Process running method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a process running method and device, electronic equipment and a storage medium, the method is applied to terminal equipment, and the method comprises the steps that under the condition that the terminal equipment detects a target process used for calling a target application program, an executable file corresponding to the target application program is obtained; and under the condition that the executable file comprises the security tag, running the target process to start the target application program. According to the process running method, the detection efficiency of the target application program is improved, and the detection time and the overhead of system resources are saved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a process running method, device, electronic device and storage medium. Background Art

[0002] Currently, most computer data is often stored on servers based on Linux systems. However, vulnerabilities in some servers can leak stored private data. To protect this private data, security software needs to be deployed on the servers for protection.

[0003] Mainstream security software mainly performs security protection by globally detecting running processes or detecting all files in the server system. In the former, harmful processes may have been running for a period of time before being detected by the monitoring software, and its monitoring timeliness is poor. In the latter, a large amount of system resources are occupied, thus affecting the performance of the server. How to balance the relationship between system process security detection and system resource overhead has become a major problem in the field of information security. Summary of the invention

[0004] The embodiments of the present application disclose a process running method, device, electronic device and storage medium, which judge the security of the target process by detecting whether the executable file corresponding to the application called by the target process contains a security label. The detection of the security label only requires a small amount of system resources, thereby saving system resources.

[0005] The present application discloses a process running method, which is applied to a terminal device, comprising:

[0006] When a target process for calling a target application is detected, obtaining an executable file corresponding to the target application;

[0007] In a case where the executable file includes a security tag, the target process is run to launch the target application.

[0008] The present application discloses a process running device, comprising:

[0009] A file acquisition module, which acquires an executable file corresponding to the target application when a target process for calling the target application is detected;

[0010] The program processing module runs the target process to start the target application program when the executable file includes a security tag.

[0011] The present application discloses an electronic device, including a memory and a processor, wherein the memory is used to store code instructions; and the processor is used to run the code instructions to implement the method described above.

[0012] The present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program includes instructions for implementing the method described above.

[0013] Compared with the high system resource occupancy rate of existing process security detection technologies, the method provided in the embodiments of the present application can determine the security of the target process by detecting whether the executable file corresponding to the application called by the target process contains a security label, without the need to detect all files in the system. Only a small amount of system resources are needed to detect the security label, thereby saving system overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0015] Figure 1 A schematic diagram of the system architecture provided for an embodiment of the present application;

[0016] Figure 2 A schematic diagram of the interaction between kernel state and user state when intercepting system calls provided in an embodiment of the present application;

[0017] Figure 3 A flowchart of a process operation method provided in an embodiment of the present application;

[0018] Figure 4 A flowchart of obtaining an executable file for a preset main program provided in an embodiment of the present application;

[0019] Figure 5 A flowchart of a preset main program processing a target application program provided in an embodiment of the present application;

[0020] Figure 6 Asymmetric encryption algorithm flow chart provided for the embodiment of the present application;

[0021] Figure 7 A flowchart for detecting the security of an executable file provided in an embodiment of the present application;

[0022] Figure 8 A schematic block diagram of a process running device provided in an embodiment of the present application;

[0023] Fig. 9 A schematic block diagram of a process-running electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0025] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first" and "second" are used to distinguish the same items or similar items with substantially the same functions and effects. For example, the first instruction and the second instruction are to distinguish different user instructions, and their order is not limited. Those skilled in the art can understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit them to be different.

[0026] It should be noted that, in this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0027] In addition, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

[0028] In addition, the terms "including" and "having" and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products, or devices.

[0029] Most of the current servers use the Linux system, because the Linux system, as an open source operating system, has many excellent features and advantages: it has strong self-repair capabilities, can automatically recover when the system fails, reduces the burden of manual maintenance, and has stability and reliability; it is equipped with many security protection functions, such as firewalls, intrusion detection, etc., which can effectively resist various network attacks and has strong security performance; it can be easily expanded and upgraded to meet the growing demand for servers; it has rich software support to meet the needs of different businesses; it supports a variety of file systems and storage methods, can quickly read, write and store data, and improves the processing power of the server. Computer data is often stored in servers, because servers have larger hard disk space than personal devices, and can run 24 hours a day to ensure the continuous availability of data; at the same time, servers have stronger processors and more memory resources, which can process and analyze large amounts of data faster; as the amount of data grows, servers can more easily upgrade hardware or expand storage to adapt to changing needs; servers are usually equipped with data backup solutions to ensure that data can be quickly restored in the event of a failure; servers allow IT administrators to centrally manage data and applications, simplifying the maintenance and update process. Because most data is stored on servers with Linux systems, Trojan processes or virus programs can be implanted on the server through vulnerabilities in the Linux system to steal private data stored on the server. In order to protect the data on the server from unauthorized access, it is necessary to deploy process security detection software on the server for reinforcement and protection.

[0030] In the related art, process security detection software mainly performs security protection by globally detecting running processes or detecting all files in the server system. The former can only detect already running processes during process detection, and cannot prevent the launch of harmful processes, and its monitoring timeliness is poor. The latter's continuous global detection may consume a large amount of system resources, such as CPU and memory, which may affect the performance and response time of the system. At the same time, since the process security detection software occupies a large amount of system resources, the system resources of other system processes are unevenly distributed, thus affecting the stability of the system. Global file detection may access sensitive data, which may cause privacy and compliance issues if not properly controlled.

[0031] The preset main program on the terminal device of the embodiment of the present application, when detecting the target process for calling the target application, obtains the executable file corresponding to the target application; when detecting that the executable file includes a security label, the terminal device runs the target process to start the target application. In particular, the method involved in the embodiment of the present application can detect the security of the target application that the target process wants to call, and judge whether the target application is safe by detecting whether the executable file of the target application contains a security label, and the detection of the security label only requires a small amount of system resources to complete, thereby saving system resource overhead.

