according to the application dynamic feature information of the target application and the process executable file name of the target application.

[0151] Based on the number of processes in an application, applications are divided into two categories: single-process applications and multi-process applications. Naturally, a single-process application refers to an application that includes one process, and a multi-process application refers to an application that includes at least two processes.

[0152] It should be noted that although the basis for constructing the application identifier in the embodiments of the present application is the same, which is the application static feature information corresponding to the application and the process executable file name of the application, the corresponding construction method is different due to the different types of applications.

[0153] In one embodiment, Figure 6 As shown, based on the application dynamic feature information of the target application and the process executable file name of the target application, the application identifier of each target application is constructed, including:

[0154] S601: When the target application includes one process, the process executable file name of the target application and the application dynamic feature information are combined to obtain an application identifier of the target application.

[0155] When the target application includes one process, the process executable file name of the target application, the publisher, product name, product version, digital signature, and icon hash value in the application dynamic feature information are sorted and combined to obtain the application identifier of the target application.

[0156] S602, when the target application includes multiple processes, the process executable file name of the target application is determined as the main process executable file name of the application, and the application identifier of the target application is obtained based on the main process executable file name of the application and the application dynamic feature information.

[0157] When the target application includes multiple processes, the main process executable file name of the target application, the dynamic feature information of the main process in the application dynamic feature information, and the dynamic feature information of other processes except the main process in the application dynamic feature information are combined to obtain the application identifier of the target application.

[0158] See Figure 7 , Figure 7 FIG. 1 is a schematic diagram of an application identifier of a multi-process target application program in one embodiment. Figure 7 It can be seen that the application identification of the target application includes, from top to bottom, the main process executable file name, the publisher of the main process executable file, the product name of the main process executable file, the product version of the main process executable file, the digital signature of the main process executable file, the icon hash value of the main process executable file, the hash values ​​of the executable files of multiple other processes, the hash algorithm, and the file name.

[0159] Optionally, if there is no digital signature for the static feature information of other processes in the target application, the hash values ​​of other processes are obtained through a hash algorithm (such as the SM3 cryptographic hash algorithm), and the application identifier of the target application is obtained based on the main process executable file name, the static feature information of the main process, and the hash values ​​of other processes.

[0160] In an embodiment of the present application, a corresponding application identification construction process is provided for different types of target applications, so that the application identification of the target application is complete, comprehensive and unique. By identifying the application identification of the target application, the characteristics of the target application can be quickly captured, thereby improving the speed and accuracy of application identification.

[0161] During actual operation, an operating system often has multiple stages, such as application installation completion, running, closing, or uninstalling. There may be time intervals between different stages. For example, there may be a gap between the time an application is installed and the time a process in the application is running. Based on this, in an embodiment of the present application, upon completion of application installation, an initial application identifier is initially constructed for the installed application. When any process in the application is started, the application identifier is reconstructed to update the application's identification information. Based on this, the following describes the steps for updating the application identifier of a target application through an embodiment.

[0162] In one embodiment, Figure 8 As shown, the initial application ID of the target application is updated according to the application ID, including:

[0163] S801: Obtain an initial application identifier of a target application from a local application data relationship library of an operating system.

[0164] The local application data relationship library of the operating system stores the identifiers of all applications in the operating system. These identifiers can be constructed when the application is installed, or they can be identifiers carried by the application in the installation information, consisting of registered application providers and dedicated application identifier extensions.

[0165] The product name, publisher, and product version of the target application are obtained according to the application identifier of the target application, and the initial application identifier of the application having the same product name, publisher, and product version as the target application is obtained from the local application data relationship library.

[0166] S802: Merge the application identifier of the target application with the initial application identifier to update the initial application identifier of the target application.

[0167] Take the case where the application is a multi-process application, Figure 9 The figure is a flowchart of the application identification updating step in one embodiment.

[0168] S901: Obtain an application identifier of a target application.

[0169] Merge processes with parent-child relationships in running applications.

[0170] S902: Obtain the initial application identifier of the target application in the local application relation database.

[0171] S903: Compare and merge the application identifier of the target application with the initial application identifier in the local application relationship database to determine the application identifier of the target application.

[0172] Figure 10 FIG. 1 is a flow chart of an application identification updating step in another embodiment.

[0173] S1001: Obtain application dynamic feature information.

[0174] S1002: Merge the parent-child relationship of the processes in the dynamic feature information of the application.

[0175] S1003: Obtain an initial identifier in the local application relation database.

[0176] S1004: Merge the merged application dynamic feature information and the initial identifier to obtain an application identifier.

[0177] In an embodiment of the present application, the application identifier of the target application is merged with the initial application identifier, the initial application identifier of the target application is updated, the program identifier of the target application is further corrected and supplemented, the correlation between the application identifier and the application status is improved, and the accuracy of the application identifier is thereby improved.

[0178] In the preceding embodiments, the steps for updating the initial application identifier based on the target application's application identifier are described. Naturally, for the same target application, the initial application identifier construction process occurs first, followed by the application identifier construction and update process. Based on this, the target application identifier construction process is described below using an embodiment.

[0179] In one embodiment, Figure 11 As shown, the method further includes:

[0180] S1101 , monitoring the process running status of each application in the operating system by running a process monitoring program in the operating system.

[0181] A process monitoring program is deployed in the operating system, and the process monitoring program automatically starts when the computer device where the operating system is located is turned on to monitor the process status in the operating system in real time.

[0182] S1102: If any process in the target application is in a running state, the step of obtaining process information of the process is executed.

