Method, device, medium and equipment for managing program permissions based on behavior dynamics

Abstract

The present application provides a method, apparatus, medium and equipment for managing program permissions based on behavior dynamics, which relates to the field of information security. The method includes: obtaining a behavior feature vector corresponding to the program to be detected each time a preset detection time point is reached; inputting the behavior feature vector into a preset classification model to obtain a matching rate corresponding to each preset malicious behavior type; if the maximum matching rate is greater than the corresponding first matching rate threshold and less than the corresponding second matching rate threshold, determining whether the program to be detected is a non-malicious program; if not, limiting the corresponding behavior of the program to be detected according to the corresponding preset malicious behavior type restriction behavior list. When the corresponding matching degree threshold does not reach the second matching degree threshold, the present application protects the security of the system and related files, programs, etc. by limiting some key behaviors, while preventing non-malicious programs with similar behaviors from being misjudged as malicious programs, thereby interrupting the working process of the non-malicious programs.

Description

Background Art

[0002] In the current information security field, the threat of malicious programs (such as stealing Trojans, etc.) is increasing. These malicious programs use various complex technical means to invade and destroy target systems, causing huge losses to users and organizations. With the continuous development of attack technology, malicious codes are increasingly using system permissions to perform illegal operations, such as encrypting files, stealing sensitive data, creating persistence mechanisms, etc., to evade detection and maintain their own persistence. Traditional permission management mechanisms are powerless in the face of these dynamically changing threats and cannot effectively prevent the behavior of malicious programs.

[0003] Some non-malicious programs may have similar behaviors to some malicious programs, which results in a high misjudgment rate of malicious code judgment based only on behavioral characteristics in the prior art, which may force some non-malicious programs to terminate their processes. Summary of the invention

[0004] In view of this, the present application provides a method, apparatus, medium and device for dynamically managing program permissions based on behavior, which at least partially solves the technical problems existing in the prior art. The technical solution adopted by the present application is:

[0005] According to one aspect of the present application, a method for dynamically managing program permissions based on behaviors is provided, which is applied to a program to be detected, wherein the program to be detected has a number of corresponding behaviors, each of which has a corresponding behavior number; the method comprises:

[0006] Every time the preset detection time point is reached, the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed within the target time window are obtained to obtain the corresponding behavior feature vector; wherein the end time of the target time window is the current time;

[0007] Input the above behavior feature vector into a preset classification model to obtain a matching rate between the above behavior feature vector and each preset malicious behavior type; wherein each preset malicious behavior type has a corresponding restricted behavior list;

[0008] If the maximum matching rate is greater than the corresponding first matching rate threshold and less than the corresponding second matching rate threshold, determining whether the program to be detected is a non-malicious program according to a preset detection method;

[0009] If the program to be detected is not a non-malicious program, the behavior corresponding to the program to be detected is restricted according to a restricted behavior list of preset malicious behavior types corresponding to the maximum matching rate.

[0010] In an exemplary embodiment of the present application, the above-mentioned behavior feature vector includes a behavior frequency sub-feature vector and a behavior number sub-feature vector; the above-mentioned behavior frequency sub-feature vector is obtained according to the historical execution times of each behavior; the above-mentioned behavior number sub-feature vector is obtained by the following steps:

[0011] Get every action executed within the target time window.

[0012] Arrange the behavior numbers corresponding to each behavior executed within the target time window in the order of execution time to obtain the corresponding initial behavior list.

[0013] If the number of behaviors executed within the above-mentioned target time window is greater than the preset number of feature dimensions n of the above-mentioned behavior number sub-feature vector, then n corresponding behavior numbers are intercepted from the back to the front in the above-mentioned initial behavior list to obtain the above-mentioned behavior number feature sub-vector; wherein each behavior number in the above-mentioned behavior number feature sub-vector is arranged in the order of execution time.

[0014] In an exemplary embodiment of the present application, after arranging the behavior numbers corresponding to each behavior executed within the target time window in the order of execution time to obtain a corresponding initial behavior list, the method further includes:

[0015] If the number of behaviors executed within the above-mentioned target time window is less than the preset number of feature dimensions n of the above-mentioned behavior number sub-feature vector, the preset feature values ​​of the preset number of remaining dimensions are filled after the initial behavior list to obtain the corresponding behavior number sub-feature vector; wherein the preset number of remaining dimensions is the difference between the preset number of feature dimensions and the number of behaviors included in the initial behavior list.