[0032] The embodiment of the present application discloses a process running method, device, electronic device and storage medium, which can realize rapid detection and scanning of the process, and only needs to detect whether the executable file corresponding to the target application called by the target process includes a security label to judge the security of the target process, which can save system resources. In order to implement the above method, the system architecture of the terminal device of the embodiment of the present application is first introduced to fully understand the functions of each hardware of the terminal device.

[0033] like Figure 1 As shown, it is a schematic diagram 100 of the system architecture provided in an embodiment of the present application. The system architecture 100 of the terminal device may include components such as a processor 101, a transceiver 102, a memory 103, a sensor 104, a power supply 105, an input unit 106, a display unit 107, an audio circuit 108, a virus scanning module 109, and an encryption module 110. Those skilled in the art can understand that Figure 1 The system architecture shown in the figure does not constitute a limitation of the system, and the system architecture of the terminal device may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0034] The processor 101 is the control center of the main terminal device. It uses various interfaces and lines to connect various parts of the entire main terminal device. By running or executing software programs and / or modules stored in the memory 103, and calling data stored in the memory 103, it executes various functions of the terminal device and processes data, thereby monitoring the terminal device as a whole. Optionally, the processor 101 may include one or more processing units; preferably, the processor 101 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 101.

[0035] In some possible embodiments, the processor 101 includes a pre-written virus scanning module program, and the virus scanning module can be used to scan whether the file carries a virus and obtain the scanned result, which may include the type of virus contained in the file, warning information and scanning log. The virus scanning module can load and update the virus database to ensure the accuracy of the scan. The virus scanning module can be configured to scan a single file, scan multiple files or directories, scan results without displaying a summary, and automate scanning. The scanned data can be saved by the memory 103 for subsequent access. The scan results can be displayed on the display unit 107 in real time or on demand. The memory 103 can cooperate with the virus scanning module to provide a computer virus and Trojan horse retrieval library for the virus scanning module 109. After the encryption module decrypts a piece of data of a specific size at a specific position in the file and finds that it is not a security label, the virus scanning module can scan the file to determine whether the file carries a virus.

[0036] In some possible instances, the processor 101 includes an encryption module program pre-written according to an asymmetric encryption algorithm. The encryption module is used for encryption and decryption of data, and is configured with an asymmetric encryption algorithm. Asymmetric encryption, also known as public key encryption, is an encryption method that uses a pair of keys to perform encryption and decryption operations, and the pair of keys includes a public key and a private key. The public key can be shared publicly with anyone, while the private key must be kept confidential and can only be held by the owner of the key. The algorithm used by the encryption module can be an asymmetric encryption algorithm such as the RSA algorithm, the ECC algorithm, the Diffie-Helllman algorithm, the Elgamal algorithm, etc. Preferably, the encryption module uses the Elgamal algorithm.

[0037] The transceiver 102 can be used for receiving and sending signals during information transmission or calls. In particular, after receiving the information from the server, it is sent to the processor 101 for processing; in addition, the information is sent to the server. Generally, the transceiver 102 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the transceiver 102 can also communicate with the network and other devices through wireless communication. The above wireless communication can use any communication standard or protocol, including but not limited to the global system of mobile communication (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), long term evolution, email, short messaging service (SMS), etc.

[0038] The memory 103 can be used to store software programs and modules. The processor 101 executes various functional applications and data processing of the electronic device by running the software programs and modules stored in the memory 103. The memory 103 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the electronic device (such as audio data, a phone book, etc.), etc. In addition, the memory 103 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0039] Sensor 104 may be a light sensor, a motion sensor, or other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display unit 107 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel and / or backlight of the display unit 107 when the main terminal device is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, and can be used for applications that identify the posture of terminal electronic devices (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can also be configured in the main terminal device, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0040] The system architecture of the terminal device also includes a power supply 105 (such as a battery) for supplying power to each component. Preferably, the power supply can be logically connected to the processor 101 through a power management system, so that functions such as charging, discharging, and power consumption management can be managed through the power management system.

[0041] The input unit 106 may be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the main terminal device. Specifically, the input unit 106 may include one or more of a touch screen, a touch detection device and a touch controller, a physical keyboard, a function key (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, etc.

[0042] The display unit 107 can be used to display information input by the user or information provided to the user and various menus of the main terminal device. The display unit 107 may include a display panel configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Figure 1 In the embodiment, the input unit 106 and the display unit 107 are used as two independent components to implement the input and output functions of the main terminal device, but in some embodiments, the input unit 106 and the display unit 107 can be integrated to implement the input and output functions of the main terminal device.

[0043] The audio circuit 108 can provide an audio interface between the user and the terminal device. The audio circuit 108 can convert the received audio data into an electrical signal, and then convert it into a sound signal for output by the speaker; on the other hand, the microphone converts the collected sound signal into an electrical signal, which is received by the audio circuit 108 and converted into audio data, and then the audio data is output to the processor 101 for processing, and then sent to another server through the transceiver 102, or the audio data is output to the memory 103 for further processing.

[0044] Through the introduction of hardware such as the terminal device system architecture, we can understand the functions of each component of the terminal device. At the software level, in order to implement the above method, we first need to intercept the system call function of the target process to start the target application.

[0045] like Figure 2 As shown, a schematic diagram 200 of the interaction between kernel state and user state when intercepting system calls provided in an embodiment of the present application, the schematic diagram 200 of the interaction between kernel state and user state may include user state 201, kernel state 202, target process 203, system call 204, system call table 205, interception function 206, PID 207, absolute path 208, device file 209 and process detection program 210.

[0046] In some possible embodiments, user state 201 is also referred to as user mode, which refers to the running state of the application. In this mode, the target process 203 has limited system resource access rights and can only run in a specific space defined by the operating system. Programs running in user state 201 cannot directly access hardware devices or execute privileged instructions, and all access to hardware must be performed through the operating system. In user state 201, the application requests services provided by the operating system through system calls 204. For example, file operations, network communications, etc. all need to be implemented through system calls 204. When the application issues a system call 204, a context switch is triggered, and the control of the CPU is handed over to the operating system kernel to enter kernel state 202.