[0183] When it is detected that any process of the application is in a running state, the process information of the running process is obtained by dynamic collection, and the initial application identification of the target application is constructed based on it.

[0184] S1103: If the target application is installed and all processes in the target application are not running, construct an initial application identifier of the target application.

[0185] When it is detected that the application is installed and all processes in the target application are not running, a static collection method is used to construct an initial application identifier of the target application.

[0186] In an embodiment of the present application, a process monitoring program is used to automatically monitor the process change status in the operating system in real time to obtain application identification of the application in different states, characterize the characteristic information of the application in different states, and thereby improve the scenario applicability of the application identification method.

[0187] Next, a feasible method of constructing the initial application identification by static collection is described.

[0188] In one embodiment, Figure 12 As shown, build the initial application identity of the target application, including:

[0189] S1201: Obtain file installation information of a target application and the name of an initial process executable file of the target application.

[0190] The file installation information of the target application includes the installation location of the application and other identification data of the application, such as the publisher of the target application, the product version, the name of the application, etc.

[0191] Optionally, obtain file installation information of the target application from the registry of the operating system.

[0192] The process executable file name of the target application refers to the identifier of all process executable files in the target application. Naturally, the number of process executable file names of the target application is the same as the process data of the application. In the embodiment of the present application, the specific installation location of each process executable file can be determined as the process executable file name corresponding to each process.

[0193] S1202: Construct an initial application identifier of the target application according to the file installation information of the target application and the name of the initial process executable file of the target application.

[0194] Optionally, the file installation information of the application and the corresponding process executable file name are aggregated to generate an application identifier corresponding to the application.

[0195] Optionally, the process executable file name of the application is processed by filtering, compressing, sorting, etc. through the file installation information of the application, and the processed result is used as the application identifier of the application.

[0196] The embodiment of the present application is performed after the target application is installed and any processes within the target application are not running. That is, before the target application is running, an identifier is constructed for the application, which improves the scenario applicability of the application identification method to a certain extent. In addition, in the process of constructing the application identifier, the application installation information and the process executable file name are used as the basis. By obtaining the application installation information, the integrity of the application identifier content is guaranteed, and by obtaining the process executable file name, different processes in the application are distinguished, which enhances the layering of the application identifier and makes the target application identifier clearer and more concise.

[0197] Next, a possible implementation method of “obtaining the name of the process executable file of the target application” in the aforementioned embodiment S1201 is described.

[0198] In one embodiment, Figure 13 As shown, get the target application's initial process executable file name, including:

[0199] S1301: When the target application includes one process, obtain the name of the initial process executable file of the target application from the registry of the operating system.

[0200] If the target application includes a process, the installation location of the target application is obtained from the operating system registry, and the installation location of the target application's executable file is determined based on the installation location of the target application, and is used as the initial process executable file name of the target application.

[0201] S1302: When the target application includes multiple processes, obtain the name of the initial main process executable file of the target application by executing a main process executable file path scanning strategy.

[0202] When the target application includes multiple processes, in order to ensure the uniqueness of the target application identifier, it is necessary to determine the initial main process executable file name of the target application and use the initial main process executable file name as the header information of the initial public version of the application identifier.

[0203] Considering that when a target application includes multiple processes, the name of its main process executable file may exist in multiple locations in the operating system, such as the registry, startup items, or shortcuts, there are corresponding multiple acquisition methods. Based on this, the embodiments of the present application implement a main process executable file path scanning strategy to set priorities for multiple acquisition methods to obtain the main process executable file name of the target application.

[0204] Optionally, if the main process executable file path scanning strategy is to perform all acquisition methods simultaneously, the computer device simultaneously scans from the registry, startup items or shortcuts in the operating system until the initial main process executable file name of the target application is obtained.

[0205] In the embodiments of this application, considering that the target application may include a single process or multiple processes, different methods are set for obtaining the process executable file name: for single-process target applications, the process executable file name is directly determined from the registry; for multi-process target applications, a main process executable file path scanning strategy is implemented to obtain the target application's initial main process executable file name. Obviously, regardless of the acquisition method, the embodiments of this application select a specific process executable file name of the target application to maintain the uniqueness of the target application's application identifier.

[0206] As can be seen from the above embodiment, when the target application includes multiple processes, the method for obtaining the main process executable file name is based on the main process executable file path scanning strategy. Based on this, the following describes an embodiment of a possible method for obtaining the initial main process executable file name.

[0207] In one embodiment, Figure 14 As shown, by executing the main process executable file path scanning strategy, the initial main process executable file name of the target application is obtained, including:

[0208] S1401: In accordance with a preset order, query the registry, the operating system startup items, and the operating system shortcuts to see whether the initial main process executable file name of the target application exists.

[0209] In an embodiment of the present application, the operation of querying from the registry is used as the first query method, the operation of querying from the startup item of the operating system is used as the second query method, and the operation of querying from the shortcut of the operating system is used as the third query method. The queries are performed from the registry, the startup item of the operating system, and the shortcut of the operating system in sequence to obtain the initial main process executable file name of the target application.

[0210] The specific query method can be: obtain the folder pointed to by the installation location of the initial main process executable file of the target application from the registry, the startup items of the operating system and the shortcuts of the operating system, and query whether there is an executable file in the folder. If there is a main process executable file in the folder, the installation location of the main process executable file is determined as the initial main process executable file name of the target application; if the folder is empty, the installation location of the main process executable file cannot be obtained, and the initial main process executable file name of the target application cannot be obtained.