[0016] In an exemplary embodiment of the present application, the above-mentioned preset detection method includes:

[0017] Obtain the digital signature corresponding to the above program to be detected.

[0018] If the digital signature is different from each preset digital signature, it is determined that the program to be detected is not a non-malicious program.

[0019] In an exemplary embodiment of the present application, after inputting the above-mentioned behavior feature vector into a preset classification model to obtain a matching rate between the above-mentioned behavior feature vector and each preset malicious behavior type, the above-mentioned method further includes:

[0020] If the maximum matching rate is greater than the corresponding second matching rate threshold, the program to be detected is determined to be a malicious program.

[0021] In an exemplary embodiment of the present application, the first preset matching rate threshold is determined according to the following steps:

[0022] Every time a preset collection time point is reached, the user type of the target device corresponding to the program to be detected is updated once; wherein each user type has a corresponding preset threshold adjustment coefficient list; the above preset threshold adjustment coefficient list includes the preset threshold adjustment coefficient corresponding to each preset malicious behavior type.

[0023] According to the preset threshold adjustment coefficient list of the user type corresponding to the current time and the first initial matching rate threshold corresponding to each preset malicious behavior type, the first matching rate threshold corresponding to each preset malicious behavior type is obtained; the number of preset malicious behavior types is m, i=1, 2, ..., m; the first matching rate threshold G corresponding to the i-th preset malicious behavior type i Meet the following conditions:

[0024] G i =Z ai ×C i

[0025] Among them, Z ai is the preset threshold adjustment coefficient of the i-th preset malicious behavior type corresponding to the user type a corresponding to the current time; C i is the first initial matching rate threshold corresponding to the i-th preset malicious behavior type.

[0026] In an exemplary embodiment of the present application, the user type of the target device corresponding to the program to be detected is updated once each time a preset collection time point is reached, including:

[0027] Every time a preset collection time point is reached, user feature information of the target device corresponding to the program to be detected is obtained to obtain a corresponding user feature vector; wherein the user feature vector includes the total number of programs corresponding to each preset program type and the number of uses corresponding to each preset program type within a target time period; the start time of the target time period is the collection time point closest to the current time, and the end time is the current collection time point.

[0028] The matching degree between the user feature vector and the key feature vector corresponding to each historical user feature cluster in a plurality of preset historical user feature clusters is obtained; wherein each historical user feature cluster has a corresponding user type.

[0029] The user type corresponding to the key feature vector with the highest matching degree with the user feature vector is determined as the user type of the target device corresponding to the program to be detected at the current acquisition time point.

[0030] The key feature vector corresponding to each historical user feature cluster in the plurality of preset historical user feature clusters is determined according to the following steps:

[0031] Collect historical user feature information corresponding to several devices in several historical time periods to obtain a corresponding historical user feature vector list.

[0032] The historical user feature vector list is clustered to obtain several historical user feature clusters.

[0033] According to all historical user feature vectors in each historical user feature cluster, a key feature vector corresponding to each historical user feature cluster is obtained; wherein each feature value in the key feature vector is an average value of corresponding feature values ​​in all historical user feature vectors in the corresponding historical user feature cluster.

[0034] According to one aspect of the present application, a method and device for managing program permissions based on behavior dynamics is provided, which is applied to a program to be detected, wherein the program to be detected has a number of corresponding behaviors, and each behavior has a corresponding behavior number; the device comprises:

[0035] The acquisition unit is used to acquire the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed within the target time window at each preset detection time point, and obtain the corresponding behavior feature vector; wherein the end time of the target time window is the current time;

[0036] A matching rate determination unit, used to input the above-mentioned behavior feature vector into a preset classification model to obtain a matching rate between the above-mentioned behavior feature vector and each preset malicious behavior type; wherein each preset malicious behavior type has a corresponding restricted behavior list;

[0037] A program determination unit, configured to determine whether the program to be detected is a non-malicious program according to a preset detection method if the maximum matching rate is greater than a corresponding first matching rate threshold and less than a corresponding second matching rate threshold;

[0038] The behavior restriction unit is used to restrict the behavior corresponding to the program to be detected according to a restricted behavior list of preset malicious behavior types corresponding to the maximum matching rate if the program to be detected is not a non-malicious program.

