Portable device access interception method and system

Abstract

The invention belongs to the technical field of computer systems, and discloses a portable device access interception method and system. The method comprises the following steps: monitoring a registry of an operating system in real time after the portable equipment is accessed; judging whether a registry under the portable equipment has a creation action or not based on a monitoring result; if the creating action exists, content information written in a registry under the portable equipment is acquired; determining an access interception policy based on the written content information; and controlling the access of the portable equipment according to the access interception strategy. Through the mode, the registry creation action is monitored and the written content information is identified aiming at the accessed portable equipment, so that the access of the portable equipment is controlled, and the safety of an operating system can be effectively ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of computer systems, and in particular to a portable device access interception method and system. Background Art

[0002] In a normal operating system, when a portable device is inserted for the first time, the system will find the new device and write the corresponding content in the registry to initialize it. However, this poses a certain risk to the security of the operating system. Currently, there is no effective response to this situation.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a portable device access interception method and system, aiming to solve the problem that in a normal operating system, when a portable device is inserted for the first time, the system will find the new device and write the corresponding content in the registry to initialize it, but this poses a certain risk to the security of the operating system. At present, there is no effective technical solution to this situation.

[0005] To achieve the above object, the present invention provides a portable device access interception method, the portable device access interception method comprising the following steps:

[0006] After the portable device is connected, the registry of the operating system is monitored in real time;

[0007] Determining whether there is a creation action in the registry under the portable device based on the monitoring result;

[0008] If there is a creation action, obtaining the content information written in the registry under the portable device;

[0009] Determining an access interception strategy based on the written content information;

[0010] Access to the portable device is controlled according to the access interception policy.

[0011] In some embodiments, determining the access interception strategy based on the written content information includes:

[0012] Obtaining information of the portable device and a corresponding registry path;

[0013] Acquire the written content information according to the registry path;

[0014] Determining whether the written content information includes the information of the portable device;

[0015] Determine the access interception strategy based on the judgment result.

[0016] In some embodiments, determining the access interception strategy based on the judgment result includes:

[0017] If the judgment result is that the written content information contains the information of the portable device, determining the access interception policy to prohibit access;

[0018] If the judgment result is that the written content information does not include the information of the portable device, the access interception policy is determined to allow access.

[0019] In some embodiments, the determining whether the written content information includes the information of the portable device includes:

[0020] Obtaining historical interception records stored in the log, and obtaining a historical data set based on the historical interception records;

[0021] Using the historical data set for training to obtain an information classification model;

[0022] Inputting the written content information into the information classification model, and obtaining the information classification result input by the information classification model;

[0023] Determine the type of all information in the written content information according to the classification result;

[0024] Based on the types of all the information, it is determined whether the type corresponding to the information of the portable device is included.

[0025] In some embodiments, the using the historical data set to perform training to obtain an information classification model includes:

[0026] Splitting the historical data set into a training set and a test set according to a preset ratio;

[0027] Initialize model parameters to determine the initial number of neural network layers and the initial number of neurons contained in each neural network layer;

[0028] For the input training set, the fuzzy C-means clustering algorithm is used to form multiple fuzzy sub-training sets;

[0029] The coefficients corresponding to each fuzzy sub-training set are determined using the least squares method;

[0030] Performing information classification based on the coefficients and the multiple fuzzy sub-training sets to obtain reference classification results output by each neuron node;

[0031] The reference classification results output by all neuron nodes are integrated by weighted voting to obtain the target classification results output by the neuron nodes.

[0032] The test set is used to determine the performance index of each neuron based on the target classification result, and a number of neurons are screened out according to the performance index. The corresponding neural network layers are constructed using the several neurons, and the number of initial neural network layers is adjusted according to the initial number of neurons contained in each neural network layer to obtain an information classification model.