[0211] S1402: If it exists, obtain the name of the initial main process executable file of the target application.

[0212] If the target application's initial main process executable file name exists, it means that the installation location of the target application's main process executable file has been queried. In this case, the installation location of the main process executable file is determined as the target application's initial main process executable file name.

[0213] S1403: If it does not exist, obtain the name of the initial main process executable file of the target application according to the file installation information.

[0214] If the initial main process executable file name of the target application does not exist in the registry, the operating system startup items, and the operating system shortcuts, the installation location of the main process executable file of the target application is obtained based on the file installation information, and the main process executable file installation location is determined as the initial main process executable file name of the target application.

[0215] In an embodiment of the present application, multiple methods of obtaining the name of the initial main process executable file based on the registry, startup items, shortcuts, or file installation information are provided, enriching the diversity of acquisition methods. In addition, in an embodiment of the present application, corresponding priorities are set for the above-mentioned multiple acquisition methods to avoid waste of resources caused by simultaneous acquisition.

[0216] Next, the implementable manner of “obtaining the name of the initial main process executable file of the target application according to the file installation information” in the aforementioned embodiment S1403 is described.

[0217] In one embodiment, Figure 15 As shown, according to the file installation information, the name of the initial main process executable file of the target application is obtained, including:

[0218] S1501: Obtain the installation location of the target application according to the file installation information.

[0219] The file installation information includes the installation location of the target application.

[0220] S1502: According to the installation location of the target application, obtain multiple executable files in the installation location.

[0221] According to the installation location of the target application, the installation path of the target application is determined, and multiple executable files in the installation location are obtained according to the installation path of the target application. In the embodiment of the present application, the multiple executable files in the installation location are used as candidate executable files of the main process executable file.

[0222] S1503: Determine the name of the executable file with the largest storage capacity as the initial main process executable file name of the target application.

[0223] By calculating the storage capacity of multiple executable files under the installation location of the target application, the installation location of the executable file with the largest storage capacity is determined, and the installation location of the executable file with the largest storage capacity is determined as the name of the executable file, that is, the initial main process executable file name of the target application.

[0224] In an embodiment of the present application, based on the file installation information, multiple executable files are obtained under the installation location of the target application, and the executable file with the largest storage capacity is determined as the main process executable file, and then the initial main process executable file name is obtained. This acquisition method is reliable and easy to implement, and can quickly distinguish the main process executable file and non-main process executable files in the target application.

[0225] In the process of constructing the application identification, the information of all processes in the target application can be comprehensively considered to improve the comprehensiveness and effectiveness of the application identification. Based on this, the steps of constructing the application identification of the target application are described below through an embodiment.

[0226] In one embodiment, Figure 16 As shown, the initial application identifier of the target application is constructed according to the file installation information of the target application and the name of the initial process executable file of the target application, including:

[0227] S1601: Obtain all executable files in the file installation information of the target application.

[0228] For any target application, obtain files in the file installation information of the target application, and obtain all executable files with a file suffix of ".exe" based on the file type.

[0229] S1602: parse all executable files in the file installation information of the target application to obtain application static feature information of the target application.

[0230] The static feature information of the target application includes the publisher, digital signature, product name, product version, and icon hash value of all process executable files in the target application.

[0231] All executable files in the file installation information of the target application are parsed respectively, and static feature information of each process executable file is extracted as application static feature information of the target application.

[0232] S1603: Construct an initial application identifier of the target application according to the application static feature information of the target application and the name of the initial process executable file of the target application.

[0233] According to the number of processes in the target application, the target application is divided into two categories: single-process target application and multi-process target application. Naturally, a single-process target application refers to a target application including one process, and a multi-process target application refers to a target application including at least two processes.

[0234] It should be noted that although the basis for constructing the application identifier in the embodiments of the present application is the same, namely, the application static feature information corresponding to the target application and the process executable file name of the target application, the corresponding construction method is different due to the different types of target applications.

[0235] In this case, the embodiment of the present application first determines the application identification construction process of the target application based on the type of the target application, and then combines the application static feature information corresponding to the target application, the process executable file name of the target application and the construction process to obtain the application identification of each target application.

[0236] In an embodiment of the present application, the application static feature information of the target application is obtained based on all executable files in the file installation information of the target application. On this basis, combined with the process executable file name of the target application, a complete and unique application identifier is constructed for the target application.

[0237] The following describes the process of constructing application identifiers for different types of target application programs through an embodiment.

[0238] In one embodiment, Figure 17 As shown, the initial application identifier of the target application is constructed based on the application static feature information of the target application and the initial process executable file name of the target application, including:

[0239] S1701: When the target application includes one process, the initial process executable file name of the target application and the application static feature information are combined to obtain an application identifier of the target application.

[0240] When the target application includes a process, the process executable file name of the target application, the publisher, product name, product version, digital signature, and icon hash value in the application static feature information are arranged and combined to obtain the application identifier of the target application.

[0241] It should be noted that the feature types included in the application static information and the application dynamic information are the same. The difference between the two is that the feature information of the target application will be different due to whether there is a running process in the target application. Therefore, the embodiment of the present application will collect the feature information of the target application once during static or dynamic collection.

[0242] S1702, when the target application includes multiple processes, obtain the main process executable file name of the target application based on the process executable file name of the target application, and combine the main process executable file name of the target application and the application static feature information to obtain the initial application identifier of the target application.

[0243] The application static feature information includes the static feature information of the main process in the target application and the static feature information of other processes in the target application.

