A software control method, device, electronic equipment and storage medium

Abstract

The present disclosure provides a software control method, device, electronic device and storage medium, the method comprising: when triggering the start of a control program, determining the current software to be controlled based on the control program; detecting whether the software to be controlled has been started; when detecting that the software to be controlled has been started, determining whether the target file of the active process corresponding to the software to be controlled is an abnormal file, and when determining that the target file is an abnormal file, controlling the software to be controlled to end, thereby improving the success rate and accuracy of controlling the operation of the software and improving the effect of security protection.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and in particular, to a software control method, device, electronic device and storage medium. Background Art

[0002] With the development of the Internet, information security has become increasingly important. Network attacks often cause huge losses to users' hosts or terminals, and malware is an attack method that requires key control. In the prior art, the method commonly used to control malware is to set the control software as self-starting software or service software so that it can be disabled before the malware is started. Although the control software has been started as early as possible, it is still difficult to avoid the situation where the malware is started earlier than the control software, resulting in the failure of the operation control of the malware and reduced security. Summary of the invention

[0003] The embodiments of the present disclosure at least provide a software control method, device, electronic device and storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a software control method, including:

[0005] When the control program is triggered to start, the current software to be controlled is determined based on the control program;

[0006] Detecting whether the software to be controlled has been started;

[0007] When it is detected that the software to be controlled has been started, it is determined whether the target file of the active process corresponding to the software to be controlled is an abnormal file, and when it is determined that the target file is an abnormal file, the software to be controlled is terminated.

[0008] In an optional implementation manner, determining the current software to be controlled includes:

[0009] Send a request to the server for obtaining the software to be controlled;

[0010] The current software to be controlled returned by the server is received, wherein the software to be controlled is preset, or the software to be controlled is abnormal software determined by the server.

[0011] In an optional implementation manner, the detecting whether the software to be controlled has been started includes:

[0012] Traverse the currently running activity processes;

[0013] Matching each active process with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled;

[0014] When it is determined that there is an active process corresponding to the software to be controlled, it is determined that the software to be controlled has been started.

[0015] In an optional implementation manner, matching the active processes with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled includes any of the following methods:

[0016] Determine whether the file installation path corresponding to each of the active processes includes the software name of the software to be controlled, and if it is determined that the file installation path includes the software name of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or,

[0017] Determine the target software signature information corresponding to each of the active processes, and when it is determined that the target software signature information matches the signature information of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or,

[0018] A target hash value corresponding to each of the active processes is determined, and when it is determined that the target hash value matches the hash value of the software to be controlled, it is determined that there is an active process corresponding to the software to be controlled.

[0019] In an optional implementation manner, the controlling to end the software to be controlled includes: controlling to end an active process corresponding to the software to be controlled, and prohibiting the software to be controlled from being restarted.

[0020] In an optional implementation manner, the method further includes:

[0021] When it is detected that the software to be controlled is not started, monitoring whether a process creation event corresponding to the software to be controlled occurs;

[0022] When a process creation event corresponding to the software to be controlled occurs, control ends the process creation event.

[0023] In an optional implementation manner, when a process creation event corresponding to the software to be controlled occurs, controlling to end the process creation event includes:

[0024] When a process creation event corresponding to the software to be controlled occurs and the software to be controlled does not belong to the installed software, based on the file detection engine, determining whether the process file of the process creation event is an abnormal file;

[0025] When it is determined that the process file is an abnormal file, the process creation event is controlled to end, or the process creation event is controlled to end and a prompt is given that an abnormal process occurs.

[0026] In an optional implementation manner, the triggering control program starts, including any of the following methods:

[0027] After the system where the control program is located is started, triggering the start of the control program at a preset time interval; or,

[0028] According to the received start-up instruction, the control program is triggered to start.

[0029] In a second aspect, an embodiment of the present disclosure further provides a software control device, including:

[0030] A determination module, used to determine the current software to be controlled based on the control program when the control program is triggered to start;

[0031] A detection module, used to detect whether the software to be controlled has been started;

[0032] The control module is used to determine whether the target file of the active process corresponding to the software to be controlled is an abnormal file when it is detected that the software to be controlled has been started, and control the software to be controlled to end when it is determined that the target file is an abnormal file.