[0033] In some embodiments, the method further comprises:

[0034] After the driver is initialized, the CmRegisterCallback function is called to bind the driver device and register a registry monitoring function. When a change in the registry is detected, the registry monitoring function is used to notify the driver through a corresponding callback function. The driver is used to perform access control operations.

[0035] Accordingly, controlling access to the portable device according to the access interception policy includes:

[0036] If the access interception policy is to prohibit access, the driver is used to prevent the creation of the current value of the registry, and the written content information is deleted to intercept the access of the portable device;

[0037] If the access interception policy is to allow access, the creation operation of the registry and the written content information are not processed to allow access by the portable device.

[0038] In some embodiments, the method further comprises:

[0039] Obtaining a device type of the portable device;

[0040] Recording historical interception times of intercepting the portable device;

[0041] The device type and the historical interception time are stored in a log, and the log is used for monitoring subsequent access of portable devices.

[0042] In addition, to achieve the above-mentioned purpose, the present invention also proposes a portable device access interception system, the portable device access interception system comprising:

[0043] A monitoring module, used for real-time monitoring of the registry of the operating system after the portable device is connected;

[0044] A determination module, used for determining whether there is a creation action in the registry under the portable device based on the monitoring result;

[0045] A reading module, used for obtaining the content information written in the registration table under the portable device if there is a creation action;

[0046] A decision module, used to determine an access interception strategy based on the written content information;

[0047] A control module is used to control the access to the portable device according to the access interception policy.

[0048] In some embodiments, the decision module is used to obtain information of the portable device and a corresponding registry path;

[0049] Acquire the written content information according to the registry path;

[0050] Determining whether the written content information includes the information of the portable device;

[0051] Determine the access interception strategy based on the judgment result.

[0052] In some embodiments, the decision module is used to determine that the access interception policy is to prohibit access if the judgment result is that the written content information contains the information of the portable device;

[0053] If the judgment result is that the written content information does not include the information of the portable device, the access interception policy is determined to allow access.

[0054] In the present invention, after the portable device is connected, the registry of the operating system is monitored in real time; based on the monitoring results, it is determined whether there is a creation action in the registry under the portable device; if there is a creation action, the content information written in the registry under the portable device is obtained; based on the written content information, an access interception strategy is determined; and access to the portable device is controlled according to the access interception strategy. In the above manner, the registry creation action of the connected portable device is monitored and the written content information is identified, so that the access to the portable device is controlled, which can effectively ensure the security of the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of a first embodiment of a portable device access interception method of the present invention;

[0056] Figure 2 It is a structural block diagram of the first embodiment of the portable device access interception system of the present invention.

[0057] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0058] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0059] The embodiment of the present invention provides a portable device access interception method, referring to Figure 1 , Figure 1 The figure is a flow chart of a first embodiment of a portable device access interception method of the present invention.

[0060] In this embodiment, the portable device access interception method includes the following steps:

[0061] Step S10: After the portable device is connected, the registry of the operating system is monitored in real time.

[0062] In this embodiment, the executor of this embodiment is a portable device access interception device, wherein the portable device access interception device has functions such as data processing, data communication and program running. The portable device access interception device can be a computer terminal device or other network device, and of course it can also be other devices with similar functions, and this embodiment does not limit this.

[0063] It should be noted that in a normal operating system, when a portable device is inserted for the first time, the system will find the new device and write the corresponding content in the registry to initialize it. However, this poses a certain risk to the security of the operating system. Currently, there is no effective response to this situation.

[0064] In order to solve the above technical problems, in this embodiment, after the portable device is connected, the registry of the operating system is monitored in real time; based on the monitoring results, it is determined whether there is a creation action in the registry under the portable device; if there is a creation action, the content information written in the registry under the portable device is obtained; based on the written content information, an access interception strategy is determined; and access to the portable device is controlled according to the access interception strategy. In the above manner, the registry creation action of the connected portable device is monitored and the written content information is identified, so as to control the access to the portable device, which can effectively ensure the security of the operating system. Specifically, it can be implemented as follows.

