Registry protection method and system based on software

Abstract

The invention belongs to the technical field of registry security protection, and discloses a registry protection method and system based on software, and the method comprises the steps: capturing an operation request of a registry, and transmitting the identification information of the operation request to registry protection software; performing security rule judgment on the identification information to obtain a rule judgment result; if the identification information accords with the security rule, the registry protection software permits execution of the operation request, otherwise, the registry protection software does not permit execution of the operation request and generates response information; and the registry protection software sends the response information to the operation end, and the operation end executes corresponding protection operation according to the response information. According to the method and the device, the operation request for the registry can be effectively monitored and filtered, the safety is greatly enhanced, and the operation request can be finely judged and controlled based on the preset rule by preventing potential harmful operation, so that an administrator can more flexibly and accurately manage the access and operation of the registry.

Description

Technical Field

[0001] The present invention relates to the technical field of registry security protection, and in particular to a software-based registry protection method and system. Background Art

[0002] The registry is a core component of the Windows operating system. It acts as a configuration database and stores the operating settings of the system, hardware drivers, and multiple Windows applications. These configuration information are related to everything from system startup to application operation, and therefore play a vital role in the entire operating system.

[0003] With the in-depth advancement of intelligent manufacturing and the full deployment of the industrial Internet, the industrial control environment is facing an increasingly severe network environment. New attack methods such as ransomware, worms, and Trojans are emerging one after another, and attacks on the registry are increasing. Therefore, the protection of the registry is becoming more and more important.

[0004] Currently, the traditional host registry has become one of the main targets of attackers due to its core position and rich system information. The registry can be modified by unauthorized users or malware, and the system is often difficult to perceive these illegal changes in real time, which greatly increases security risks. Such undetectable modifications may lead to system configuration errors, exploitation of security vulnerabilities, or even complete system crashes.

[0005] Therefore, how to provide a software-based registry protection method and system is a problem that needs to be solved urgently. Summary of the invention

[0006] The embodiment of the present invention provides a software-based registry protection method and system to solve the problem in the prior art that it is difficult to perceive these illegal changes in real time.

[0007] In order to have a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not a general review, nor is it intended to identify key / important components or to describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0008] According to a first aspect of an embodiment of the present invention, a software-based registry protection method is provided.

[0009] In one embodiment, a software-based registry protection method includes: The operation end captures the operation request of the registry and sends the identification information of the operation request to the registry protection software; Based on the registry protection software, the security rules of the identification information are judged to obtain the rule judgment result; Based on the result of the rule judgment, if the identification information complies with the security rule, the registry protection software allows the execution of the operation request; otherwise, the registry protection software does not allow the execution of the operation request and generates a response message; The registry protection software sends the response information to the operation end, and the operation end performs corresponding protection operations according to the response information.

[0010] In one embodiment, the registry-based protection software performs security rule judgment on the identification information to obtain the rule judgment result including: Compare the character length of the identification information with the preset security rules in the registry protection software. If the character length of the identification information is less than the character length of the preset security rules, it means that the registry operation request complies with the preset security rules. Otherwise, character content recognition is performed on the identification information and the preset security rules respectively. Semantic analysis is performed on the character content of the identification information and the character content of the preset security rules respectively, and based on the results of the semantic analysis, it is determined whether the identification information contains the semantic features defined in the preset security rules. If so, the permission status in the identification information is analyzed. Otherwise, it means that the operation request of the registry does not comply with the preset security rules.

[0011] In one embodiment, comparing the character length of the identification information with the preset security rules in the registry protection software includes: Separately process the identification information and the security rules preset in the registry protection software; Using the predefined character calculation rules, calculate the length of each segmented string; The length of the segmented character string of the identification information is compared with the length of the segmented character string according to the preset security rule in the registry protection software to obtain a comparison result.

[0012] In one embodiment, before the identification information and the preset security rules in the registry protection software are segmented, the following steps are performed: Preprocessing is performed on the identification information and the preset security rules in the registry protection software respectively, wherein the preprocessing is to delete invisible characters.