[0033] In an optional implementation manner, when determining the current software to be controlled, the determination module is specifically used to:

[0034] Send a request to the server for obtaining the software to be controlled;

[0035] The current software to be controlled returned by the server is received, wherein the software to be controlled is preset, or the software to be controlled is abnormal software determined by the server.

[0036] In an optional implementation manner, when detecting whether the software to be controlled has been started, the detection module is specifically used to:

[0037] Traverse the currently running activity processes;

[0038] Matching each active process with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled;

[0039] When it is determined that there is an active process corresponding to the software to be controlled, it is determined that the software to be controlled has been started.

[0040] In an optional implementation manner, when matching the active processes with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled, the detection module is specifically used in any of the following ways:

[0041] Determine whether the file installation path corresponding to each of the active processes includes the software name of the software to be controlled, and if it is determined that the file installation path includes the software name of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or,

[0042] Determine the target software signature information corresponding to each of the active processes, and when it is determined that the target software signature information matches the signature information of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or,

[0043] A target hash value corresponding to each of the active processes is determined, and when it is determined that the target hash value matches the hash value of the software to be controlled, it is determined that there is an active process corresponding to the software to be controlled.

[0044] In an optional implementation manner, when the control ends the software to be controlled, the control module is specifically used to:

[0045] The active process corresponding to the software to be controlled is controlled to end, and the software to be controlled is prohibited from being restarted.

[0046] In an optional implementation manner, the control module is further specifically used for:

[0047] When it is detected that the software to be controlled is not started, monitoring whether a process creation event corresponding to the software to be controlled occurs;

[0048] When a process creation event corresponding to the software to be controlled occurs, control ends the process creation event.

[0049] In an optional implementation manner, when a process creation event corresponding to the software to be controlled occurs, when controlling to end the process creation event, the control module is used to:

[0050] When a process creation event corresponding to the software to be controlled occurs and the software to be controlled does not belong to the installed software, based on the file detection engine, determining whether the process file of the process creation event is an abnormal file;

[0051] When it is determined that the process file is an abnormal file, the process creation event is controlled to end, or the process creation event is controlled to end and a prompt is given that an abnormal process occurs.

[0052] In an optional implementation manner, when the trigger control program is started, the determination module is specifically used in any of the following ways:

[0053] After the system where the control program is located is started, triggering the start of the control program at a preset time interval; or,

[0054] According to the received start-up instruction, the control program is triggered to start.

[0055] In a third aspect, an optional implementation of the present disclosure further provides an electronic device, comprising a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the processor executes the above-mentioned first aspect, or the steps in any possible implementation of the first aspect.

[0056] In a fourth aspect, an optional implementation of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-mentioned first aspect, or the steps in any possible implementation of the first aspect.

[0057] The software control method provided by the embodiment of the present disclosure can determine whether the software to be controlled has been started based on the management and control program, and forcibly terminate the started software to be controlled, thereby improving the success rate and accuracy of controlling the operation of the software and improving the effect of security protection. Moreover, when the started software to be controlled is detected, it can further determine whether the target file of the corresponding active process is an abnormal file. If it is an abnormal file, it can be determined as abnormal software, that is, the software to be controlled is terminated, which can further improve the accuracy of controlling the abnormal software.

[0058] For a description of the effects of the above-mentioned software control device, electronic device, and computer-readable storage medium, please refer to the description of the above-mentioned software control method, which will not be repeated here.

[0059] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure.

[0060] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0062] Figure 1A flowchart of a software control method provided by an embodiment of the present disclosure is shown;

[0063] Figure 2 A flowchart of another software control method provided by an embodiment of the present disclosure is shown;

[0064] Figure 3 A schematic diagram of a software control device provided by an embodiment of the present disclosure is shown;

[0065] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0066] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0067] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure is not intended to limit the scope of the present disclosure claimed for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0068] Research has found that the existing control of malware usually sets the control program as self-starting software or service software so that it can be disabled before the malware or abnormal software is started. Although the control program has been started as early as possible, it is still difficult to avoid the situation where the malware is started earlier than the control program, causing the control program to fail, the operation control of the malware fails, and security is reduced.