[0047] In some possible embodiments, kernel state 202 is also referred to as kernel mode or privileged mode, which is the running state of the operating system kernel. The CPU in kernel state 202 can execute all instructions, access all memory addresses, and has the highest authority. The target process 203 running in kernel state 202 can access all resources of the system, including CPU, memory, input / output, etc. In kernel state 202, the operating system can respond to all interrupt requests, process hardware events and system calls 204. When the target process 203 issues a system call, the CPU will switch to kernel state 202, perform the corresponding operation, and then return to user state 201. In addition, when a serious error or exception occurs, the switch of kernel state 202 will also be triggered.

[0048] In some possible embodiments, the target process 203 consists of three parts: a process control block, a program segment, and a data segment. The system perceives the existence of the process through the existence of the process control block; the program segment is used to describe the function to be completed by the process and is an instruction set for controlling the execution of the process; the data set is the data and workspace required by the program when it is executed. The system manages and schedules the process through the process control block. The process control block includes creating a process, executing a program, exiting a process, and changing the priority of a process. The process control block in the process is represented by a structure called task_struct, which is defined in include / linux / sched.h. Whenever a new process is created, an empty task_struct structure is applied in the memory and filled with the required information. At the same time, a pointer to the structure is also added to the task array, and all process control blocks are stored in the task[] array. The target process 203 is a process of dynamic execution of a program with certain independent functions on a data set. It is an independent unit for resource allocation and scheduling by the operating system and a carrier for the operation of the target application.

[0049] In some possible embodiments, system call 204 is an interface provided by the operating system to the user space program, which allows the target process 203 to request the service of the operating system. System call 204 is a bridge between user state 201 and kernel state 202 (the core part of the operating system), enabling user programs to access protected kernel functions such as file operations, process control, communication, and memory management. Through system call 204, the operating system can control access to hardware and system resources to prevent user programs from directly operating resources that may affect system stability. System call 204 is usually implemented in the operating system kernel and mapped to a specific function or instruction. The operating system maintains a system call table 205, which maps the system call number to the corresponding processing function in the kernel. The parameters of system call 204 are usually passed to the kernel through registers or stacks.

[0050] In some possible embodiments, the system call table 205 is an important component in the operating system kernel. It is a special data structure for mapping the index or name of the system call to the corresponding processing function in the kernel. When a program in the user space needs to request an operating system service, it will do so through the system call table. The system call table 205 is usually an array or a hash table, which contains pointers to functions that implement system calls in the kernel. By modifying the system call table 205 and replacing the function address, a certain system call can be redirected to a custom function, and the system call hijacking can be completed.

[0051] In some possible embodiments, the interception function 206 is designed to obtain the process identifier PID 207 of the target process 203. The interception function 206 is located in the kernel state 202 and redirects the result after modifying the function address of the system call table 205. The interception function 206 is executed before the original system call is triggered, and uses the API provided by the kernel, such as the current macro, to obtain the pointer of the target process 203, and extract information such as the process identifier PID 207 from it.

[0052] In some possible embodiments, the system defines a non-negative integer that uniquely identifies each process, called a process identifier, or PID 207. PID 207 is used to reference a process, and the operating system and the user can manage and control the process through PID 207, such as starting, stopping, or querying the process status. The operating system uses PID 207 to track and manage resources allocated to the process, such as memory, file descriptors, and input / output operations. PID 207 is usually associated with scheduling information, and the scheduler of the operating system uses PID to determine which process gets CPU time. In the Linux operating system, the ps command can be used to obtain and view a list of processes.

[0053] In some possible embodiments, the absolute path 208 is a complete path starting from the root directory in the file system hierarchy, which specifies the exact location from the root directory to the target file or directory. In Linux systems, the root directory is represented by a forward slash ( / ). In Windows systems, the absolute path can start with a drive letter, such as C:\ or D:\, and then follow the file system path under the drive letter.

[0054] In some possible embodiments, the device file 209 is a special type of file in the Linux operating system, which represents the device in the system. Device files are usually used to access hardware devices, such as keyboards, mice, hard disks, network interfaces, etc. In Linux systems, character device files are used to sequentially access devices, such as terminals, serial ports, etc. Character device files are in the / dev directory, and the file names usually begin with c. Device files allow users to interact with devices through standard file operations, such as reading, writing, etc. They provide a unified interface for device drivers, allowing applications to access different types of devices in the same way.

[0055] In some possible embodiments, the process detection program 210 contains an encryption module, a virus scanning module and a program processing module. After obtaining the absolute path of the target application, the process detection program 210 opens the executable file of the target application and finds part of the data located at a specific position in the executable file. Optionally, the data can be a piece of data with a size of 4KB located at the beginning of the executable file, a piece of data with a comment symbol and a size of 2KB located on the second line of the executable file, or a piece of data with a size of 8KB located at the end of the executable file. Preferably, the process detection program 210 obtains the 4KB data at the end of the executable file, decrypts the data using the encryption module, determines whether the executable file carries a virus using the virus scanning module, and finally calls the program processing module to process the executable file according to the scanning result.