[0244] When the target application includes multiple processes, the main process executable file name of the target application, the static feature information of the main process in the application static feature information, and the static feature information of other processes except the main process in the application static feature information are combined to obtain the application identifier of the target application.

[0245] The embodiment of the present application provides a targeted process for constructing corresponding application identifiers for different types of target applications, so that the application identifier of each target application is complete, comprehensive and unique. Therefore, by identifying the application identifier of the target application, the characteristics of the target application can be quickly captured, thereby improving the speed and accuracy of application identification.

[0246] The basis for obtaining an application identifier includes two types of information: the target application's process executable file and the application's static feature information. As can be seen from the previous embodiment, the static feature information is obtained by parsing all executable files in the target application's file installation information. Based on this, the following describes various possible implementations for obtaining all executable files of the target application.

[0247] In one embodiment, Figure 18 As shown, all executable files in the target application's file installation information are obtained, including:

[0248] S1801: Obtain application identification data in the file installation information according to the file installation information of the target application.

[0249] The file installation information of the target application includes identification data of the application, such as the publisher of the application, the product name of the application, and version information of the application.

[0250] S1802: According to the application identification data, the executable files identical to the application identification data are obtained from a preset data collection library as all executable files in the file installation information of the target application.

[0251] The preset data collection library refers to a collection of multiple executable files collected according to a preset empirical path. For example, the empirical path can be the Roaming, Local, Common Files, and other empirical paths on the C drive of the device where the operating system is located, and the data collection library is the collection of executable files in the above empirical paths.

[0252] Among the multiple executable files in the data collection library, the executable files that meet the application identification data conditions are used as all the executable files in the file installation information of the target application.

[0253] Optionally, if the application identification data is a publisher, all executable files in the data collection library that are consistent with the publisher are used as all executable files in the file installation information of the target application.

[0254] Optionally, if the application identification data is publisher, product name, and version information, all executable files in the data collection library that are consistent with the publisher, product name, and version information are used as all executable files in the file installation information of the target application.

[0255] In an embodiment of the present application, the executable file of the target application is obtained from a preset data collection library based on the application identification data. This is equivalent to taking into account the irregular release of installation files by multi-process applications, which results in the installation files existing in multiple locations. By supplementing the executable file of the target application through the preset data collection library, the integrity of the executable file of the target application can be improved to a certain extent.

[0256] In one embodiment, Figure 19 As shown, all executable files in the target application's file installation information are obtained, including:

[0257] S1901: Obtain the installation location in the file installation information according to the file installation information of the target application.

[0258] According to the file installation information of the target application, the installation location of the application in the file installation information is obtained.

[0259] S1902, obtaining multiple folders under the installation directory at the installation location.

[0260] According to the installation location of the application, multiple folders in the installation directory of the installation location are obtained. Naturally, information such as the name, version number, and storage capacity of each folder are obtained. Optionally, the folder name includes the product name and version number of the target application.

[0261] S1903: According to the version numbers of the folders, the executable file in the folder with the highest version number is obtained as all the executable files in the file installation information of the target application.

[0262] When there are multiple folders in the installation directory at the installation location, the version numbers of each folder are compared to determine the folder with the highest version number and other folders with lower versions. The executable file in the folder with the highest version number is used as all executable files in the file installation information of the target application; the executable files in other folders with lower versions are discarded.

[0263] It should be noted that, if there is a folder under the installation directory at the installation location, the executable files in the folder will be used as all executable files in the file installation information of the target application.

[0264] See Figure 20 , Figure 20 This is a flowchart of obtaining the executable file in the installation directory according to the installation location of the target application. Figure 20 It can be seen that the process of obtaining an executable file includes the following steps:

[0265] S2001, obtaining the installation location of the target application.

[0266] S2002: Determine whether the number of folders in the installation directory at the installation location is a multi-directory upgrade, that is, whether the number of folders in the installation directory is multiple.

[0267] If it is not a multi-directory upgrade, obtain the executable file in the installation directory.

[0268] S2003: When there are multiple folders in the installation directory, obtain all executable files in the folder with the highest version number.

[0269] S2004, obtaining the executable file in the installation directory at the installation location.

[0270] In an embodiment of the present application, based on the installation location of the target application, the executable file in the highest version folder is used as all the executable files of the target application from multiple folders under the installation directory at the installation location. This acquisition method conforms to the actual installation process of the target application, making the executable file of the target application more complete.

[0271] In one embodiment, Figure 21 As shown, all executable files in the target application's file installation information are obtained, including:

[0272] S2101, according to the file installation information of the target application, obtain the installation directory at the installation location in the file installation information.

[0273] According to the file installation information of the target application, the installation location of the application in the file installation information and the installation directory at the installation location are obtained.

[0274] S2102, obtaining multiple folders in a non-installation directory in the registry of the operating system.

[0275] S2103: Executable files in multiple folders other than the installation directory are used as all executable files in the file installation information of the target application.

[0276] Multiple folders under the non-installation directory are obtained through the index data of the registry key item, that is, other paths for storing installation release files, thereby obtaining the executable files in the folders under the non-installation directory.

[0277] In an embodiment of the present application, based on index data, the path for storing the installation release file is obtained from the registry of the operating system, and then the executable file of the target application is obtained. This is equivalent to taking into account the irregular release of installation files by multi-process applications, which results in the installation files existing in multiple locations, so as to improve the integrity of the executable file of the target application.