[0069] Based on the above research, the present disclosure provides a software control method, device, electronic device and storage medium, which can determine whether the software to be controlled has been started based on the management and control program, and terminate the started software to be controlled, thereby improving the success rate and accuracy of controlling the operation of the software, improving the effect of security protection, and for the started software to be controlled, judging whether the target file of the corresponding active process is an abnormal file. When it is determined to be an abnormal file, the software to be controlled is controlled to be terminated, thereby improving the control accuracy.

[0070] The defects existing in the above solutions are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the present disclosure for the above problems below should be the contributions made by the inventor to the present disclosure during the disclosure process.

[0071] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0072] To facilitate understanding of this embodiment, a software control method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the software control method provided in the embodiment of the present disclosure is generally an electronic device with certain computing capabilities, and the electronic device includes, for example: a terminal device or a server or other processing device. The terminal device can be a user equipment (UE), a mobile device, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc., wherein a personal digital assistant is a handheld electronic device with some functions of an electronic computer, which can be used to manage personal information, browse the Internet, send and receive emails, etc. It is generally not equipped with a keyboard and can also be called a handheld computer. In some possible implementations, the software control method can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0073] The software control method provided by the embodiment of the present disclosure is described below by taking the execution subject as a terminal device as an example.

[0074] See also Figure 1 FIG. 1 is a flowchart of a software control method provided by an embodiment of the present disclosure, the method comprising:

[0075] S101: When the control program is triggered to start, the current software to be controlled is determined based on the control program.

[0076] In the embodiments of the present disclosure, the management and control program can run on a variety of different systems and devices. For example, it can run on a personal computer with a Windows system or on a server with a Linux system. The specific operating environment can be configured according to actual needs.

[0077] In this step, the control program is triggered to start, including any of the following methods:

[0078] 1) After the system where the control program is located is started, the control program is triggered to start according to the preset time interval.

[0079] For example, the startup time of the control program can be set to: start 1 second after the system startup is completed, where the preset time interval can be set according to the system startup time. Preferably, according to the startup time of the necessary items required for the system operation and the control program operation, a time interval as short as possible is set to further improve the security protection effect of the control program.

[0080] 2) According to the received start-up instruction, trigger the start of the control program.

[0081] For example, when a double-click operation of the application icon of the control program is received, the control program is started. For another example, when a voice command input by the user is received to open the control program, the control program is started.

[0082] Based on the above implementation, in some cases, such as when the control program is accidentally closed, the control program can be started at any time in response to a received start instruction, thereby improving the flexibility of the start timing of the control program.

[0083] Based on the above startup methods, the startup of the management and control program can be realized, and then based on the management and control program, the current software to be controlled can be determined, including: sending a request to obtain the software to be controlled to the server; receiving the current software to be controlled returned by the server, wherein the software to be controlled is pre-set, or the software to be controlled is abnormal software determined by the server.

[0084] In the above implementation, after the management and control program is started, it sends a request to the server to obtain the software to be controlled. The current software to be controlled returned by the server may be a list file, etc. The present disclosure does not limit this. The software to be controlled may be pre-set, for example, the security operator may set certain specific software as the software to be controlled according to security protection requirements, or the software to be controlled may be abnormal software determined by the server, for example, it may be software that has abnormal behaviors such as transmitting data to unknown servers.

[0085] Based on the above implementation, the efficiency and accuracy of the management and control program in determining the current software to be controlled can be improved, which helps to improve the accuracy of management and control of the operation of the software.

[0086] In addition, in order to further improve the protection effect of the control program, after obtaining the software to be controlled, the control program can save the obtained information locally to solve the problem of failure of the control program when it cannot communicate with the server.

[0087] S102: Detect whether the software to be controlled has been started.

[0088] When executing the above step S102, the embodiment of the present disclosure provides a possible implementation method for detecting whether the software to be controlled has been started, including: traversing each currently running active process; matching each active process with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled; when it is determined that there is an active process corresponding to the software to be controlled, determining that the software to be controlled has been started.

[0089] In the above implementation, the currently running active processes can be traversed through the application programming interface (Application Programming Interface, API) provided by the system, and then each active process can be matched with the software to be controlled. Specifically, each active process can be matched with the software to be controlled when it is obtained, or all the currently running active processes can be obtained first, and then matched with the software to be controlled. Before matching, the number of currently running active processes and the number of software to be controlled can be obtained first, and then the specific matching method can be determined according to the number of active processes and the number of software to be controlled, so as to improve the matching efficiency.