[0056] In one possible embodiment, the target process 203 running in the user state 201 starts the target application through the system call 204, and the system call 204 is the execve function, which is used to execute a new program in the context of the current process. The kernel state 202 detects the system call request, searches the system call table 205 according to the system call number of the execve function to obtain the corresponding sys_execve function pointer, writes the interception function 206 of the kernel module, and modifies the sys_execve function pointer in the system call table 205 to point to the interception function 206. When the kernel state executes the sys_execve function of the system call 204, it will redirect the execution of the interception function 206. The interception function 206 can use the API provided by the kernel, such as the current macro, to obtain the pointer of the target process 203, and obtain the PID 207 of the target process 203 therefrom, and obtain the absolute path 208 of the executable file corresponding to the target application according to the PID 207 of the target process 203. In the kernel state 202, a device file 209 can be registered in the / dev directory by using the register_chrdev function. The process detection program 210 can read the device file 209 to obtain the absolute path 208 of the executable file intercepted by the kernel state 202 interception function 206. The process detection program 210 opens the executable file corresponding to the target application through the absolute path 208, obtains a piece of data with a size of 4KB at the end of the executable file, calls the encryption module to decrypt the data, and if the decrypted data matches the security label, executes the execve function of the system call 204 to start the target application; if the decrypted data does not match the security label, the process detection program 210 calls the virus scanning module to scan whether the executable file carries a virus. If the executable file is detected to be safe, a security label with a size of 4KB is added to the end of the executable file after one end encryption, and the execve function of the system call 204 is executed to start the target application; if the virus scanning module detects that the executable file carries a virus, the process detection program 210 deletes the executable file and closes the target process 203.

[0057] By rewriting the kernel module to intercept the system calls of the target process, the security of the executable file of the target application can be analyzed before the target process starts the target application, instead of detecting the security of the process after the program is started, thereby improving the real-time performance of process detection and further reducing the threat of harmful processes to the system.

[0058] After understanding how the kernel state and the user state interact in the embodiment of the present application, the flowchart of the process running method is introduced next. By introducing the flowchart 300 of the process running method of the embodiment of the present application, you can intuitively understand how the various hardware of the terminal device work together.

[0059] like Figure 3 As shown, a flowchart 300 of a process running method provided in an embodiment of the present application is provided, and the software architecture is used as an example for introduction. The method includes the following steps:

[0060] S301, when a target process for calling a target application is detected, obtaining an executable file corresponding to the target application.

[0061] In some possible embodiments, the target process needs to execute a new program, namely the target application, through the execve function of the system call. The kernel state detects the system call request of the user state, and searches the system call table according to the system call number of the execve function to obtain the corresponding sys_execve function pointer. The pointer corresponding to the system call number of the execve function in the system call table is modified to point to the interception function in the kernel module written in advance. The interception function can use the API provided by the kernel, such as the current macro, to obtain the pointer of the target process, and then obtain the process identifier PID of the target process, and obtain the absolute path of the executable file corresponding to the target application according to the process identifier.

[0062] In some possible embodiments, in kernel state, a character device file can be registered in the / dev directory by using the register_chrdev function for data exchange between kernel state and user state. The preset main program in user state can obtain the absolute path of the executable file of the target application in kernel state through the character device file.

[0063] S302: When the executable file includes a security tag, run the target process to start the target application.

[0064] In some possible embodiments, the preset main program in user mode can open the executable file according to the absolute path and obtain a fixed-size data segment located at a specific position in the executable file. The preset main program decrypts the data using the private key of the asymmetric encryption algorithm and compares the decryption result with the security label. If the decryption result matches the security label, it indicates that the executable file has been scanned by the virus detection module before, the scan result is safe, and the preset main program adds an encrypted security label. The encrypted security label is obtained by encrypting the security label using the public key generated by the same asymmetric encryption algorithm.

[0065] Exemplarily, the preset main program obtains a segment of data with a size of 4 KB at the head of the executable file as a security label to be decrypted.

[0066] Exemplarily, the preset main program obtains a segment of data with a comment symbol and a size of 2KB in the second line of the executable file as a security label to be decrypted.

[0067] Exemplarily, the preset main program obtains a segment of data at the end of the executable file with a size of 8 KB as a security label to be decrypted.

[0068] Exemplarily, the asymmetric encryption algorithm selects the ElGamal algorithm, which is based on the difficulty of the discrete logarithm problem. The principle it is based on is that it is difficult to solve the discrete logarithm, but its inverse operation can be effectively calculated by applying the square multiplication method. The ElGamal algorithm generates a pair of keys including a public key and a private key based on the discrete logarithm problem. The public key is used to encrypt the security label, and the private key is used to decrypt a piece of data of the executable file selected by the preset main program to determine whether the decryption result matches the security label.

[0069] Exemplarily, the asymmetric encryption algorithm is the RSA algorithm, which is based on a number theory fact: it is very easy to multiply two large prime numbers, but it is extremely difficult to factorize the product, so the product can be made public as an encryption key. The RSA algorithm generates a pair of keys including a public key and a private key based on the factorization problem of the result of multiplying two large prime numbers. The public key is used to encrypt the security label, and the private key is used to decrypt a piece of data of the executable file selected by the preset main program to determine whether the decryption result matches the security label.

[0070] Exemplarily, the asymmetric encryption algorithm is an ECC algorithm, which is based on the elliptic curve discrete logarithm problem. The ECC algorithm generates a pair of keys based on the elliptic curve, including a public key and a private key. The public key is used to encrypt the security label, and the private key is used to decrypt a segment of data of an executable file selected by the preset main program to determine whether the decryption result matches the security label.

[0071] The asymmetric encryption algorithm may be any asymmetric encryption algorithm with relatively high security, that is, an algorithm using different keys for encryption and decryption, and this embodiment does not specifically limit this.

[0072] Exemplarily, the safety tag is a freely defined English phrase, such as "SafeTay", "safetay" or "SAFETAG", etc., which is not specifically limited in this embodiment.

[0073] In some possible embodiments, if the decryption result matches the security label, the preset main program determines that the executable file has been scanned by the virus detection module before and the scan result is safe, and a security label is added. Therefore, the executable file is no longer detected and the executable file is directly run to start the target program and run the target process.

[0074] If the decryption result does not match the security label, the preset main program calls the virus detection module to scan the executable file. The preset main program will load the virus library and scan the executable file for viruses. If the executable file does not carry viruses, the preset main program will detect whether the target process is a malicious process and connected to an illegal network address. If the target process is also safe after detection, the preset main program uses the public key generated by the asymmetric encryption algorithm to encrypt the security label, and add the encrypted security label to the specific location, run the executable file to start the target program and run the target process. The size of the encrypted security label corresponds to the size of a piece of data located at a specific location in the executable file obtained by the preset main program. If the virus detection module detects that the executable file carries a virus or detects that the target process is a malicious process or is connected to an illegal network address, the executable file is deleted and the target process is closed.