[0065] In a specific implementation, in this embodiment, after detecting that a portable device is connected, it is necessary to monitor the registry in the operating system in real time.

[0066] Step S20: judging whether there is a creation action in the registry of the portable device based on the monitoring result.

[0067] When a portable device is connected, a new location will be generated in the registry. There will be no device object at the new location at the beginning. If a creation action occurs, the content information written by the portable device will appear at the corresponding new location.

[0068] Step S30: If there is a creation action, then obtain the content information written in the registration table under the portable device.

[0069] It should be understood that if there is no creation action, there is no need to perform subsequent interception control related operations. On the contrary, if there is a creation action, in this embodiment, it is necessary to obtain the content information written in the registry under the portable device. The registry under the portable device is also the relevant registry corresponding to the portable device in the registry. The connected portable device has its corresponding path in the registry. According to the path, the registry under it can be determined. Assuming that the portable device is a USB device, the path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB. After determining the registry path, the content information written in the registry after the portable device is connected can also be obtained according to the registry path.

[0070] Step S40: Determine an access interception strategy based on the written content information.

[0071] In a specific implementation, based on the written content information obtained as mentioned above, the access interception strategy can be determined in this embodiment. The specific process of determining the access interception strategy based on the written content information is to obtain the information of the portable device and the corresponding registry path; obtain the written content information according to the registry path; determine whether the written content information contains the information of the portable device; and determine the access interception strategy based on the judgment result.

[0072] It should be noted that the determination of the access interception strategy is mainly based on whether the written content information contains the information of the portable device, wherein the information of the portable device may include class_00, class_ff, MTP, USB\\Class_06, CdRom and other information. The process of judging whether the written content information contains the information of the portable device is specifically to obtain the historical interception records stored in the log, and obtain the historical data set based on the historical interception records; use the historical data set for training to obtain an information classification model; input the written content information into the information classification model, and obtain the information classification result input by the information classification model; determine the type of all information in the written content information according to the classification result; and judge whether the type corresponding to the information of the portable device is contained based on the type of all information.

[0073] It should be noted that the information classification model can be used to obtain the types of all information in the written content information, including but not limited to device classes and subclasses, service startup types and dependencies, and device permission information. Based on the above list, class_00 and class_ff are information of the device class and subclass type. If this type of information is included, it means that the written content information contains information about portable devices.

[0074] Furthermore, the process of using the historical data set for training to obtain the information classification model is specifically to split the historical data set into a training set and a test set according to a preset ratio; initialize the model parameters to determine the initial number of neural network layers and the initial number of neurons contained in each neural network layer; for the input training set, use the fuzzy C-means clustering algorithm to form multiple fuzzy sub-training sets; use the least squares method to determine the coefficients corresponding to each fuzzy sub-training set; classify information based on the coefficients and the multiple fuzzy sub-training sets to obtain the reference classification results output by each neuron node; integrate the reference classification results output by all neuron nodes by weighted voting to obtain the target classification results output by the neuron; use the test set to determine the performance indicators of each neuron based on the target classification results, and select a number of neurons according to the performance indicators, use the several neurons to construct the corresponding neural network layer, and adjust the initial number of neural network layers and the initial number of neurons contained in each neural network layer to obtain the information classification model.