[0090] Furthermore, when matching, the matching result can be determined by any of the following methods, including:

[0091] 1) Determine whether the file installation path corresponding to each active process includes the software name of the software to be controlled, and if it is determined that the file installation path includes the software name of the software to be controlled, determine that there is an active process corresponding to the software to be controlled.

[0092] For example, the file installation path corresponding to the active process is: D:\ABC\DEF.exe, and when the software name of the software to be controlled includes "DEF", it can be determined that the file installation path includes the software name of the software to be controlled, and then it can be determined that there is an active process corresponding to the software to be controlled.

[0093] 2) Determine the target software signature information corresponding to each active process, and when it is determined that the target software signature information matches the signature information of the software to be controlled, determine that there is an active process corresponding to the software to be controlled.

[0094] Among them, the software signature information is used to ensure that the software comes from a verified genuine software publisher. When the software is running, the active process related to the software will generally also contain the corresponding signature information. Therefore, it is possible to determine whether the target software signature information corresponding to each active process matches the signature information of the software to be controlled, thereby determining whether there is an active process corresponding to the software to be controlled.

[0095] For example, when the target software signature information corresponding to the active process is "Company A", and the signature information of the software to be controlled includes "Company A, Company B, Company C", it can be determined that the target software signature information matches the signature information of the software to be controlled successfully, and then it can be determined that there is an active process corresponding to the software to be controlled.

[0096] 3) Determine the target hash value corresponding to each active process, and when it is determined that the target hash value matches the hash value of the software to be controlled, determine that there is an active process corresponding to the software to be controlled.

[0097] Among them, the hash value can be understood as a unique identifier of a piece of data. Different data has different corresponding hash values. In this way, by matching the target hash value corresponding to each active process with the hash value of the software to be controlled, it can be determined whether there is an active process corresponding to the software to be controlled.

[0098] For example, when the target hash value corresponding to the active process is "Y" and the hash value of the software to be controlled includes "X, Y, Z", it can be determined that the target hash value matches the hash value of the software to be controlled successfully, and then it can be determined that there is an active process corresponding to the software to be controlled.

[0099] Furthermore, the above-mentioned embodiments can be combined according to actual needs. For example, it can be determined first whether the file installation path corresponding to each active process includes the software name of the software to be controlled. If not, it can be determined whether the target software signature information corresponding to each active process matches the signature information of the software to be controlled. When the match fails, it can be determined whether the target hash value corresponding to each active process matches the hash value of the software to be controlled. In this way, by combining the use of multiple matching methods, the accuracy of determining whether the software to be controlled has been started is further improved.

[0100] In addition, only one of the methods may be used according to actual needs, which can improve the efficiency of determining whether the software to be controlled has been started.

[0101] In summary, when executing step S102, it is possible to accurately determine whether the software to be controlled has been started through the matching result of the active process related information.

[0102] S103: When it is detected that the software to be controlled has been started, it is determined whether the target file of the active process corresponding to the software to be controlled is an abnormal file, and when it is determined that the target file is an abnormal file, the software to be controlled is terminated.

[0103] In the disclosed embodiment, when it is detected that the software to be controlled has been started, it is possible that the software to be controlled is not the installed software in the terminal device. In order to improve the accuracy of the judgment on abnormal software, it is possible to further judge whether the software to be controlled is abnormal software. Specifically, it is possible to judge whether the target file of the active process corresponding to the software to be controlled is an abnormal file based on the file detection engine. If it is an abnormal file, the software to be controlled can be considered to be abnormal software, and then the software to be controlled can be controlled to end, and the user can be prompted that an abnormality has occurred, thereby further improving security.

[0104] When executing the above step S103, the embodiment of the present disclosure provides a possible implementation method, controlling the termination of the software to be controlled, including: controlling the termination of the active process corresponding to the software to be controlled, and prohibiting the software to be controlled from restarting.

[0105] In the above implementation, the active process corresponding to the software to be controlled can be ended by calling the API interface function provided by the system, and determining the success value returned after the function is executed. In this way, it can be determined that the active process is successfully ended, thereby achieving the end of the software to be controlled.