[0039] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the above-mentioned method of dynamically managing program permissions based on behavior.

[0040] According to one aspect of the present application, an electronic device is provided, comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0041] This application has at least the following beneficial effects:

[0042] The method of dynamically managing program permissions based on behavior of the present application is applied to the program to be detected, and the above-mentioned program to be detected has a corresponding number of behaviors, and each behavior has a corresponding behavior number; first, each time the preset detection time point is reached, the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed in the target time window are obtained to obtain the corresponding behavior feature vector. Here, the behavior feature vector represents the overall execution of the behavior of the program to be detected since its installation and the specific execution of the behavior of the program to be detected in the recent period of time; then, according to the preset classification model, the matching rate of the program to be detected belonging to each preset malicious behavior type is obtained. Here, the higher the matching rate, the greater the possibility that the program to be detected may be the corresponding preset malicious behavior type, and vice versa. Each preset malicious behavior type has a corresponding restricted behavior list, and the restricted behavior is the key behavior that is harmful. Afterwards, if the maximum match rate corresponding to the preset malicious behavior type is greater than the corresponding first match rate threshold and less than the corresponding second match rate threshold, then the preset detection method is used to determine whether the above-mentioned program to be detected is a non-malicious program. Here, two thresholds are set. If it is greater than the corresponding first match rate threshold and less than the corresponding second match rate threshold, it means that the program to be detected has some suspicious behaviors or the currently executed behaviors are more suspicious when combined, but not enough to directly determine it as a malicious program. At this time, it is determined whether it is a non-malicious program according to the preset detection method. If it cannot be determined as a non-malicious program, it cannot be directly determined as a malicious program. However, in order to protect the security of the system, its corresponding behavior is restricted according to its corresponding restricted behavior list. The present application first obtains a preliminary malicious type judgment of the program to be detected based on the overall execution of the behavior since installation and the specific execution of the behavior of the program to be detected in the recent period of time. Then, when the match rate corresponding to the preset malicious behavior type is greater than the corresponding first match rate threshold and less than the corresponding second match rate threshold, it is not directly judged as a malicious program, thereby avoiding some non-malicious programs with similar behaviors from being misjudged as malicious programs. After determining that it is not a non-malicious program, the behavior corresponding to the above-mentioned program to be detected is restricted according to the preset restricted behavior list. When the corresponding matching degree threshold does not reach the second matching degree threshold, the present application protects the security of the system and related files, programs, etc. by restricting some key behaviors, while preventing non-malicious programs with similar behaviors from being misjudged as malicious programs, thereby interrupting the working process of the non-malicious programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0044] Figure 1 A flowchart of a method for dynamically managing program permissions based on behavior provided for this application;

[0045] Figure 2 This is a structural block diagram of the device for dynamically managing program permissions based on behavior provided in this application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0047] like Figure 1 As shown, a method for dynamically managing program permissions based on behaviors is provided according to an embodiment of the present application, and is applied to a program to be detected, wherein the program to be detected has a number of corresponding behaviors, and each behavior has a corresponding behavior number. The method comprises the following steps:

[0048] Step S100, every time a preset detection time point is reached, the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed within the target time window are obtained to obtain the corresponding behavior feature vector; wherein the end time of the target time window is the current time.

[0049] Specifically, in this embodiment, the behavior may be: accessing sensitive files, modifying the registry, etc. The behaviors corresponding to the program to be detected are each behavior executed by the program to be detected before the current time. The historical execution count may be the execution count of each behavior executed from the time the program to be detected is installed on the corresponding target device to the current time. Each behavior has a corresponding behavior number, which is used to distinguish and identify each behavior.

[0050] In one embodiment, the end time of the target time window is the current time, and the length of the target time window may be 1 hour.

[0051] Furthermore, the above behavior feature vector includes a behavior frequency sub-feature vector and a behavior number sub-feature vector; the above behavior frequency sub-feature vector is obtained according to the historical execution times of each behavior. The above behavior frequency sub-feature vector includes the execution times corresponding to each behavior executed by the program to be detected before the current time. The above behavior number sub-feature vector is obtained by the following steps:

[0052] Step S110, obtaining each behavior executed within the target time window.