[0278] It should be noted that the above Figures 18 to 21 The following are multiple ways to obtain executable files. In actual applications, the above multiple ways can be executed separately or in combination. In the embodiment of the present application, all executable files of the target application are comprehensively obtained from multiple dimensions by executing the above multiple ways simultaneously.

[0279] In one embodiment, the method further comprises:

[0280] The initial application identifier of the target application is stored in a local application data relationship database; the local application data relationship database is used to store the application identifiers of all target applications in the operating system.

[0281] Each time an application identifier of a target application that has been installed is obtained, the application identifier is stored in the application data relationship library of the operating system to meet the needs of identifying the application identifier in different scenarios.

[0282] For example, the target application is identified by calling the application data relationship library, and the designated target application is blocked; the target application is identified by calling the application data relationship library, and the target application installed and running on the Windows host is supervised; the target application is identified by calling the application data relationship library, and tampered and disguised applications downloaded from unofficial channels are identified.

[0283] In an embodiment of the present application, the application identification of all target applications in the operating system is stored through the application data relationship database. Since the target application identification is constructed before the target application is run, it means that the application relationship database stores the latest target application identification, which can improve the response speed of real-time monitoring of each installed target application in the operating system, thereby improving the target application identification efficiency and maintaining the security of the operating environment of the operating system.

[0284] In one embodiment, taking the target application as a multi-process as an example, the steps of constructing the initial application identification of the target application through static collection are described as follows: Figure 22 As shown, the method includes the following steps:

[0285] S2201. Obtain file installation information of a target application from the registry of the operating system.

[0286] The installation information includes the installation location of the target application and application identification data of the target application, such as the product name, publisher, product version, etc. of the target application.

[0287] S2202: Query the operating system registry to see whether the name of the initial main process executable file of the target application exists.

[0288] If it exists, execute S2206; if it does not exist, execute S2203.

[0289] S2203: If the name of the initial main process executable file of the target application does not exist in the registry of the operating system, query whether the name of the initial main process executable file of the target application exists in the startup item of the operating system.

[0290] If it exists, go to S2206; if it does not exist, go to S2204.

[0291] S2204: If the name of the initial main process executable file of the target application does not exist in the startup item of the operating system, query whether the name of the initial main process executable file of the target application exists in the shortcut of the operating system.

[0292] If it exists, go to S2206; if it does not exist, go to S2205.

[0293] S2205: If the initial main process executable file name of the target application does not exist in the shortcut of the operating system, the initial main process executable file name of the target application is obtained according to the file installation information and the main process executable file acquisition rule.

[0294] S2206: Obtain the name of the initial main process executable file of the target application.

[0295] S2207, obtaining all executable files in non-installation directories of the target application from the registry.

[0296] S2208, all folders under the installation directory according to the installation location of the target application.

[0297] S2209, obtaining all executable files in the folder with the highest version number.

[0298] S2210 , according to the application identification data of the target application program, obtaining an executable file identical to the application identification data from a preset data collection library.

[0299] S2211 , aggregate the executable files obtained in S2207 to S2210 to obtain all executable files of the target application.

[0300] S2212, construct an initial identification of the target application.

[0301] According to all executable files of the target application and the executable file name of the main process of the target application, static feature information of each process in the target application is constructed, and then the initial application identification of the target application is obtained.

[0302] S2213: Store the initial identifier of the target application program in the local application data relationship library of the operating system.

[0303] In an embodiment of the present application, by collecting the file installation information of the target application before the target application is run, the static feature information of the file of the target application is obtained, and the identification of multi-process target applications is achieved, which to a certain extent improves the scenario applicability of the application identification method.

[0304] In one embodiment, taking the target application as a multi-process as an example, the steps of constructing the application identification of the target application by dynamic collection are described as follows: Figure 23 As shown, the method includes the following steps:

[0305] S2301, obtaining process information: Dynamically collect process information from the computer device where the operating system is located.

[0306] S2302: Obtain a process path from the process information.

[0307] S2303, obtain the process handle from the process information.

[0308] S2304, obtaining the parent-child relationship of the process from the process information.

[0309] S2305: Obtain the main process executable file name according to the process handle.

[0310] S2306: Obtain all executable files of the target application according to the process path, process handle, and process parent-child relationship.

[0311] S2307: Obtain an application identifier of the target application based on all executable files and the main process executable file name of the target application.

[0312] The application identification includes process identification data of multiple processes.

[0313] S2308: Merge multiple process identification data in the target application.

[0314] S2309: Store the application identifier of the target application program in a local application relational database.

[0315] In the embodiments of the present application, by reading process information and using it to obtain dynamic application feature information, multi-process applications can be uniquely identified and displayed together, making it easier to manage applications. In addition, the embodiments of the present application perform data collection at the application layer, which reduces application performance loss to a certain extent.

[0316] In one embodiment, a method for identifying an application is provided, the method comprising the following steps:

[0317] (1) By running the process monitoring program in the operating system, the process running status of each application in the operating system is monitored.

[0318] (2) If the target application is installed and all processes in the target application are not running, then obtain at least one target application that is currently installed in the operating system.

[0319] (3) Obtain the file installation information of the target application from the registry of the operating system.

[0320] (4) For any target application, if the target application includes a process, the name of the initial process executable file of the target application is obtained from the registry of the operating system.

[0321] (5) Obtain all executable files in the file installation information of the target application.

[0322] (6) All executable files in the file installation information of the target application are parsed to obtain the application static feature information of the target application.

[0323] (7) The initial process executable file name of the target application and the application static feature information are combined to obtain the initial identification of the target application.