[0106] In addition to controlling the already started software to be controlled through the above-mentioned implementation, the present disclosure also provides an implementation method for controlling the software to be controlled that has not been started, specifically including: when it is detected that the software to be controlled has not been started, monitoring whether a process creation event corresponding to the software to be controlled occurs; when a process creation event corresponding to the software to be controlled occurs, controlling the end of the process creation event.

[0107] In the above implementation, the process creation event includes a process creation request issued by the software, etc. When the process creation event corresponding to the software to be controlled is monitored, the process creation event can be directly ended, for example, the process creation request issued by the software to be controlled is rejected. In this way, the initial startup of the software to be controlled that has not yet been started can be prohibited, thereby further improving the security protection effect.

[0108] Furthermore, with respect to controlling the termination of a process creation event when a process creation event corresponding to the software to be controlled occurs, the present disclosure also provides possible implementation methods, including: when a process creation event corresponding to the software to be controlled occurs and the software to be controlled does not belong to the installed software, based on the file detection engine, determining whether the process file of the process creation event is an abnormal file; when it is determined that the process file is an abnormal file, controlling the termination of the process creation event, or controlling the termination of the process creation event and prompting the occurrence of an abnormal process.

[0109] In the disclosed embodiment, it is possible to monitor in real time whether there are process creation events. When there are process creation events, it is possible to determine whether the software is already installed in the terminal device. If it is determined that the software is not already installed and is software to be controlled, it is possible to further determine whether the process file is an abnormal file or abnormal software. If it is determined to be an abnormal file or abnormal software, the user can be prompted and the software cannot be allowed to run, thereby improving the accuracy of judgment and the security of management and control.

[0110] The disclosed embodiments can determine whether the software to be controlled has been started based on the control program, and terminate the started software to be controlled, thereby improving the success rate and accuracy of controlling the operation of the software and improving the effect of security protection.

[0111] The following uses a specific application scenario to illustrate the software control method in the embodiment of the present disclosure. Take a computer with Windows system as an example, see Figure 2 As shown, Figure 2 A flowchart of another software control method provided by an embodiment of the present disclosure specifically includes:

[0112] S201: System startup.

[0113] In this step, the system usually starts a series of necessary services and certain software during startup. Among them, some malware will modify its startup priority to the highest to evade detection by the control program.

[0114] S202: The software to be controlled is started.

[0115] Since the software control method of the present disclosure can be applied to the scenario where the startup time of the software to be controlled is earlier than the control program, in order to further illustrate the software control method in the embodiment of the present disclosure, it is exemplified here that the software to be controlled is started before step S203. The embodiment of the present disclosure does not limit the software to be controlled to be started earlier than the control program.

[0116] For example, when the software to be controlled is started, process A is created, and the signature information includes "Company N".

[0117] S203: The control procedure is initiated.

[0118] In this step, the control program may be started by setting a startup mode such as automatic startup at boot time, or the control program may be started after a preset time interval after the system is started.

[0119] After the control program is started, the control program initiates a request to the server to obtain the software to be controlled. After receiving the above request, the server sends the software to be controlled to the device where the control program is located. The representation of the software to be controlled here includes relevant data of the software to be controlled, such as a table file including the name of the software to be controlled, signature information, and hash value.

[0120] Based on the received files related to the software to be controlled, it helps to accurately control the operation of the software to be controlled in subsequent steps.

[0121] S204: Traverse all active processes in the system.

[0122] For example, all active processes in the system obtained through the system API include: process A, process B, and process C.

[0123] Because the control program executes the above step S204 after startup, the active processes obtained through traversal are all started earlier than the control program. In this way, by executing step S204, it is possible to determine the processes that are started earlier than the control program, thereby expanding the security protection scope of the control program.

[0124] S205: Matching the list of software to be controlled.

[0125] In this step, when an active process is obtained in the above step S204, a match is performed with the list of software to be controlled, or after all active processes are traversed in the above step S204, a match is performed with the list of software to be controlled.

[0126] S206: Determine the started software to be controlled.

[0127] In this step, the management and control program obtains the relevant data of the software to be controlled and matches the active processes obtained through traversal. For example, the software to be controlled includes process A, and all active processes in the system obtained through the system API include: process A, process B, process C. At this time, it can be determined that the software to be controlled corresponding to process A has been started.