[0053] Step S120 , arranging the behavior numbers corresponding to each behavior executed within the target time window in the order of execution time to obtain a corresponding initial behavior list.

[0054] Step S130, if the number of behaviors executed within the above-mentioned target time window is greater than the preset number of feature dimensions n of the above-mentioned behavior number sub-feature vector, then n corresponding behavior numbers are intercepted from the back to the front in the above-mentioned initial behavior list to obtain the above-mentioned behavior number feature sub-vector; wherein each behavior number in the above-mentioned behavior number feature sub-vector is arranged in the order of execution time.

[0055] In this embodiment, in order to ensure the consistency of the feature vector length each time the program to be detected is detected, the behavior number sub-feature vector is set as a sub-feature vector of fixed dimension, wherein the corresponding preset number of dimensions is n, and the number of behaviors executed in the target time window may be different from n. If the number of behaviors executed in the target time window is greater than n, in order to obtain the behavior situation in the most recent period as much as possible, at this time, n corresponding behavior numbers are intercepted from the back to the front in the above initial behavior list, that is, the behavior numbers of n behaviors that are relatively close to the end time (current time) of the target time window are obtained. And each behavior number in the behavior number feature sub-vector is arranged in the order of execution time.

[0056] In an exemplary embodiment of the present application, after step S120, the method further includes:

[0057] Step S140, if the number of behaviors executed within the above-mentioned target time window is less than the preset number of feature dimensions n of the above-mentioned behavior number sub-feature vector, then the preset feature values ​​of the preset number of remaining dimensions are filled after the initial behavior list to obtain the corresponding behavior number sub-feature vector; wherein the preset number of remaining dimensions is the difference between the preset number of feature dimensions and the number of behaviors included in the initial behavior list.

[0058] Specifically, if the number of behaviors executed in the target time window is less than n, the remaining feature dimensions are filled with preset feature values ​​to ensure the integrity of the behavior number sub-feature vector. As an example: the preset feature value may be 0.

[0059] It can be understood that if the number of behaviors executed within the target time window is equal to n, the behavior number sub-feature vector is directly filled according to the initial behavior list.

[0060] Step S200, inputting the above-mentioned behavior feature vector into a preset classification model to obtain a matching rate between the above-mentioned behavior feature vector and each preset malicious behavior type; wherein each preset malicious behavior type has a corresponding restricted behavior list.

[0061] Specifically, the preset classification model is used to obtain the matching rate between the input behavior feature vector and each preset malicious behavior type, and the corresponding matching rate indicates the possibility that the program to be detected is each preset malicious behavior type. The higher the matching rate, the greater the possibility that the program to be detected may be the corresponding preset malicious behavior type, and vice versa. As an example: the preset malicious behavior type can be a stealing type, a phishing type, etc. And each preset malicious behavior type has a corresponding restricted behavior list. Here, each preset malicious behavior type uses the system permissions of the target device to perform the corresponding behavior, and each preset malicious behavior type needs to perform multiple behaviors to complete the illegal operation. As an example: when the preset malicious behavior type is a stealing type, the purpose is to steal sensitive files. The executed behaviors include: reading files, encrypting files, and transferring files. The most critical behavior in the process is transferring files. Then, when the preset malicious behavior type is a stealing type, the corresponding restricted behavior can be transferring files. That is, the restricted behavior is the behavior that plays a decisive role in the multiple behaviors that need to be executed to complete the illegal operation.

[0062] Step S300: If the maximum matching rate is greater than the corresponding first matching rate threshold and less than the corresponding second matching rate threshold, it is determined whether the program to be detected is a non-malicious program according to a preset detection method.

[0063] Specifically, the preset malicious behavior type corresponding to the maximum match rate is the preset malicious behavior type that the program to be detected most likely corresponds to. Among them, the first match rate threshold can be 70%, and the second match rate threshold can be 90%. If the maximum match rate corresponding to the preset malicious behavior type is greater than the corresponding first match rate threshold and less than the corresponding second match rate threshold, it means that the program to be detected has certain suspicious behaviors or the combination of currently executed behaviors is suspicious, but it is not enough to directly determine it as a malicious program. Because some non-malicious programs may also execute the above steps, in order to avoid misjudgment as much as possible, it is determined whether the above program to be detected is a non-malicious program according to the preset detection method, wherein the preset detection method includes:

[0064] Step S310, obtaining the digital signature corresponding to the program to be detected.