[0075] Exemplarily, the encrypted security tag has a size of 4 KB and is added to the header of the executable file.

[0076] Exemplarily, the encrypted security label has a size of 2 KB and is added to the top or end of the second line of the executable file after setting the comment symbol.

[0077] Exemplarily, the encrypted security tag has a size of 8 KB and is added to the end of the executable file.

[0078] Exemplarily, the asymmetric encryption algorithm used to encrypt the security tag is consistent with the asymmetric encryption algorithm used to decrypt a segment of data of a specific size located in an executable file. The asymmetric encryption algorithm may be an ElGamal algorithm, an RSA algorithm, or an ECC algorithm. The asymmetric encryption algorithm generates a pair of keys including a public key and a private key, the public key is used to encrypt the security tag, and the private key is used to decrypt a segment of data of an executable file selected by a preset main program to determine whether the decryption result matches the security tag.

[0079] By detecting whether the corresponding executable file includes a security label before the target application is started, detection time can be saved, repeated file detection and excessive system resource occupation can be avoided, and the running of harmful processes can be prevented, and the real-time performance of process detection is high.

[0080] Through the above steps, we can understand the general framework of the execution steps of the embodiment of the present application. The following is a detailed description of the steps of obtaining the executable file by the preset main program. Figure 4 As shown, it is a flowchart 400 of obtaining an executable file by a preset main program provided in an embodiment of the present application.

[0081] S401, the user-mode target process calls the target application.

[0082] In some possible embodiments, the target process is created by a process that already exists in other systems, the newly created target process is a child process, and the process that creates the target process is a parent process. In order to copy a child process in a parent process, the Linux system provides a system call fork(). The entity that represents a process in the Linux system is the process control block. The main task of creating a new process is to create a new control block, and the simplest way to create a new control block is to copy. In order to load and run an executable file during program operation, Linux provides a system call execv() function to execute the target application. The target process calls the execv() function, which loads the executable file specified by the function parameter path into the user memory space of the process, overwrites the original file, and then runs the newly loaded executable file.

[0083] S402, intercepting the system call function in kernel state to obtain process information of the target process.

[0084] In some possible embodiments, when the target process in user state executes a request system call, the CPU will switch from user state to kernel state, and search the kernel state system call table according to the system call number of the system call function fork() and execv() in the user state to obtain the corresponding sys_fork() and sys_execv() function pointers, and the pointers of the sys_fork() and sys_execv() functions are modified and redirected to a pre-written kernel module interception function, which can obtain the pointer of the target process through the API provided by the kernel, such as the current macro, and then obtain the process identifier PID of the target process through the pointer.

[0085] S403, the kernel-mode interception function obtains the absolute path of the target application according to the process information.

[0086] In some possible embodiments, for each process, the / proc file system provides a symbolic link / proc / [PID] / exe pointing to its executable file. This symbolic link points to the actual path of the executable file of the process in the file system. The kernel-mode interception function can obtain the path of the executable file by reading the / proc / [pid] / exe symbolic link. This usually involves calling a function provided by the kernel to parse and read the symbolic link.

[0087] S404, the user-mode preset main program obtains the absolute path by reading the kernel-mode device file.

[0088] In some possible embodiments, a device file can be registered in the kernel state in the / dev directory by using the register_chrdev function for exchanging data between the kernel state and the user state. The preset main program in the user state uses the read() function to read the kernel state device file, thereby obtaining the executable file of the target application.

[0089] S405, the user mode preset main program opens the executable file of the target application according to the absolute path.

[0090] In some possible embodiments, the absolute path is a complete path starting from the root directory in the file system hierarchy, which specifies the exact location from the root directory to the target file or directory. The preset main program in the user state can locate the location of the executable file in the file system through the absolute path of the executable file, and then open the executable file.

[0091] By modifying the kernel module system call registry and writing the interception function, the relevant information of the target process and the executable file corresponding to the target application can be obtained in time before the target process calls the target application. These steps are sufficient preparations for further detection of the executable file and avoid the operation of harmful processes, which improves the security of the system to a certain extent. After obtaining the executable file of the target application, the security detection of the executable file is then performed.

[0092] like Figure 5 As shown, it is a flowchart 500 of a preset main program processing a target application program provided in an embodiment of the present application.

[0093] S501, obtaining part of the data located at a specific location in the executable file of the target application.

[0094] Exemplarily, the preset main program obtains a segment of data with a size of 4 KB at the head of the executable file as a segment of data.

[0095] Exemplarily, the main program is preset to obtain a segment of data with a comment symbol and a size of 2KB in the second line of the executable file.

[0096] Exemplarily, the preset main program obtains a segment of data at the end of the executable file and having a size of 8 KB as the segment of data to be decrypted.

[0097] S502: Decrypt the portion of data using a preset decryption algorithm to obtain decrypted content.

[0098] Exemplarily, the preset decryption algorithm is the ElGamal algorithm, which is based on the difficulty of the discrete logarithm problem. The principle on which it is based is that it is difficult to solve the discrete logarithm, while its inverse operation can be effectively calculated by applying the square multiplication method. The preset main program decrypts the partial data according to the private key generated by the ElGamal algorithm to obtain the decrypted content.

[0099] Exemplarily, the preset decryption algorithm is the RSA algorithm, which is based on a number theory fact: it is very easy to multiply two large prime numbers, but it is extremely difficult to factorize their product, so the product can be made public as an encryption key. The preset main program decrypts the partial data according to the private key generated by the RSA algorithm to obtain the decrypted content.

[0100] Exemplarily, the preset decryption algorithm is an ECC algorithm, which is based on the elliptic curve discrete logarithm problem. The preset main program decrypts the partial data according to the private key generated by the ECC algorithm to obtain the decrypted content.