[0013] In one embodiment, the performing semantic analysis on the character content of the identification information and the character content of the preset security rule respectively, and judging whether the identification information contains the semantic features defined in the preset security rule according to the semantic analysis result comprises: Construct and train a language processing model, and use the trained language processing model to encode the character content of the recognition information and the character content of the preset security rules to generate a semantic vector; Calculate the semantic similarity between the identification information and the preset security rules according to the generated semantic vector; The semantic similarity is compared with a preset similarity threshold. If the semantic similarity is greater than the preset similarity threshold, it means that the identification information contains the semantic features defined in the preset. Otherwise, it means that the identification information does not contain the semantic features defined in the preset.

[0014] In one embodiment, the constructing and training of the language processing model, using the trained language processing model to encode the character content of the identification information and the character content of the preset security rules respectively, and generating the semantic vector includes: Perform word segmentation and entity full-word coverage on the text in the collection registry knowledge text library to obtain semantic training samples; Performing semantic training on a pre-trained language model using semantic training samples; the pre-trained language model includes an encoder and an output layer, the encoder is used to extract a semantic vector, and the output layer is used to generate a corresponding output according to the semantic vector; The trained language processing model is used to extract the semantic features of the character content of the recognition information and the character content of the preset security rules, and convert them into semantic vectors.

[0015] In one embodiment, the word segmentation and entity full word coverage of the text in the collection registration table knowledge text library to obtain semantic training samples includes: Collect a knowledge text base about the registry; Performing text processing and word segmentation processing on the text in the registry knowledge text library, wherein the text processing includes removing irrelevant characters in the text; For the text after word segmentation, identify and mark the entity words related to the registration form, and use the covering tags to cover the entity words; The text after word segmentation and entity vocabulary coverage is used as semantic training samples.

[0016] In one embodiment, the calculation formula for calculating the semantic similarity between the identification information and the preset security rules based on the generated semantic vector is: ; In the formula, S represents the semantic similarity between the identification information and the preset security rules; V i Semantic vector representing identification information; V ik The eigenvalue of the kth semantic vector in the semantic vector representing the identification information; V j A semantic vector representing a preset security rule; V jk The eigenvalue of the kth semantic vector in the semantic vector representing the preset security rule; n represents the total number of semantic vectors of identification information.

[0017] In one embodiment, the analyzing the permission status in the identification information includes: Parse the permission type in the identification information to obtain the requested permission; Extract and parse the permission definitions in the preset security rules; Compare the requested permissions with the permissions defined in the rules. If the requested permissions meet the permission definitions in the preset security rules, it means that the operation request is allowed to be executed and is controlled according to the preset control mode. Otherwise, it means that the operation request of the registry does not meet the preset security rules.

[0018] According to a second aspect of an embodiment of the present invention, a software-based registry protection system is provided.

[0019] In one embodiment, the software-based registry protection system includes: An operation request capture module is used for the operation end to capture the operation request of the registry and send the identification information of the operation request to the registry protection software; A rule judgment module is used to perform security rule judgment on the identification information based on the registry protection software to obtain the rule judgment result; A response information generation module is used to determine the result based on the rules. If the identification information meets the security rules, the registry protection software allows the execution of the operation request. Otherwise, the registry protection software does not allow the execution of the operation request and generates response information. The operation execution module is used for the registry protection software to send response information to the operation end, and the operation end executes corresponding protection operations according to the response information.

[0020] According to a third aspect of an embodiment of the present invention, a computer device is provided.

[0021] In some embodiments, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0022] According to a fourth aspect of embodiments of the present invention, a computer-readable storage medium is provided.

[0023] In one embodiment, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0024] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: 1. The present invention can effectively monitor and filter operation requests to the registry, thereby preventing unauthorized access and modification, greatly enhancing security. By blocking potentially harmful operations, the method helps to maintain the integrity and consistency of the registry, thereby improving overall stability. The registry protection software can make refined judgments and controls on operation requests based on preset rules, allowing administrators to manage access to and operations of the registry more flexibly and accurately.