[0065] In step S320, if the digital signature is different from each of the preset digital signatures, it is determined that the program to be detected is not a non-malicious program.

[0066] Here, the digital signature corresponding to the program to be detected is used to determine whether it is a non-malicious program. The digital signature has a high degree of security and credibility. Others cannot forge the signature and can be used to authenticate the program to be detected. If the digital signature is different from each preset digital signature, it may be because the user has modified the digital signature himself, or the program to be detected may be a malicious program or an uncommon non-malicious program. However, it cannot be directly determined to be a malicious program.

[0067] In this embodiment, firstly, a preliminary malicious type judgment of the program to be detected is obtained based on the overall execution of the behavior since installation and the specific execution of the behavior of the program to be detected in the recent period, and then when the matching rate corresponding to the preset malicious behavior type is greater than the corresponding first matching rate threshold and less than the corresponding second matching rate threshold, it is not directly judged as a malicious program, thereby avoiding some non-malicious programs with similar behaviors from being misjudged as malicious programs. After determining that it is not a non-malicious program, the corresponding behavior of the above-mentioned program to be detected is restricted according to the preset restricted behavior list. When the corresponding matching degree threshold does not reach the second matching degree threshold, the present application protects the security of the system and related files, programs, etc. by restricting some key behaviors, while avoiding non-malicious programs with similar behaviors from being misjudged as malicious programs, thereby interrupting the working process of non-malicious programs.

[0068] In an exemplary embodiment of the present application, the first preset matching rate threshold is determined according to the following steps:

[0069] Step S301, every time the preset collection time point is reached, the user type of the target device corresponding to the program to be detected is updated once; wherein each user type has a corresponding preset threshold adjustment coefficient list; the above preset threshold adjustment coefficient list includes the preset threshold adjustment coefficient corresponding to each preset malicious behavior type.

[0070] Specifically, step S301 further includes the following steps:

[0071] Step S3011, every time a preset collection time point is reached, the user feature information of the target device corresponding to the program to be detected is obtained to obtain a corresponding user feature vector; wherein the above-mentioned user feature vector includes the total number of programs corresponding to each preset program type and the number of uses corresponding to each preset program type within the target time period; the start time of the above-mentioned target time period is the collection time point closest to the current time, and the end time is the current collection time point.

[0072] Here, the target device corresponding to the program to be detected is the device where the program to be detected is located, and since the users corresponding to the device in different time periods may be different, different users may have different usage frequencies for different types of programs. Or the users corresponding to the device in different time periods are the same, but due to different needs, different types of programs may have different usage frequencies. The executable behavior corresponding to a certain class or a certain type of program may partially overlap with the executable behavior corresponding to the above-mentioned preset malicious behavior type. At this time, since the program to be detected is detected once every period of time, in order to better prevent the misjudgment of non-malicious programs, in this embodiment, every period of time, when the preset collection time point is reached, the user type of the target device corresponding to the program to be detected is updated once. First, the user feature information of the target device corresponding to the program to be detected is obtained. Here, the user feature vector includes the total number of programs corresponding to each preset program type and the number of uses corresponding to each preset program type in the target time period. The above user feature vector represents the installation and use of the corresponding user of the target device between the collection time point closest to the current time and the current time, so as to know whether the user will use a non-malicious program that partially overlaps with the executable behavior corresponding to a preset malicious behavior type.

[0073] Step S3012, obtaining the matching degree between the user feature vector and the key feature vector corresponding to each historical user feature cluster in a plurality of preset historical user feature clusters; wherein each historical user feature cluster has a corresponding user type.

[0074] The key feature vector corresponding to each historical user feature cluster in the plurality of preset historical user feature clusters is determined according to the following steps:

[0075] Step a: collecting historical user feature information corresponding to a number of devices in a number of historical time periods to obtain a corresponding historical user feature vector list.

[0076] Step b: clustering the historical user feature vector list to obtain a number of historical user feature clusters.

[0077] Step c, obtaining a key feature vector corresponding to each historical user feature cluster according to all historical user feature vectors in each historical user feature cluster; wherein each feature value in the key feature vector is the average value of the corresponding feature values ​​in all historical user feature vectors in the corresponding historical user feature cluster.