[0101] In some possible embodiments, the preset algorithm may be any asymmetric encryption algorithm with relatively high security, that is, an algorithm that uses different keys for encryption and decryption, which is not specifically limited in this embodiment.

[0102] S503, determining whether the decrypted content matches the security tag.

[0103] In some possible embodiments, the preset main program uses a private key generated by a preset asymmetric encryption algorithm to decrypt a section of data located at a specific location in the executable file, and determines whether the decryption result is the same as the security label, thereby determining whether the executable file has been detected and an encrypted security label has been added.

[0104] S504, run the target process and start the target application.

[0105] In some possible embodiments, if the content obtained by decrypting a piece of data at a specific position in the executable file using a private key generated by an asymmetric encryption algorithm is the same as the preset security label, it indicates that the executable file has been detected and an encrypted security label has been added. The executable file is safe, and the preset main program does not need to perform a secondary detection on the executable file, and can directly start the executable file, run the target process and start the target application.

[0106] S505: Check whether the executable file is safe.

[0107] In some possible embodiments, if the content obtained by decrypting a piece of data located at a specific position in the executable file using a private key generated by an asymmetric encryption algorithm is different from the preset security label, it indicates that the executable file has been detected, and the preset main program calls the virus detection module to detect whether the executable file carries a virus. The preset main program is installed with the ClamAV virus detection tool. Before detecting whether the executable file carries a virus, the preset main program uses the freshclam command to update the virus database. The preset main program calls the clamscan command to scan the executable file and obtain the scanning result, and determines whether the executable file is safe according to the scanning result.

[0108] S506: Add the security tag to the specific location of the executable file.

[0109] In some possible embodiments, if the scan result obtained by the virus detection module after scanning the executable file is safe, the preset main program encrypts the security label by using a preset encryption algorithm and adds the encrypted security label to a specific location of the executable file. When the preset main program detects that the executable file does not pose a security threat, it starts the executable file, runs the target process and starts the target application. The preset encryption algorithm is the same as the preset decryption algorithm in step S502, and the specific location of the encrypted security label added to the executable file is the same as the specific location in the executable file in step S501.

[0110] Exemplarily, the encrypted security tag has a size of 4 KB and is added to the header of the executable file.

[0111] Exemplarily, the encrypted security label has a size of 2 KB and is added to the top or end of the second line of the executable file after setting the comment symbol.

[0112] Exemplarily, the encrypted security tag has a size of 8 KB and is added to the end of the executable file.

[0113] Exemplarily, the preset encryption algorithm is the ElGamal algorithm, which is based on the difficulty of the discrete logarithm problem. The principle on which it is based is that it is difficult to solve the discrete logarithm, while its inverse operation can be effectively calculated by applying the square multiplication method. The preset main program encrypts the security label according to the public key generated by the ElGamal algorithm to obtain an encrypted security label.

[0114] Exemplarily, the preset encryption algorithm is the RSA algorithm, which is based on a number theory fact: it is very easy to multiply two large prime numbers, but it is extremely difficult to factorize their product, so the product can be made public as an encryption key. The preset main program encrypts the security label according to the public key generated by the RSA algorithm to obtain an encrypted security label.

[0115] Exemplarily, the preset encryption algorithm is an ECC algorithm, which is based on the elliptic curve discrete logarithm problem. The preset main program encrypts the security label according to the public key generated by the ECC algorithm to obtain an encrypted security label.

[0116] In some possible embodiments, the preset algorithm may be any asymmetric encryption algorithm with relatively high security, that is, an algorithm that uses different keys for encryption and decryption, which is not specifically limited in this embodiment.

[0117] S507: close the target process and delete the executable file.

[0118] In some possible embodiments, if the scan result obtained by the virus detection module after scanning the executable file is unsafe, that is, the detection result shows that the executable file carries a virus or the target process is a harmful process or the target process is connected to an illegal network address, the preset main program controls the deletion of the executable file and closes the target process.

[0119] The above steps determine whether the executable file needs to be tested by detecting whether the target application includes a security label, which reduces the number of repeated tests on the same executable file and saves system overhead and time. By adding a security label to the executable file that has been tested, the executable file can be directly tested before the target process runs the target application to determine whether it carries a security label to preliminarily determine whether the executable file is safe, greatly improving the detection efficiency. In the above steps, an asymmetric encryption algorithm is used to decrypt a piece of data located at a specific location in the executable file corresponding to the target application and to encrypt the security label. In order to better understand the principle of the asymmetric encryption algorithm, key generation and encryption and decryption processes are described below. An asymmetric encryption algorithm is introduced.

[0120] like Figure 6 The asymmetric encryption algorithm flow chart 600 provided by the embodiment of the present application. The encryption process and decryption process of the asymmetric encryption algorithm use different keys. Flow chart 600 introduces the principle of the asymmetric encryption algorithm using the ElGamal algorithm as an example, including key generation, encryption process and decryption process.

[0121] S601-S604 are steps for generating private keys and public keys.

[0122] S601, Select a large prime number p.

[0123] In some possible embodiments, a prime number refers to a natural number that has only two positive divisors, 1 and itself. With the improvement of computing power and different application scenarios, the criteria for large prime numbers may vary. In cryptography, large prime numbers are used to generate key pairs, and these prime numbers usually have hundreds of digits or even more to ensure the security of encryption.

[0124] Exemplarily, the large prime number p can be 104711, 104717, or 104729, and this embodiment does not make specific limitations.

[0125] S602, Select a generator g of p.

[0126] In a possible embodiment, for the prime number p, if there exists a positive integer 1 < g < p such that g 1 , g 2 , g 3 ,..., g p-1 modulo p takes on all the integers of 1, 2,..., p - 1, then g is called a primitive root of p, that is, a generator. For the modulo operation AmodB, it is to find the remainder obtained by dividing A by B.

[0127] Exemplarily, for the prime number 7, there is 5 1 mod7 = 5, 5 2 mod7 = 4, 5 3 mod7 = 6, 5 4 mod7 = 2, 5 5 mod7 = 3, 5 6 mod7 = 1, then 5 is a generator of the prime number 7.