[0324] (8) For any target application, if the target application includes multiple processes, in accordance with a preset order, query whether the initial main process executable file name of the target application exists from the registry, the startup items of the target operating system, and the shortcuts of the target operating system.

[0325] (9) If it exists, obtain the name of the initial main process executable file of the target application;

[0326] (10) If it does not exist, the installation location of the target application is obtained according to the file installation information, and then multiple executable files under the installation location are obtained according to the installation location of the target application. Finally, the name of the executable file with the largest storage capacity is determined as the initial main process executable file name of the target application.

[0327] (11) Obtain all executable files in the file installation information of the target application.

[0328] In the embodiment of this application, it is mainly obtained through the following three channels:

[0329] ①According to the file installation information of the target application, the application identification data in the file installation information is obtained, and then according to the application identification data, an executable file identical to the application identification data is obtained from a preset data collection library.

[0330] ②According to the file installation information of the target application, the installation location in the file installation information is obtained, and then multiple folders under the installation directory at the installation location are obtained, and according to the version number of each folder, the executable file under the folder with the highest version number is obtained.

[0331] ③According to the file installation information of the target application, obtain the installation directory at the installation location in the file installation information, then obtain multiple folders under the non-installation directory in the registry of the operating system, and finally obtain the executable files in the multiple folders under the non-installation directory.

[0332] (12) Store the target application's identifier in the local application data relational database.

[0333] (13) If any process in the target application is in a running state, the process information of the process is obtained.

[0334] (14) Obtain the executable file of the process according to the process path in the process information.

[0335] (15) According to the parent-child relationship of the processes in the process information, the executable files of other processes in the target application except the process are obtained.

[0336] (16) Aggregate the executable files of the process and the executable files of other processes to obtain all the executable files of the target application.

[0337] (17) Determine the process executable file name of the target application based on the process handle in the process information.

[0338] (18) Parsing all executable files of the target application to obtain the application dynamic feature information of the target application;

[0339] (19) When the target application includes a process, the process executable file name of the target application and the application dynamic feature information are combined to obtain the application identifier of the target application.

[0340] (20) When the target application includes multiple processes, the process executable file name of the target application is determined as the main process executable file name of the application, and the application identifier of the target application is obtained based on the main process executable file name of the application and the application dynamic feature information.

[0341] (21) Obtain the initial application identifier of the target application from the local application data relationship library of the operating system.

[0342] (22) Merge the application identifier of the target application with the initial application identifier to update the initial application identifier of the target application.

[0343] In an embodiment of the present application, when any process in the target application is in a running state, the process information of the process is obtained, and based on the process information of the process, the application identifier of the target application is constructed, and finally the initial application identifier of the target application is updated based on the application identifier. The initial application identifier is constructed when the target application is installed in the operating system but is not running. In this method, when the target application is installed and not running, the initial application identifier is constructed, and then when any process of the target application is running, the application identifier is constructed based on the process information to update the initial application identifier. This is equivalent to first statically collecting the application identifier and then dynamically collecting the application identifier for applications in different states, which improves the correlation between the application identifier and the application state to a certain extent, and thus improves the accuracy of the application identifier. This determination method can ensure the uniqueness and accuracy of the application identifier.

[0344] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0345] Based on the same inventive concept, embodiments of the present application also provide an application identification device for implementing the aforementioned application identification method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in one or more application identification device embodiments provided below can be found in the above-mentioned limitations on the application identification method and will not be further elaborated here.

[0346] In one embodiment, Figure 24 As shown, an application identification device 2400 is provided, comprising: an acquisition module 2401, a construction module 2402 and an update module 2403, wherein:

[0347] The acquisition module 2401 is used to acquire process information of any process in the target application when the process is in a running state;

[0348] A construction module 2402 is used to construct an application identifier of a target application program according to the process information of the process;

[0349] The updating module 2403 is configured to update the initial application identifier of the target application according to the application identifier; the initial application identifier is constructed when the target application is installed in the operating system but is not running.

[0350] In one embodiment, the construction module 2402 includes a first acquisition unit and a first construction unit, wherein:

[0351] a first acquiring unit, configured to acquire all executable files of a target application and names of process executable files according to process information of the process;

[0352] The first construction unit is configured to construct an application identifier of the target application according to names of all executable files and process executable files of the target application.

[0353] In one embodiment, the first acquisition unit includes an information acquisition subunit and a file aggregation subunit, wherein:

[0354] The information acquisition subunit is used to obtain the executable file of the process according to the process path in the process information; and to obtain the executable files of other processes in the target application except the process according to the process parent-child relationship in the process information;

[0355] The file aggregation subunit is used to aggregate the executable files of the process and the executable files of other processes to obtain all the executable files of the target application.

[0356] In one embodiment, the first acquisition unit further includes a name acquisition subunit, which is used to determine the process executable file name of the target application according to the process handle in the process information.

[0357] In one embodiment, the first construction unit includes: a dynamic acquisition subunit and an identification construction subunit, wherein:

[0358] The dynamic acquisition sub-unit is used to parse all executable files of the target application to obtain the dynamic feature information of the target application;

[0359] The identification building subunit is used to build the application identification of each target application according to the application dynamic feature information of the target application and the process executable file name of the target application.

[0360] In one embodiment, the identification construction subunit includes a first combination subunit and a second combination subunit, wherein:

[0361] A first combining subunit is configured to combine the process executable file name of the target application and the application dynamic feature information to obtain an application identifier of the target application when the target application includes one process;

[0362] The second combination sub-unit is used to determine the process executable file name of the target application as the main process executable file name of the application when the target application includes multiple processes, and obtain the application identifier of the target application based on the main process executable file name of the application and the application dynamic feature information.