[0078] Here, the classification of several user feature information is obtained according to several historical user feature clustering clusters obtained by clustering the historical user feature information corresponding to several devices in several historical time periods, wherein the matching degree between any two historical user feature information in each historical user feature clustering cluster is less than a preset matching degree threshold, that is, the user feature information in each historical user feature clustering cluster is a class of similar feature information. Each historical user feature clustering cluster can obtain its corresponding key feature vector according to each historical user feature information contained therein, and each feature value in the key feature vector is the average value of the corresponding feature values ​​in all historical user feature vectors in the corresponding historical user feature clustering cluster. The key feature vector is the average vector of the corresponding user feature clustering cluster, which represents the average user feature in the user feature clustering cluster.

[0079] It should be noted that each historical user feature cluster has a corresponding user type. The user type represents the

[0080] Step S3013: determine the user type corresponding to the key feature vector having the highest matching degree with the user feature vector as the user type of the target device corresponding to the program to be detected at the current acquisition time point.

[0081] Here, the higher the matching degree with the user feature vector, the more similar the program installation and usage of the target device are to the corresponding historical user feature clustering clusters during the target time period. At this time, the user type corresponding to the key feature vector with the highest matching degree with the user feature vector is determined as the user type of the target device corresponding to the program to be detected at the current acquisition time point.

[0082] Step S302: According to the preset threshold adjustment coefficient list of the user type corresponding to the current time and the first initial matching rate threshold corresponding to each preset malicious behavior type, a first matching rate threshold corresponding to each preset malicious behavior type is obtained; the number of preset malicious behavior types is m, i=1, 2, ..., m; the first matching rate threshold G corresponding to the i-th preset malicious behavior type is i Meet the following conditions:

[0083] G i =Z ai ×C i

[0084] Among them, Z ai is the preset threshold adjustment coefficient of the i-th preset malicious behavior type corresponding to the user type a corresponding to the current time; C i is the first initial matching rate threshold corresponding to the i-th preset malicious behavior type.

[0085] Since each user type has a preset threshold adjustment coefficient list, the corresponding first matching rate threshold is adjusted according to the corresponding preset threshold adjustment coefficient list.

[0086] It should be noted that if the executable behavior corresponding to the user type of the target device within the target time period may partially overlap with the executable behavior corresponding to a certain preset malicious behavior type mentioned above, at this time, the program to be detected may be a non-malicious program used by the user. At this time, in order to minimize the false detection rate, it is necessary to adjust the corresponding preset threshold according to the preset threshold adjustment coefficient list, that is, to increase the first matching rate threshold of the preset malicious behavior type.

[0087] As an example: if the user type a of the target device in the target time period partially overlaps with some behaviors that the i-th preset malicious behavior type may perform, at this time, the preset threshold adjustment coefficient of user type a for the i-th preset malicious behavior type is set higher than other preset threshold adjustment coefficients. It can be 0.95, and the preset threshold adjustment coefficients of other preset malicious behavior types can be 0.8. That is, the preset threshold adjustment coefficient of the preset malicious behavior type for the user type that may perform some behaviors that partially overlap with some behaviors that a preset malicious behavior type may perform is set higher than that of other preset malicious behavior types that do not overlap. This is to reduce the probability of misjudging non-malicious programs as malicious programs.

[0088] In this embodiment, the user type corresponding to the target device where the program to be detected is located is obtained once at a certain interval, and then the first initial matching rate threshold is adjusted according to the preset threshold adjustment coefficient corresponding to the user type. The specific adjustment method is: the preset threshold adjustment coefficient of a preset malicious behavior type for a user type whose certain behaviors may be partially overlapped with certain behaviors that may be performed by a preset malicious behavior type is set higher than that of other preset malicious behavior types that do not have overlap, so as to reduce the probability of misjudging a non-malicious program as a malicious program.

[0089] In an exemplary embodiment of the present application, if the digital signature is the same as any preset digital signature, the program to be detected is determined to be a non-malicious program, and no behavior restriction is imposed on it.

[0090] In an exemplary embodiment of the present application, after step S200, the method further includes:

[0091] Step S010: If the maximum matching rate is greater than the corresponding second matching rate threshold, the program to be detected is determined to be a malicious program.