[0128] S603, Select a random integer x as the private key.

[0129] In a possible embodiment, the value of the private key x is 1 < x < p - 1.

[0130] Exemplarily, if p = 37, then the private key x can be 5.

[0131] S604, Calculate the public key A = g x modp.

[0132] Exemplarily, taking p = 37, g = 2, x = 5, then there is A = 2 5 mod37 = 32.

[0133] S605 - S607 are the encryption process for the plaintext M.

[0134] S605, Select a random integer k.

[0135] In some possible embodiments, 1 <k<p-1。

[0136] For example, p=37, and k can be 7.

[0137] S606, calculate C1=g k modp,C2=M·A k modp.

[0138] In some possible embodiments, the plaintext M is encrypted using the generated public key A and the random number k.

[0139] S607, obtain the encrypted ciphertext (C1, C2).

[0140] S608-S610 is the decryption process of the ciphertext (C1, C2).

[0141] S608, calculate key K = (C1) x modp.

[0142] S609, calculate the inverse element K of the key K -1 .

[0143] In some possible embodiments, for the inverse element K -1 There is K.K -1 =1modp.

[0144] S610, decrypt plaintext M=C2·K -1 modp.

[0145] In some possible embodiments, the ciphertext (C1, C2) is decrypted using the private key x to obtain the plaintext M.

[0146] The execution flow of the algorithm is described below through two embodiments.

[0147] For example, if the prime number p=19, the generators are {2, 3, 10, 13, 14, 15}, and the generator g=10 is selected.

[0148] Key generation: select private key x=5, calculate A=10 5 mod19=3;

[0149] Encryption: Take plaintext M = 17, take random number k = 6, then C1 = g k modp=10 6 mod19=11,C2=M·A k modp=17×3 6 mod19 = 5. The ciphertext is (C1, C2) = (11, 5).

[0150] Decryption: Calculate K = (C1) x modp=11 5 mod19=7, calculate K -1 For 7 -1 mod19=11, we get the plain text M=C2·K -1 modp=5×11mod19=17.

[0151] Exemplarily, take the prime number p=37 and the generator g=2.

[0152] Key generation: select private key x=5, calculate A=2 5 mod37=32;

[0153] Encryption: Take plaintext M = 29, take random number k = 7, then C1 = g k modp=2 7 mod37=17,C2=M·A k modp=29×32 7 mod37=33. The ciphertext is (C1, C2)=(17, 33).

[0154] Decryption: Calculate K = (C1) x modp=17 5 mod37=19, calculate K -1 For 19 -1 mod37=2, and we get the plain text M=C2·K -1 modp=33×2mod37=29.

[0155] As an asymmetric encryption algorithm, the Elgamal algorithm has different encryption keys and decryption keys. Since the Elgamal algorithm is based on the difficulty of discrete logarithm problems, its security is guaranteed and cannot be broken by attackers. By using different keys to decrypt a piece of data at a specific location in the executable file and encrypt the security label, it can prevent attackers from inferring the encryption algorithm based on the executable file including the security label and forging the security label in the executable file containing the virus, further improving the security and confidentiality of the process detection method.

[0156] After decrypting a piece of data at a specific location of an executable file of a target application using an asymmetric encryption algorithm, if the decryption result does not contain a security label, the security of the executable file needs to be checked.

[0157] like Figure 7 As shown, a flowchart 700 for detecting the security of an executable file provided in an embodiment of the present application is provided.

[0158] S701, load the ClamAV antivirus module.

[0159] In a possible embodiment, if the preset main program detects that the executable file corresponding to the target application does not include a security label, it is necessary to call a virus detection module to detect whether the executable file carries a virus. The preset main program first loads the ClamAV antivirus module and configures parameters of the clamd.conf configuration file located at / etc / clamav / clamd.conf, such as setting the location of the database and the scanning options.

[0160] S702, update the virus database.

[0161] In a possible embodiment, the main program is preset to use the command freshclam to update the virus database of the ClamAV module.

[0162] S703, scan the executable file and process the scan result.

[0163] In a possible embodiment, the preset main program uses the clamscan command to scan the executable file and display the scan result. If the executable file in the scan result carries a virus, the preset main program directly deletes the executable file.

[0164] S704: Check whether the target process has opened a listening port according to the PID of the target process.

[0165] In some possible embodiments, the preset main program runs the netstat-antlp command to check whether there are unauthorized listening ports on the server, and detects whether the PID of the corresponding target process has opened an unauthorized listening port. Malicious processes often open listening ports and connect to illegal external network addresses. If the preset main program detects that the PID of the corresponding target process has opened an unauthorized listening port, the target process is considered to be an illegal process, the target process is closed, and the application corresponding to the target process is deleted.

[0166] S705: Use a system monitoring tool to determine whether the running status of the target process is normal.

[0167] In some possible embodiments, the preset main program uses the top or htop command to monitor the running status of the system process in real time, and obtain the CPU and memory usage of the target process. If it is detected that the target process occupies a large amount of system CPU or memory resources, the target process is considered to be a malicious process.

[0168] S706, checking the log file of the target process to determine whether the target process is running normally.

[0169] In some possible embodiments, the preset main program checks the log file of the target process in the / var / log directory, and determines whether the running state of the target process is normal by analyzing the content in the log file. If the preset main program detects that the target process occupies a large amount of CPU or memory resources and detects that the target process is running in an abnormal state through the log file corresponding to the target process, the target process is determined to be a malicious process, the target process is closed, and the application corresponding to the target process is deleted.

[0170] The above steps detect the security of the executable files and target processes corresponding to the target application from multiple dimensions such as virus detection, port detection, system resource usage detection, and process log detection, thereby minimizing the false detection rate of the preset main program on the security of the executable files and target processes corresponding to the target application, thereby avoiding the operation of executable files carrying viruses and the continuous harm to the system by malicious processes, and further improving the security of the system.