[0075] It should be noted that the preset ratio can be 6:4, that is, the ratio of the training set to the test set is 6:4. The two main parameters of the classification model are the number of network layers and the number of neurons in each layer. The number of network layers is the number of neural network layers. After initialization, the initial number of neural network layers and the initial number of neurons contained in each neural network layer are used for subsequent training. The coefficient corresponding to each fuzzy sub-training set is A=(X T X+λI) -1 X T, where X is the fuzzy sub-training set, λ is the regularization coefficient, and I is the unit matrix. In this embodiment, each neuron is defined to be composed of multiple neuron nodes, and the weighted voting method is to weight the reference classification results output by each neuron node to obtain the target classification result output by the final neuron. After obtaining the target classification result, the performance indicators of each neuron, such as model accuracy and recall rate, can be determined through the above test set. The selected neurons are the first neurons with stronger performance indicators. The specific number can also be set according to the actual training needs, and the corresponding thresholds of accuracy and recall rate can also be set, and the number of neurons is determined by the threshold. Finally, the neural network layer constructed by these neurons is used to optimize the initial number of neural network layers with the initial number of neurons contained in each neural network layer, and then the model training can be completed, thereby obtaining an information classification model.

[0076] Furthermore, the judgment results in this embodiment are divided into: the written content information contains information about the portable device and the written content information does not contain information about the portable device. Specifically, if the judgment result is that the written content information contains information about the portable device, the corresponding access interception policy is to prohibit access; if the judgment result is that the written content information does not contain information about the portable device, the corresponding access interception policy is to allow access.

[0077] Step S50: Controlling access to the portable device according to the access interception policy.

[0078] In this embodiment, after the driver is initialized, the CmRegisterCallback function is called to bind the driver device and register a registry monitoring function. When changes are detected in the registry, the registry monitoring function is used to notify the driver through the corresponding callback function, and the driver is used to perform access control operations.

[0079] Furthermore, after determining the access interception strategy, if the access interception strategy is to prohibit access, the driver is used to prevent the creation of the current value of the registry, and the written content information is deleted to intercept the access of the portable device. If the access interception strategy is to allow access, the registry creation operation and the written content information are not processed to allow the access of the portable device. When a new USB device is inserted, a new position will be generated in the registry. There is no device object at the new position. If the creation of the registry is intercepted at this time, the hardware will not be found, and the effect of intercepting the portable device is achieved. The above method is mainly aimed at the plug-and-play method of portable devices in the operating system, and is mainly used to modify the registry of the operating system, so as to achieve the effect of intercepting the creation of the portable device registry.

[0080] Furthermore, in this embodiment, the device type of the intercepted portable device is also recorded, and the historical interception time of the portable device is recorded. The device type and the historical interception time are stored in a log, and the subsequent portable devices connected subsequently can be quickly monitored through the log.

[0081] In this embodiment, after the portable device is connected, the registry of the operating system is monitored in real time; based on the monitoring results, it is determined whether there is a creation action in the registry under the portable device; if there is a creation action, the content information written in the registry under the portable device is obtained; based on the written content information, an access interception strategy is determined; and access to the portable device is controlled according to the access interception strategy. In the above manner, the registry creation action of the connected portable device is monitored and the written content information is identified, so that the access to the portable device is controlled, which can effectively ensure the security of the operating system.

[0082] Reference Figure 2 , Figure 2 It is a structural block diagram of the first embodiment of the portable device access interception system of the present invention.

[0083] like Figure 2 As shown, the portable device access interception system proposed in the embodiment of the present invention includes:

[0084] The monitoring module 10 is used to monitor the registry of the operating system in real time after the portable device is connected;

[0085] A determination module 20, configured to determine whether a creation action exists in the registry under the portable device based on the monitoring result;

[0086] The reading module 30 is used to obtain the content information written in the registration table under the portable device if there is a creation action;

[0087] A decision module 40, configured to determine an access interception strategy based on the written content information;

[0088] The control module 50 is used to control the access to the portable device according to the access interception policy.

[0089] In this embodiment, after the portable device is connected, the registry of the operating system is monitored in real time; based on the monitoring results, it is determined whether there is a creation action in the registry under the portable device; if there is a creation action, the content information written in the registry under the portable device is obtained; based on the written content information, an access interception strategy is determined; and access to the portable device is controlled according to the access interception strategy. In the above manner, the registry creation action of the connected portable device is monitored and the written content information is identified, so that the access to the portable device is controlled, which can effectively ensure the security of the operating system.