[0025] 2. The present invention can comprehensively and deeply identify and analyze registry operation requests through the steps of character length comparison, segmentation processing, preprocessing, semantic analysis, language processing model training and application, word segmentation processing and entity full-word coverage, semantic similarity calculation, and permission status analysis, and effectively prevent unauthorized access and modification, thereby greatly enhancing security and stability. At the same time, it also has good compatibility and scalability, can be easily integrated into the existing system architecture, and can be flexibly configured and expanded according to actual needs.

[0026] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0028] Figure 1 is a flowchart of a software-based registry protection method according to an exemplary embodiment; Figure 2 is a principle block diagram of a software-based registry protection system according to an exemplary embodiment; Figure 3 The figure is a schematic diagram showing the structure of a computer device according to an exemplary embodiment. DETAILED DESCRIPTION

[0029] The following description and accompanying drawings fully illustrate the specific embodiments of this article so that those skilled in the art can practice them. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The scope of the embodiments of this article includes the entire scope of the claims, as well as all available equivalents of the claims. Herein, the terms "first", "second", etc. are only used to distinguish one element from another, without requiring or implying any actual relationship or order between these elements. In fact, the first element can also be called the second element, and vice versa. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the structure, device or equipment including a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also include elements inherent to such structure, device or equipment. In the absence of more restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the structure, device or equipment including the elements. Each embodiment is described in a progressive manner herein, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the embodiments can be referred to each other.

[0030] The terms "longitudinal", "lateral", "upper", "lower", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc. in this document indicate the orientation or position relationship based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing this document and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In the description of this document, unless otherwise specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a mechanical connection or an electrical connection, it can also be the internal communication of two elements, it can be a direct connection, or it can be an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0031] As used herein, the term "plurality" means two or more than two, unless otherwise specified.

[0032] In this document, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0033] In this article, the term "and / or" is a description of the association relationship between objects, indicating that three relationships may exist. For example, A and / or B means: A or B, or, A and B.

[0034] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0035] Each module in the device or system of the present application can be implemented in whole or in part by software, hardware, or a combination thereof. The above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above modules.

[0036] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0037] Figure 1 An embodiment of the software-based registry protection method of the present invention is shown.

[0038] In this optional embodiment, the software-based registry protection method includes: Step S101, the operation terminal captures the operation request of the registry, and sends the identification information of the operation request to the registry protection software; Step S103, performing security rule judgment on the identification information based on the registry protection software to obtain a rule judgment result; Step S105: Based on the rule judgment result, if the identification information complies with the security rule, the registry protection software allows the execution of the operation request; otherwise, the registry protection software does not allow the execution of the operation request and generates response information; Step S107: The registry protection software sends the response information to the operation end, and the operation end performs corresponding protection operations according to the response information.

[0039] In this optional embodiment, when the security rule judgment is performed on the identification information based on the registry protection software and the rule judgment result is obtained, the character length of the identification information can be compared with the preset security rule in the registry protection software. If the character length of the identification information is less than the character length of the preset security rule, it means that the operation request of the registry complies with the preset security rule. Otherwise, the character content recognition is performed on the identification information and the preset security rule respectively; the character content of the identification information and the character content of the preset security rule are semantically analyzed respectively, and according to the result of the semantic analysis, it is judged whether the identification information contains the semantic features defined in the preset security rule. If it does, the permission status in the identification information is analyzed. Otherwise, it means that the operation request of the registry does not comply with the preset security rule.

[0040] In this optional embodiment, when comparing the character lengths of the identification information and the preset security rules in the registry protection software, the identification information and the preset security rules in the registry protection software can be segmented separately; the length of each segmented character string is calculated using a predefined character calculation rule; the length of the segmented character string of the identification information is compared with the length of the segmented character string of the preset security rules in the registry protection software to obtain a comparison result.