[0128] Furthermore, based on the result determined in step S206, the started software to be controlled can be controlled to end through the process end instruction provided by the system. In this way, based on the above steps S201-S206, the success rate and accuracy of managing the operation of the started software are improved, thereby improving the effect of security protection.

[0129] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0130] Based on the same inventive concept, a software control device corresponding to the software control method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned software control method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0131] Reference Figure 3 FIG. 1 is a schematic diagram of a software control device provided by an embodiment of the present disclosure, the device comprising:

[0132] A determination module 31 is used to determine the current software to be controlled based on the control program when the control program is triggered to start;

[0133] A detection module 32, used to detect whether the software to be controlled has been started;

[0134] The control module 33 is used to determine whether the target file of the active process corresponding to the software to be controlled is an abnormal file when it is detected that the software to be controlled has been started, and control the software to be controlled to end when it is determined that the target file is an abnormal file.

[0135] In an optional implementation manner, when determining the current software to be controlled, the determination module 31 is used to:

[0136] Send a request to the server for obtaining the software to be controlled;

[0137] The current software to be controlled returned by the server is received, wherein the software to be controlled is preset, or the software to be controlled is abnormal software determined by the server.

[0138] In an optional implementation manner, when detecting whether the software to be controlled has been started, the detection module 32 is used to:

[0139] Traverse the currently running activity processes;

[0140] Matching each active process with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled;

[0141] When it is determined that there is an active process corresponding to the software to be controlled, it is determined that the software to be controlled has been started.

[0142] In an optional implementation manner, when matching the active processes with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled, the detection module 32 is used in any of the following ways:

[0143] Determine whether the file installation path corresponding to each of the active processes includes the software name of the software to be controlled, and if it is determined that the file installation path includes the software name of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or,

[0144] Determine the target software signature information corresponding to each of the active processes, and when it is determined that the target software signature information matches the signature information of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or,

[0145] A target hash value corresponding to each of the active processes is determined, and when it is determined that the target hash value matches the hash value of the software to be controlled, it is determined that there is an active process corresponding to the software to be controlled.

[0146] In an optional implementation manner, when the control ends the software to be controlled, the control module 33 is used to: control the end of the active process corresponding to the software to be controlled, and prohibit the software to be controlled from being restarted.

[0147] In an optional implementation manner, the control module 33 is further configured to:

[0148] When it is detected that the software to be controlled is not started, monitoring whether a process creation event corresponding to the software to be controlled occurs;

[0149] When a process creation event corresponding to the software to be controlled occurs, control ends the process creation event.

[0150] In an optional implementation manner, when a process creation event corresponding to the software to be controlled occurs, when controlling to end the process creation event, the control module 33 is used to:

[0151] When a process creation event corresponding to the software to be controlled occurs and the software to be controlled does not belong to the installed software, based on the file detection engine, determining whether the process file of the process creation event is an abnormal file;

[0152] When it is determined that the process file is an abnormal file, the process creation event is controlled to end, or the process creation event is controlled to end and a prompt is given that an abnormal process occurs.

[0153] In an optional implementation manner, when the trigger control program is started, the determination module 31 is used in any of the following ways:

[0154] After the system where the control program is located is started, the control program is triggered to start at a preset time interval; or, the control program is triggered to start according to a received start instruction.

[0155] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0156] The present disclosure also provides an electronic device, such as Figure 4 FIG. 1 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure, including:

[0157] A processor 41 and a memory 42; the memory 42 stores machine-readable instructions executable by the processor 41, and the processor 41 is used to execute the machine-readable instructions stored in the memory 42. When the machine-readable instructions are executed by the processor 41, the processor 41 performs the following steps:

[0158] When the control program is triggered to start, the current software to be controlled is determined based on the control program;

[0159] Detecting whether the software to be controlled has been started;

[0160] When it is detected that the software to be controlled has been started, it is determined whether the target file of the active process corresponding to the software to be controlled is an abnormal file, and when it is determined that the target file is an abnormal file, the software to be controlled is terminated.

[0161] The above-mentioned memory 42 includes internal memory 421 and external memory 422; the memory 421 here is also called internal memory, which is used to temporarily store the calculation data in the processor 41 and the data exchanged with the external memory 422 such as the hard disk. The processor 41 exchanges data with the external memory 422 through the internal memory 421.

[0162] The specific execution process of the above instructions can refer to the steps of the software control method described in the embodiment of the present disclosure, which will not be repeated here.