[0092] In this embodiment, if the maximum matching rate corresponding to the preset malicious behavior type is greater than the corresponding second matching rate threshold, it means that the program to be detected has certain suspicious behaviors or there is a high possibility that the currently executed behaviors are combined into the preset malicious behavior type. At this time, the above-mentioned program to be detected is directly determined as a malicious program.

[0093] Step S400: If the program to be detected is not a non-malicious program, the behavior corresponding to the program to be detected is restricted according to a restricted behavior list of corresponding preset malicious behavior types.

[0094] Specifically, by restricting corresponding behaviors, the security of the system and related files, programs, etc. is guaranteed.

[0095] like Figure 2 As shown, a device 100 for dynamically managing program permissions based on behavior is provided according to an embodiment of the present application.

[0096] The above-mentioned device 100 for managing program permissions based on behavior dynamics includes:

[0097] The acquisition unit 110 is used to obtain the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed within the target time window every time a preset detection time point is reached, so as to obtain the corresponding behavior feature vector; wherein the end time of the target time window is the current time.

[0098] The matching rate determination unit 120 is used to input the above-mentioned behavior feature vector into a preset classification model to obtain a matching rate between the above-mentioned behavior feature vector and each preset malicious behavior type; wherein each preset malicious behavior type has a corresponding restricted behavior list.

[0099] The program determination unit 130 is configured to determine whether the program to be detected is a non-malicious program according to a preset detection method if the maximum matching rate is greater than the corresponding first matching rate threshold and less than the corresponding second matching rate threshold.

[0100] The behavior restriction unit 140 is used to restrict the behavior corresponding to the program to be detected according to a restricted behavior list of preset malicious behavior types corresponding to the maximum matching rate if the program to be detected is not a non-malicious program.

[0101] An embodiment of the present application further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present application described above in this specification.

[0102] In addition, although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0103] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation method of the present application.

[0104] In an exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided.

[0105] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0106] The electronic device according to this embodiment of the present application is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0107] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one storage device mentioned above, and a bus connecting different system components (including storage devices and processors).

[0108] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0109] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0110] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0111] The bus may represent one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0112] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. This communication may be performed through an input / output (I / O) interface. In addition, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0113] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation method of the present application.

[0114] In an exemplary embodiment of the present application, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present application described in the above "Exemplary Method" section of the present specification.

[0115] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0116] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0117] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0118] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0119] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0120] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0121] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for managing program permissions based on behavior dynamics, characterized in that: Applied to a program to be detected, the program to be detected has a number of corresponding behaviors, each behavior has a corresponding behavior number; the method includes: Every time the preset detection time point is reached, the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed within the target time window are obtained to obtain the corresponding behavior feature vector; wherein the end time of the target time window is the current time; Inputting the behavior feature vector into a preset classification model to obtain a matching rate between the behavior feature vector and each preset malicious behavior type; wherein each preset malicious behavior type has a corresponding restricted behavior list; If the maximum matching rate is greater than the corresponding first matching rate threshold and less than the corresponding second matching rate threshold, determining whether the program to be detected is a non-malicious program according to a preset detection method; If the program to be detected is not a non-malicious program, limiting the behavior corresponding to the program to be detected according to a restricted behavior list of preset malicious behavior types corresponding to the maximum matching rate; The behavior feature vector includes a behavior frequency sub-feature vector and a behavior number sub-feature vector; the behavior frequency sub-feature vector is obtained according to the historical execution times of each behavior; the behavior number sub-feature vector is obtained by the following steps: Get every action executed within the target time window; Arrange the behavior numbers corresponding to each behavior executed within the target time window in the order of execution time to obtain a corresponding initial behavior list; If the number of behaviors executed within the target time window is greater than the number of feature dimensions n preset in the behavior number sub-feature vector, then n corresponding behavior numbers are intercepted from the back to the front in the initial behavior list to obtain the behavior number feature sub-vector; wherein each behavior number in the behavior number feature sub-vector is arranged in the order of execution time; The first matching rate threshold is determined according to the following steps: Every time a preset collection time point is reached, the user type of the target device corresponding to the program to be detected is updated once; wherein each user type has a corresponding preset threshold adjustment coefficient list; the preset threshold adjustment coefficient list includes a preset threshold adjustment coefficient corresponding to each preset malicious behavior type; According to the preset threshold adjustment coefficient list of the user type corresponding to the current time and the first initial matching rate threshold corresponding to each preset malicious behavior type, the first matching rate threshold corresponding to each preset malicious behavior type is obtained; the number of preset malicious behavior types is m, i=1, 2, ..., m; the first matching rate threshold G corresponding to the i-th preset malicious behavior type i Meet the following conditions: G i =Z ai ×C i Among them, Z ai is the preset threshold adjustment coefficient of the i-th preset malicious behavior type corresponding to the user type a corresponding to the current time; C i is the first initial matching rate threshold corresponding to the i-th preset malicious behavior type.