[0041] In this optional embodiment, before the identification information and the security rules preset in the registry protection software are segmented and processed respectively, the identification information and the security rules preset in the registry protection software can be preprocessed respectively, and the preprocessing is to delete invisible characters.

[0042] In this optional embodiment, when semantic analysis is performed on the character content of the identification information and the character content of the preset security rules respectively, and based on the results of the semantic analysis, it is determined whether the identification information contains the semantic features defined in the preset security rules, a language processing model can be constructed and trained, and the trained language processing model is used to encode the character content of the identification information and the character content of the preset security rules respectively to generate a semantic vector; the semantic similarity between the identification information and the preset security rules is calculated based on the generated semantic vector; the semantic similarity is compared with a preset similarity threshold; if the semantic similarity is greater than the preset similarity threshold, it indicates that the identification information contains the semantic features defined in the preset; otherwise, it indicates that the identification information does not contain the semantic features defined in the preset.

[0043] In this optional embodiment, when constructing and training a language processing model, the trained language processing model is used to encode the character content of the identification information and the character content of the preset security rules respectively. When generating a semantic vector, the text in the collection registry knowledge text library can be segmented and entity full-word covered to obtain a semantic training sample; the semantic training sample is used to perform semantic training on the pre-trained language model; the pre-trained language model includes an encoder and an output layer, the encoder is used to extract the semantic vector, and the output layer is used to generate a corresponding output according to the semantic vector; the trained language processing model is used to extract the semantic features of the character content of the identification information and the character content of the preset security rules respectively, and convert them into semantic vectors.

[0044] In this optional embodiment, when the text collected in the registry knowledge text library is subjected to word segmentation processing and entity full-word coverage to obtain semantic training samples, a knowledge text library about the registry is collected; text processing and word segmentation processing are performed on the text in the registry knowledge text library, and the text processing includes removing irrelevant characters in the text; for the text after word segmentation processing, entity vocabulary related to the registry is identified and marked, and the entity vocabulary is covered with a covering label; and the text after word segmentation processing and entity vocabulary coverage is used as a semantic training sample.

[0045] In this optional embodiment, the calculation formula for calculating the semantic similarity between the identification information and the preset security rule based on the generated semantic vector is: ; Where S represents the semantic similarity between the identification information and the preset security rules; V i The semantic vector representing the identification information; V ik The eigenvalue of the kth semantic vector in the semantic vector representing the recognition information; V j The semantic vector representing the preset security rules; V jk The eigenvalue of the kth semantic vector in the semantic vector of the preset security rule; n represents the total number of semantic vectors of the identification information.

[0046] In this optional embodiment, the analysis of the permission status in the identification information includes: parsing the permission type in the identification information to obtain the requested permission; extracting and parsing the permission definition in the preset security rules; comparing the requested permission with the permission defined in the rules. If the requested permission meets the permission definition in the preset security rules, it means that the operation request is allowed to execute and is controlled according to the preset control mode. Otherwise, it means that the operation request of the registry does not comply with the preset security rules.

[0047] In order to facilitate understanding of the above technical solutions of the present invention, the above technical solutions of the present invention are further described from the perspective of architecture and principle as follows: The operation end captures the operation request of the registry; When the operating system starts or the user logs in, the registry monitoring mechanism will automatically start and run.

[0048] When an application attempts to access, modify, delete, or create registry keys, the monitoring mechanism intercepts these operation requests.

[0049] The monitoring mechanism captures the specific details of these requests, including but not limited to the registry path to be operated, the operation type (read, write, delete, etc.), and the application identity that initiated the operation.

[0050] Based on the registry protection software, the security rules of the identification information are judged to obtain the rule judgment result; It should be noted that registry protection software is a security tool specifically used to monitor and protect the registry. The main purpose of this type of software is to prevent malware, viruses, Trojans, etc. from damaging the system or stealing sensitive information by modifying the registry.