[0163] The present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the software control method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0164] The present disclosure also provides a computer program product that carries a program code. The program code includes instructions that can be used to execute the steps of the software control method described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0165] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0166] If the disclosed technical solution involves personal information, the product using the disclosed technical solution has clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing the personal information. If the disclosed technical solution involves sensitive personal information, the product using the disclosed technical solution has obtained the individual's separate consent before processing the sensitive personal information, and at the same time meets the "explicit consent" requirement. For example, on personal information collection devices such as cameras, clear and prominent signs are set to inform that the personal information collection scope has been entered and personal information will be collected. If the individual voluntarily enters the collection scope, it is deemed that he or she agrees to the collection of his or her personal information; or on the device that processes personal information, when the personal information processing rules are notified by obvious signs / information, the individual's authorization is obtained through pop-up information or by asking the individual to upload his or her personal information; among them, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the type of personal information processed.

[0167] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0168] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0169] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0170] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling an electronic device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0171] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A software control method, characterized in that: include: When the control program is triggered to start, the current software to be controlled is determined based on the control program; Traverse the currently running activity processes; Matching each active process with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled; When it is determined that there is an active process corresponding to the software to be controlled, determining that the software to be controlled has been started; When it is detected that the software to be controlled has been started, determining whether the target file of the active process corresponding to the software to be controlled is an abnormal file, and when it is determined that the target file is an abnormal file, controlling to end the software to be controlled; The triggering control program starts, including any of the following methods: After the system where the control program is located is started, triggering the start of the control program at a preset time interval; or, According to the received start-up instruction, the control program is triggered to start.

2. The method according to claim 1, characterized in that The determining of the current software to be controlled includes: Send a request to the server for obtaining the software to be controlled; The current software to be controlled returned by the server is received, wherein the software to be controlled is preset, or the software to be controlled is abnormal software determined by the server.

3. The method according to claim 1, characterized in that The matching of the active processes with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled includes any of the following methods: Determine whether the file installation path corresponding to each of the active processes includes the software name of the software to be controlled, and if it is determined that the file installation path includes the software name of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or, Determine the target software signature information corresponding to each of the active processes, and when it is determined that the target software signature information matches the signature information of the software to be controlled, determine that there is an active process corresponding to the software to be controlled; or, A target hash value corresponding to each of the active processes is determined, and when it is determined that the target hash value matches the hash value of the software to be controlled, it is determined that there is an active process corresponding to the software to be controlled.

4. The method according to claim 1, characterized in that: The controlling and ending the software to be controlled includes: The active process corresponding to the software to be controlled is controlled to end, and the software to be controlled is prohibited from being restarted.

5. The method according to claim 1, characterized in that: The method further comprises: When it is detected that the software to be controlled is not started, monitoring whether a process creation event corresponding to the software to be controlled occurs; When a process creation event corresponding to the software to be controlled occurs, control ends the process creation event.

6. The method according to claim 5, characterized in that When a process creation event corresponding to the software to be controlled occurs, controlling to end the process creation event includes: When a process creation event corresponding to the software to be controlled occurs and the software to be controlled does not belong to the installed software, based on the file detection engine, determining whether the process file of the process creation event is an abnormal file; When it is determined that the process file is an abnormal file, the process creation event is controlled to end, or the process creation event is controlled to end and a prompt is given that an abnormal process occurs.

7. A software control device, characterized in that: include: A determination module, used to determine the current software to be controlled based on the control program when the control program is triggered to start; A detection module, used to traverse each currently running active process; match each active process with the software to be controlled to determine whether there is an active process corresponding to the software to be controlled; when it is determined that there is an active process corresponding to the software to be controlled, determine that the software to be controlled has been started; A control module, configured to, when detecting that the software to be controlled has been started, determine whether a target file of an active process corresponding to the software to be controlled is an abnormal file, and when determining that the target file is an abnormal file, control the software to be controlled to end; When the trigger control program is started, the determination module is specifically used in any of the following ways: After the system where the control program is located is started, triggering the start of the control program at a preset time interval; or, According to the received start-up instruction, the control program is triggered to start.

8. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the software control method as described in any one of claims 1 to 6 are performed.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the software control method according to any one of claims 1 to 6 are executed.

Images