[0363] In one embodiment, the updating module 2403 includes: a second acquiring unit and an identification updating unit, wherein:

[0364] A second acquiring unit is configured to acquire an initial application identifier of a target application from a local application data relationship library of the operating system;

[0365] The identification updating unit is configured to merge the application identification of the target application with the initial application identification to update the initial application identification of the target application.

[0366] In one embodiment, the application identification device 2400 further includes: a process monitoring module, a first execution module, and a second execution module, wherein:

[0367] The process monitoring module is used to monitor the running status of the processes in each application in the operating system by running the process monitoring program in the operating system;

[0368] A first execution module is configured to execute a step of obtaining process information of a process if any process in the target application is in a running state;

[0369] The second execution module is configured to construct an initial application identifier of the target application if the target application is installed and all processes in the target application are not running.

[0370] In one embodiment, the second execution module includes a third acquisition unit and a second construction unit, wherein:

[0371] a third acquiring unit, configured to acquire file installation information of a target application and a name of an initial process executable file of the target application;

[0372] The second construction unit is configured to construct an initial application identifier of the target application according to the file installation information of the target application and the name of the initial process executable file of the target application.

[0373] In one embodiment, the third acquisition unit includes an installation information subunit configured to acquire file installation information of the target application from a registry of the operating system.

[0374] In one embodiment, the third acquisition unit further includes: a single-process acquisition subunit and a multi-process acquisition subunit, wherein:

[0375] The single process acquisition subunit is used to acquire the name of the initial process executable file of the target application from the registry of the operating system when the target application includes one process;

[0376] The multi-process acquisition sub-unit is used to obtain the initial main process executable file name of the target application by executing the main process executable file path scanning strategy when the target application includes multiple processes.

[0377] In one embodiment, the multi-process acquisition sub-unit is also used to query whether the initial main process executable file name of the target application exists from the registry, the operating system startup items and the operating system shortcuts in a preset order; if it exists, the initial main process executable file name of the target application is obtained; if it does not exist, the initial main process executable file name of the target application is obtained according to the file installation information.

[0378] In one embodiment, the multi-process acquisition sub-unit is also used to obtain the installation location of the target application based on the file installation information; obtain multiple executable files under the installation location based on the installation location of the target application; and determine the name of the executable file with the largest storage capacity as the initial main process executable file name of the target application.

[0379] In one embodiment, the second construction unit includes: a file extraction subunit, a static acquisition subunit, and an initial construction subunit, wherein:

[0380] A file extraction subunit, used to obtain all executable files in the file installation information of the target application;

[0381] The static acquisition subunit is used to parse all executable files in the file installation information of the target application to obtain the application static feature information of the target application;

[0382] The initial construction subunit is used to construct an initial application identifier of the target application according to the application static feature information of the target application and the initial process executable file name of the target application.

[0383] In one embodiment, the initial construction subunit further includes a third combination subunit and a fourth combination subunit, wherein:

[0384] a third combining subunit, configured to combine the name of the initial process executable file of the target application and the application static feature information to obtain an application identifier of the target application when the target application includes one process;

[0385] The fourth combining sub-unit is used to obtain the main process executable file name of the target application according to the process executable file name of the target application when the target application includes multiple processes, and combine the main process executable file name of the application and the application static feature information to obtain the initial application identification of the target application.

[0386] In one embodiment, the file extraction sub-unit is also used to obtain application identification data in the file installation information based on the file installation information of the target application, and obtain executable files identical to the application identification data from a preset data collection library based on the application identification data as all executable files in the file installation information of the target application.

[0387] In one embodiment, the file extraction sub-unit is also used to obtain the installation location in the file installation information based on the file installation information of the target application, then obtain multiple folders under the installation directory at the installation location, and finally obtain the executable file in the folder with the highest version number according to the version number of each folder, as all executable files in the file installation information of the target application.

[0388] In one embodiment, the file extraction sub-unit is also used to obtain the installation directory at the installation location in the file installation information based on the file installation information of the target application, and obtain multiple folders under the non-installation directory in the registry of the operating system, and finally use the executable files in the multiple folders under the non-installation directory as all the executable files in the file installation information of the target application.

[0389] In one embodiment, the application identification device 2400 further includes a storage module for storing the initial application identification of the target application in a local application data relationship library; the local application data relationship library is used to store the application identifications of all applications in the operating system.

[0390] Each module in the aforementioned application identification device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0391] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0392] The computer device provided in the above embodiment has an implementation principle and technical effects similar to those of the above method embodiment, and will not be described in detail here.

[0393] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0394] The above embodiment provides a computer-readable storage medium, whose implementation principle and technical effects are similar to those of the above method embodiment, and will not be repeated here.

[0395] In one embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0396] The above embodiment provides a computer program product, whose implementation principle and technical effects are similar to those of the above method embodiment, and will not be repeated here.

[0397] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0398] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0399] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0400] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. An application identification method, characterized in that: The method comprises: When any process in the target application is in a running state, obtaining process information of the process; the process information includes a process path, a parent-child relationship of the process, and a process handle; Obtaining all executable files and process executable file names of the target application based on the process information of the process; wherein the all executable files include executable files of the main process and associated processes obtained based on the process path and the parent-child relationship of the processes; the process executable file name is determined based on the process handle; Parsing all the executable files to obtain application dynamic feature information, and constructing the application identifier of the target application program in combination with the process executable file name; The application identifier of the target application is merged with the initial application identifier to update the initial application identifier of the target application; the initial application identifier is a static identifier constructed based on file installation information and the name of the initial process executable file when the target application is installed but not running.