[0051] Compare the character length of the identification information with the preset security rules in the registry protection software. If the character length of the identification information is less than the character length of the preset security rules, it means that the registry operation request complies with the preset security rules. Otherwise, character content recognition is performed on the identification information and the preset security rules respectively. Among them, comparing the character length of the identification information with the preset security rules in the registry protection software includes the following detailed steps: Segmentation: First, the identification information and the preset security rules in the registry protection software need to be segmented. The purpose is to split the long string into smaller, more manageable units to facilitate subsequent length comparison and analysis. The basis for segmentation can be spaces, punctuation marks, or specific separators, depending on the format and content structure of the preset security rules.

[0052] Calculate string length: Calculate the length of each segmented string. This involves calculating the number of characters in each segmented string. This step requires a predefined character counting rule to ensure that each character is counted uniformly and correctly. It can be a simple character count, or a more complex weighted calculation (e.g., certain characters or letters may be given different weights based on their semantic importance).

[0053] Compare string lengths: Compare the length of the string after segmentation of the identification information with the length of the string after segmentation according to the preset security rules in the registry protection software. The result of this comparison will be used to determine whether the identification information meets or is close to the requirements of the preset security rules. By comparing the length of each corresponding segment, the consistency or difference of the identification information can be preliminarily evaluated.

[0054] Semantic analysis is performed on the character content of the identification information and the character content of the preset security rules respectively, and based on the results of the semantic analysis, it is determined whether the identification information contains the semantic features defined in the preset security rules. If so, the permission status in the identification information is analyzed. Otherwise, it means that the operation request of the registry does not comply with the preset security rules.

[0055] Among them, before the identification information is segmented with the preset security rules in the registry protection software, a preprocessing step is required to ensure the accuracy and consistency of the data. Among them, deleting invisible characters is an important part of preprocessing. Invisible characters may include spaces, tabs, line breaks, carriage returns, etc. These characters occupy positions in the string but are usually not displayed. If these invisible characters are not deleted, they may affect the subsequent segmentation processing and length calculation, resulting in inaccurate results. Therefore, before the segmentation process, the identification information and preset security rules need to be preprocessed to delete the invisible characters. This can be achieved by using specific string processing functions or regular expressions to ensure the purity and consistency of the data.

[0056] In addition, the performing semantic analysis on the character content of the identification information and the character content of the preset security rule respectively, and judging whether the identification information contains the semantic features defined in the preset security rule according to the semantic analysis result includes: We extensively collect professional literature, technical documents, user manuals and other text materials related to the registry to build a comprehensive and rich registry knowledge text library.

[0057] Perform text processing on the text in the registry knowledge text base, including deleting irrelevant characters (such as punctuation marks, numbers, special symbols, etc.) and performing word segmentation for subsequent analysis.

[0058] In the text after word segmentation, natural language processing technology is used to identify entity words related to the registry, such as registry entries, key values, data types, etc., and these entity words are annotated with specific coverage tags.

[0059] The text that has been processed by word segmentation and entity vocabulary annotation is used as a semantic training sample for subsequent language model training.

[0060] The pre-trained language model is further trained using semantic training samples. The language model includes an encoder and an output layer. The encoder is responsible for extracting the semantic vector of the text, while the output layer generates the corresponding output based on the semantic vector.

[0061] Using the trained language processing model, the semantic features of the character content of the recognition information and preset security rules are extracted and converted into numerical semantic vectors.

[0062] A similarity measurement method (such as cosine similarity) is used to calculate the similarity between the semantic vector of the identification information and the semantic vector of the preset security rule.

[0063] A similarity threshold is set, and the calculated semantic similarity is compared with the threshold. If the semantic similarity is greater than the preset threshold, it is considered that the identification information contains the semantic features defined in the preset security rules; otherwise, it is considered that the identification information does not contain these semantic features.