[0171] In order to implement the above-mentioned method, some functional modules are indispensable for the terminal device. The following description of the device embodiment is similar to the description of the above-mentioned method embodiment and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding. Figure 8 As shown, it is a schematic block diagram of a process running device 800 provided in an embodiment of the present application. The device 800 may include a file acquisition module 801 and a program processing module 802.

[0172] The file acquisition module 801 acquires the executable file corresponding to the target application when a target process for calling the target application is detected.

[0173] In some possible embodiments, the file acquisition module 801 includes a kernel-mode interception function for intercepting the execv() system call function of the target process and obtaining the PID of the target process and the absolute path of the executable file of the target application to be started.

[0174] In some possible embodiments, the file acquisition module 801 includes a kernel-mode device file for exchanging data between the kernel mode and the user mode.

[0175] In some possible embodiments, the file acquisition module 801 acquires the absolute path of the executable file corresponding to the target application through the device file, and opens the executable file according to the absolute path.

[0176] The program processing module 802 runs the target process to start the target application program when the executable file includes a security tag.

[0177] In some possible embodiments, the program processing module 802 may use an asymmetric encryption algorithm to decrypt a piece of data located at a specific location in the executable file corresponding to the target application to obtain a decryption result.

[0178] In some possible embodiments, the program processing module 802 may determine whether the executable file has been security checked according to whether the decryption result includes a security tag.

[0179] In some possible embodiments, the program processing module 802 includes loadable virus detection software to detect the security of the target application.

[0180] In some possible embodiments, the program processing module 802 may use an asymmetric encryption algorithm to encrypt the security tag and add the encrypted security tag to a specific location of the executable file.

[0181] In some possible embodiments, when the program processing module 802 detects that the executable file corresponding to the target application is unsafe or the target process is a malicious process, it executes a command to delete the executable file and close the target process.

[0182] like Fig. 9 , which is a schematic block diagram of a process-running electronic device 900 provided in an embodiment of the present application. The electronic device 900 may include a processor 901 , a memory 902 , a communication interface 903 and a bus 904 .

[0183] Among them, the processor 901 calls the executable program code stored in the memory 902 to execute any process running method disclosed in the embodiments of the present application.

[0184] The memory 902 stores executable program code, which is executed by the processor 901 to implement any process running method disclosed in the embodiments of the present application.

[0185] The communication interface 903 is connected to the bus 904 and is used to connect the processor 901 and the memory 902 with external input and output devices such as a printer, a scanner, a keyboard, a mouse, etc.

[0186] The bus 904 is used to transfer the program code data stored in the memory 902 to the processor 901 for execution.

[0187] Optionally, the memory 902 may include a read-only memory and a random access memory, and provide instructions and data to the processor 901. A portion of the memory 902 may also include a non-volatile random access memory. For example, the memory 902 may also store information about the device type. The processor 901 may be used to execute the instructions stored in the memory, and when the processor executes the instructions, the processor 901 may execute the various steps and / or processes corresponding to the terminal device in the above method embodiment.

[0188] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0189] It should be noted that Fig. 9 The electronic device 900 shown may also include a power supply, input buttons, a camera, a speaker, a screen, an RF circuit, a Wi-Fi module, a Bluetooth module and other components not shown, which are not described in detail in this embodiment.

[0190] This embodiment discloses a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute any one of the process running methods disclosed in the embodiments of the present application.

[0191] An embodiment of the present application discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute any one of the process running methods disclosed in the embodiment of the present application.

[0192] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor executes the instructions in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0193] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0194] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0195] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0196] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0197] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0198] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0199] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A process running method, applied to a terminal device, characterized in that: The method comprises: When a target process for calling a target application is detected, obtaining an executable file corresponding to the target application; In a case where the executable file includes a security tag, the target process is run to launch the target application.

2. The method according to claim 1, characterized in that The target process calls the target application program through a calling function in kernel mode, and obtaining the executable file corresponding to the target application program includes: Intercept the target process and obtain the absolute path of the target application by reading and writing device files; The executable file corresponding to the target application is obtained according to the absolute path through a preset main program in user mode.

3. The method according to claim 2, characterized in that In the case where the executable file includes a security tag, before running the target process to start the target application, the method further includes: Obtaining part of the data located at a specific position in the executable file through the preset main program in the user state; and determining whether the portion of data is the security tag; Wherein, in the case where the partial data is the security label, the executable file includes the security label.

4. The method according to claim 3, characterized in that The portion of data located at the specific position in the executable file is encrypted data, and determining whether the portion of data is the security tag includes: Decrypting the part of the data using a preset decryption algorithm to obtain decrypted content; the preset decryption algorithm is an asymmetric encryption algorithm; In a case where the decrypted content matches the security tag, the portion of data is determined to be the security tag.

5. The method according to claim 1, characterized in that The method further comprises: In the case where the executable file does not include a security label, detecting the security of the executable file through a preset main program in user mode; The target process and the executable file are processed according to the security detection result.

6. The method according to claim 5, characterized in that The detecting the security of the executable file through a preset main program in user mode includes: Calling a virus scanning module to detect whether the executable file carries a virus through a preset main program in user mode; and / or, Through a preset main program in user mode, according to the process identifier of the target process, it is analyzed whether the target process will perform illegal operations or connect to an illegal network address.

7. The method according to claim 5, characterized in that The processing of the target process and the executable file according to the security detection result includes: If the detection result is safe, adding the security tag to the specific location of the executable file, running the target process, and starting the target application; When the detection result is unsafe, the target process is closed and the executable file is deleted.

8. A process running device, characterized in that: include: A file acquisition module, which acquires an executable file corresponding to the target application when a target process for calling the target application is detected; The program processing module runs the target process to start the target application program when the executable file includes a security tag.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory is used to store code instructions; and the processor is used to execute the code instructions to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, the computer program comprising instructions for implementing the method according to any one of claims 1 to 7.

Images