2. The method according to claim 1, characterized in that The acquiring all executable files of the target application according to the process information of the process includes: Obtaining an executable file of the process according to the process path in the process information; and obtaining executable files of other processes in the target application except the process according to the process parent-child relationship in the process information; The executable file of the process and the executable files of other processes are aggregated to obtain all executable files of the target application.

3. The method according to claim 1, characterized in that The step of parsing all the executable files to obtain the application dynamic feature information and constructing the application identifier of the target application program in combination with the process executable file name includes: In the case where the target application includes a process, combining the process executable file name of the target application and the application dynamic feature information to obtain an application identifier of the target application; In the case where the target application includes multiple processes, the process executable file name of the target application is determined as the main process executable file name of the application, and the application identifier of the target application is obtained based on the main process executable file name of the application and the application dynamic feature information.

4. The method according to any one of claims 1 to 3, characterized in that The step of obtaining the initial application identifier includes: An initial application identifier of the target application is obtained from a local application data relationship library of the operating system.

5. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Monitor the process running status of each application in the operating system by running a process monitoring program in the operating system; If any process in the target application is in a running state, executing the step of obtaining the process information of the process; If the target application is in a state of being installed and all processes in the target application are in a non-running state, an initial application identifier of the target application is constructed.

6. The method according to any one of claims 1 to 3, characterized in that The method further comprises: The file installation information is obtained from the registry of the operating system.

7. The method according to any one of claims 1 to 3, characterized in that The method further comprises: In the case where the target application includes a process, obtaining the name of the initial process executable file of the target application from the registry of the operating system; In the case that the target application includes multiple processes, the initial main process executable file name of the target application is obtained by executing the main process executable file path scanning strategy.

8. The method according to claim 7, characterized in that The obtaining of the initial main process executable file name of the target application by executing the main process executable file path scanning strategy includes: In accordance with a preset order, querying the registry, the startup items of the operating system, and the shortcuts of the operating system in turn to determine whether the name of the initial main process executable file of the target application exists; If it exists, then obtain the name of the initial main process executable file of the target application; If it does not exist, the name of the initial main process executable file of the target application is obtained according to the file installation information.

9. The method according to claim 8, characterized in that The step of obtaining the name of the initial main process executable file of the target application according to the file installation information includes: Obtaining the installation location of the target application according to the file installation information; According to the installation location of the target application, obtaining multiple executable files in the installation location; The name of the executable file with the largest storage capacity is determined as the initial main process executable file name of the target application.

10. The method according to claim 5, characterized in that The initial application identifier for constructing the target application program includes: Obtain all executable files in the file installation information of the target application; Parsing all executable files in the file installation information of the target application to obtain application static feature information of the target application; An initial application identifier of the target application is constructed according to the application static feature information of the target application and the name of the initial process executable file of the target application.

11. The method according to claim 10, characterized in that The constructing the initial application identifier of the target application according to the application static feature information of the target application and the name of the initial process executable file of the target application includes: In the case where the target application includes one process, combining the initial process executable file name of the target application and the application static feature information to obtain an application identifier of the target application; In the case where the target application includes multiple processes, the main process executable file name of the target application is obtained based on the process executable file name of the target application, and the main process executable file name of the application and the application static feature information are combined to obtain the initial application identification of the target application.

12. The method according to claim 10, characterized in that The step of obtaining all executable files in the file installation information of the target application includes: According to the file installation information of the target application, obtaining the application identification data in the file installation information; According to the application identification data, executable files identical to the application identification data are acquired from a preset data collection library as all executable files in the file installation information of the target application program.

13. The method according to claim 10, characterized in that The step of obtaining all executable files in the file installation information of the target application includes: According to the file installation information of the target application, obtaining the installation location in the file installation information; Obtain multiple folders under the installation directory at the installation location; According to the version numbers of the folders, the executable file in the folder with the highest version number is obtained as all the executable files in the file installation information of the target application.

14. The method according to claim 10, characterized in that The step of obtaining all executable files in the file installation information of the target application includes: According to the file installation information of the target application, obtaining the installation directory at the installation location in the file installation information; Obtain multiple folders in a non-installation directory in the registry of the operating system; The executable files in the multiple folders in the non-installation directory are used as all the executable files in the file installation information of the target application.

15. The method according to claim 5, characterized in that The method further comprises: The initial application identifier of the target application is stored in a local application data relationship library; the local application data relationship library is used to store the application identifiers of all application programs in the operating system.

16. An application identification device, characterized in that: The device comprises: An acquisition module, configured to acquire process information of any process in a target application program when the process is in a running state; the process information includes a process path, a parent-child relationship of the process, and a process handle; a construction module, configured to obtain, based on the process information of the process, all executable files and process executable file names of the target application; wherein the all executable files include executable files of the main process and associated processes obtained based on the process path and the parent-child relationship of the processes; and the process executable file name is determined based on the process handle; Parsing all the executable files to obtain application dynamic feature information, and constructing the application identifier of the target application program in combination with the process executable file name; An update module is used to merge the application identifier of the target application with the initial application identifier to update the initial application identifier of the target application; the initial application identifier is a static identifier constructed based on file installation information and the name of the initial process executable file when the target application is installed but not running.

17. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 15 are implemented.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images