[0090] In some embodiments, the decision module 40 is used to obtain information of the portable device and a corresponding registry path;

[0091] Acquire the written content information according to the registry path;

[0092] Determining whether the written content information includes the information of the portable device;

[0093] Determine the access interception strategy based on the judgment result.

[0094] In some embodiments, the decision module 40 is used to determine that the access interception policy is to prohibit access if the judgment result is that the written content information contains the information of the portable device;

[0095] If the judgment result is that the written content information does not include the information of the portable device, the access interception policy is determined to allow access.

[0096] In some embodiments, the decision module 40 is used to obtain historical interception records stored in the log, and obtain a historical data set based on the historical interception records;

[0097] Using the historical data set for training to obtain an information classification model;

[0098] Inputting the written content information into the information classification model, and obtaining the information classification result input by the information classification model;

[0099] Determine the type of all information in the written content information according to the classification result;

[0100] Based on the types of all the information, it is determined whether the type corresponding to the information of the portable device is included.

[0101] In some embodiments, the decision module 40 is used to split the historical data set into a training set and a test set according to a preset ratio;

[0102] Initialize model parameters to determine the initial number of neural network layers and the initial number of neurons contained in each neural network layer;

[0103] For the input training set, the fuzzy C-means clustering algorithm is used to form multiple fuzzy sub-training sets;

[0104] The coefficients corresponding to each fuzzy sub-training set are determined using the least squares method;

[0105] Performing information classification based on the coefficients and the multiple fuzzy sub-training sets to obtain reference classification results output by each neuron node;

[0106] The reference classification results output by all neuron nodes are integrated by weighted voting to obtain the target classification results output by the neuron nodes.

[0107] The test set is used to determine the performance index of each neuron based on the target classification result, and a number of neurons are screened out according to the performance index. The corresponding neural network layers are constructed using the several neurons, and the number of initial neural network layers is adjusted according to the initial number of neurons contained in each neural network layer to obtain an information classification model.

[0108] In some embodiments, the monitoring module 10 is used to call the CmRegisterCallback function after the driver is initialized, bind the driver device, and register a registry monitoring function. When a change in the registry is detected, the registry monitoring function is used to notify the driver through a corresponding callback function, and the driver is used to perform access control operations;

[0109] Correspondingly, the control module 50 is used to use the driver to prevent the creation of the current value of the registry and to delete the written content information to intercept the access of the portable device if the access interception policy is to prohibit access;

[0110] If the access interception policy is to allow access, the creation operation of the registry and the written content information are not processed to allow access by the portable device.

[0111] In some embodiments, the portable device access interception system further includes a recording module;

[0112] The recording module is used to obtain the device type of the portable device;

[0113] Recording historical interception times of intercepting the portable device;

[0114] The device type and the historical interception time are stored in a log, and the log is used for monitoring subsequent access of portable devices.

[0115] An embodiment of the present application also provides a portable device access interception device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the memory is used to store the portable device access interception program; the processor is used to implement the above-mentioned portable device access interception method when executing the program stored in the memory.

[0116] The communication bus mentioned in the portable device access interception device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0117] The communication interface is used for communication between the portable device access interception device and other devices.

[0118] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0119] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0120] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0121] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0122] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0123] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0124] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0125] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0126] In addition, for technical details not fully described in this embodiment, reference may be made to the portable device access interception method provided in any embodiment of the present invention, and will not be repeated here.

[0127] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0128] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0129] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0130] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0131] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A portable device access interception method, characterized in that: The portable device access interception method comprises: After the portable device is connected, the registry of the operating system is monitored in real time; Determining whether there is a creation action in the registry under the portable device based on the monitoring result; If there is a creation action, obtaining the content information written in the registry under the portable device; Determining an access interception strategy based on the written content information; Access to the portable device is controlled according to the access interception policy.