2. The method for managing program permissions based on behavior dynamics according to claim 1, characterized in that: After arranging the behavior numbers corresponding to each behavior executed within the target time window in the order of execution time to obtain a corresponding initial behavior list, the method further includes: If the number of behaviors executed within the target time window is less than the preset number of feature dimensions n of the behavior number sub-feature vector, the preset feature values ​​of the preset number of remaining dimensions are filled after the initial behavior list to obtain the corresponding behavior number sub-feature vector; wherein the preset number of remaining dimensions is the difference between the preset number of feature dimensions and the number of behaviors included in the initial behavior list.

3. The method for managing program permissions based on behavior dynamics according to claim 1, characterized in that: The preset detection methods include: Obtaining a digital signature corresponding to the program to be detected; If the digital signature is different from each preset digital signature, it is determined that the program to be detected is not a non-malicious program.

4. The method for managing program permissions based on behavior dynamics according to claim 1, characterized in that: After inputting the behavior feature vector into a preset classification model to obtain a matching rate between the behavior feature vector and each preset malicious behavior type, the method further includes: If the maximum matching rate is greater than the corresponding second matching rate threshold, the program to be detected is determined to be a malicious program.

5. The method for managing program permissions based on behavior dynamics according to claim 1, characterized in that: The updating of the user type of the target device corresponding to the program to be detected once at each preset collection time point includes: At each preset collection time point, user feature information of the target device corresponding to the program to be detected is obtained to obtain a corresponding user feature vector; wherein the user feature vector includes the total number of programs corresponding to each preset program type and the number of times each preset program type is used in a target time period; the start time of the target time period is the collection time point closest to the current time, and the end time is the current collection time point; Obtaining a matching degree between the user feature vector and a key feature vector corresponding to each historical user feature cluster in a plurality of preset historical user feature clusters; wherein each historical user feature cluster has a corresponding user type; Determine the user type corresponding to the key feature vector with the highest matching degree with the user feature vector as the user type of the target device corresponding to the program to be detected at the current acquisition time point; The key feature vector corresponding to each historical user feature cluster in the plurality of preset historical user feature clusters is determined according to the following steps: Collect historical user feature information corresponding to a number of devices in a number of historical time periods to obtain a corresponding list of historical user feature vectors; Clustering the historical user feature vector list to obtain several historical user feature clusters; According to all historical user feature vectors in each historical user feature cluster, a key feature vector corresponding to each historical user feature cluster is obtained; wherein each feature value in the key feature vector is an average value of corresponding feature values ​​in all historical user feature vectors in the corresponding historical user feature cluster.

6. A device for dynamically managing program permissions based on behavior, used to execute the method for dynamically managing program permissions based on behavior according to any one of claims 1 to 5, applied to a program to be detected, wherein the program to be detected has a number of corresponding behaviors, each behavior having a corresponding behavior number; characterized in that: The device comprises: The acquisition unit is used to acquire the historical execution times of each behavior corresponding to the program to be detected and the behavior number corresponding to the behavior executed within the target time window at each preset detection time point, and obtain the corresponding behavior feature vector; wherein the end time of the target time window is the current time; A matching rate determination unit, used for inputting the behavior feature vector into a preset classification model to obtain a matching rate between the behavior feature vector and each preset malicious behavior type; wherein each preset malicious behavior type has a corresponding restricted behavior list; A program determination unit, configured to determine whether the program to be detected is a non-malicious program according to a preset detection method if the maximum matching rate is greater than a corresponding first matching rate threshold and less than a corresponding second matching rate threshold; The behavior restriction unit is used to restrict the behavior corresponding to the program to be detected according to a restricted behavior list of preset malicious behavior types corresponding to the maximum matching rate if the program to be detected is not a non-malicious program.

7. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 7.

Images