2. The portable device access interception method according to claim 1, characterized in that: The determining of the access interception strategy based on the written content information includes: Obtaining information of the portable device and a corresponding registry path; Acquire the written content information according to the registry path; Determining whether the written content information includes the information of the portable device; Determine the access interception strategy based on the judgment result.

3. The portable device access interception method according to claim 2, characterized in that: Determining the access interception strategy based on the judgment result includes: If the judgment result is that the written content information contains the information of the portable device, determining the access interception policy to prohibit access; If the judgment result is that the written content information does not include the information of the portable device, the access interception policy is determined to allow access.

4. The portable device access interception method according to claim 2, characterized in that: The determining whether the written content information includes the information of the portable device includes: Obtaining historical interception records stored in the log, and obtaining a historical data set based on the historical interception records; Using the historical data set for training to obtain an information classification model; Inputting the written content information into the information classification model, and obtaining the information classification result input by the information classification model; Determine the type of all information in the written content information according to the classification result; Based on the types of all the information, it is determined whether the type corresponding to the information of the portable device is included.

5. The portable device access interception method according to claim 4, characterized in that: The using the historical data set for training to obtain an information classification model includes: Splitting the historical data set into a training set and a test set according to a preset ratio; Initialize model parameters to determine the initial number of neural network layers and the initial number of neurons contained in each neural network layer; For the input training set, the fuzzy C-means clustering algorithm is used to form multiple fuzzy sub-training sets; The coefficients corresponding to each fuzzy sub-training set are determined using the least squares method; Performing information classification based on the coefficients and the multiple fuzzy sub-training sets to obtain reference classification results output by each neuron node; The reference classification results output by all neuron nodes are integrated by weighted voting to obtain the target classification results output by the neuron nodes. The test set is used to determine the performance index of each neuron based on the target classification result, and a number of neurons are screened out according to the performance index. The corresponding neural network layers are constructed using the several neurons, and the number of initial neural network layers is adjusted according to the initial number of neurons contained in each neural network layer to obtain an information classification model.

6. The portable device access interception method according to claim 3, characterized in that: The method further comprises: After the driver is initialized, the CmRegisterCallback function is called to bind the driver device and register a registry monitoring function. When a change in the registry is detected, the registry monitoring function is used to notify the driver through a corresponding callback function. The driver is used to perform access control operations. Accordingly, controlling access to the portable device according to the access interception policy includes: If the access interception policy is to prohibit access, the driver is used to prevent the creation of the current value of the registry, and the written content information is deleted to intercept the access of the portable device; If the access interception policy is to allow access, the creation operation of the registry and the written content information are not processed to allow access by the portable device.

7. The portable device access interception method according to claim 6, characterized in that: The method further comprises: Obtaining a device type of the portable device; Recording historical interception times of intercepting the portable device; The device type and the historical interception time are stored in a log, and the log is used for monitoring subsequent access of portable devices.

8. A portable device access interception system, characterized in that: The portable device access interception system comprises: A monitoring module, used for real-time monitoring of the registry of the operating system after the portable device is connected; A determination module, used for determining whether there is a creation action in the registry under the portable device based on the monitoring result; A reading module, used for obtaining the content information written in the registration table under the portable device if there is a creation action; A decision module, used to determine an access interception strategy based on the written content information; A control module is used to control the access to the portable device according to the access interception policy.

9. The portable device access interception system according to claim 8, characterized in that: The decision module is used to obtain the information of the portable device and the corresponding registry path; Acquire the written content information according to the registry path; Determining whether the written content information includes the information of the portable device; Determine the access interception strategy based on the judgment result.

10. The portable device access interception system according to claim 9, characterized in that: The decision module is used to determine that the access interception policy is to prohibit access if the judgment result is that the written content information contains the information of the portable device; If the judgment result is that the written content information does not include the information of the portable device, the access interception policy is determined to allow access.

Images