[0064] In one embodiment, the analyzing the permission status in the identification information includes: Parse the permission type in the identification information to obtain the requested permission; Extract and parse the permission definitions in the preset security rules; Compare the requested permissions with the permissions defined in the rules. If the requested permissions meet the permission definitions in the preset security rules, it means that the operation request is allowed to be executed and is controlled according to the preset control mode. Otherwise, it means that the operation request of the registry does not meet the preset security rules.

[0065] It should be noted that in the context of registry protection, comparing the permissions in the operation request with the permissions defined in the preset security rules is a key step. The following is a detailed explanation of this process: Parse the requested permission information from the operation request, which usually involves the permission to read, write, modify or delete the registry.

[0066] Retrieve permission definitions related to the current operation request from the preset security rule base. These rules define which operations are allowed and which permissions are required to perform these operations.

[0067] The permission information in the operation request is compared with the permission definition in the preset security rules one by one. This includes checking the type of operation requested (such as read, write, etc.) and whether the requester has the required permissions to perform the operation.

[0068] Based on the comparison results, determine whether the permissions in the operation request meet the permission definition in the preset security rules. If the permissions in the request completely match the definition in the rule, or the requester has a higher level of permissions, then the permissions are considered to be met.

[0069] Based on the result of rule judgment, if the identification information meets the security rules, the registry protection software allows the operation request to be executed; otherwise, the registry protection software does not allow the operation request to be executed and generates response information; the steps are as follows: the registry protection software first extracts the relevant information in the operation request, such as the operation type, operation object, requester identity, etc. Then, the software compares this information with the preset rules to determine whether the operation request meets the definition of the rules.

[0070] If the operation request meets the definition of the rule, the registry protection software will decide to allow the execution of the operation request. If the operation request does not meet the definition of the rule, the software will decide to deny the execution of the operation request.

[0071] Regardless of whether the operation request is allowed or denied, the registry protection software will generate corresponding response information. For an allowed operation request, the response information may include confirmation of successful operation, details of the execution result, etc. For a denied operation request, the response information may include the reason for denial, details of the violation, recommended corrective measures, etc.

[0072] Finally, the registry protection software will return the generated response information to the initiator of the operation request. The initiator can understand the execution result of the operation request and whether further action is needed based on the response information.

[0073] After the registry protection software processes the operation request and generates response information, it will send this information to the operation end. After receiving the response information, the operation end will perform corresponding protection operations based on the content. The following are the detailed steps of this process: The registry protection software packages the generated response information into an appropriate format, such as JSON, XML, etc. The software sends the response information to the operation end through a predetermined communication channel, such as HTTP, TCP / IP, etc.

[0074] The operation end listens to the communication channel from the registry protection software and waits for the response information. Once the response information is received, the operation end will parse it and extract the content.

[0075] Based on the content in the response information, the operator will determine whether the operation request is allowed to be executed. If the operation request is allowed, the operator will continue to execute subsequent operation steps, such as accessing the registry, modifying the configuration, etc. If the operation request is rejected, the operator will stop executing subsequent steps and take corresponding protective measures according to the suggestions in the response information, such as recording logs, notifying administrators, etc.

[0076] After the operation is completed, the operation end will feedback the execution results to the registry protection software so that the software can further monitor and manage. The feedback execution results include whether the operation is successful, whether an error is encountered, whether further processing is required, etc.

[0077] In this way, a closed-loop protection mechanism is formed between the registry protection software and the operation end. The software is responsible for monitoring and judging the legitimacy of the operation request, while the operation end performs corresponding protection operations based on the software's response information, jointly ensuring the security and stability of the registry.

[0078] Figure 2 An embodiment of a software-based registry protection system of the present invention is shown.

[0079] In this optional embodiment, the software-based registry protection system includes: The operation request capturing module 201 is used for the operation end to capture the operation request of the registry and send the identification information of the operation request to the registry protection software; The rule judgment module 203 is used to perform security rule judgment on the identification information based on the registry protection software to obtain a rule judgment result; A response information generating module 205 is used to determine the result based on the rules. If the identification information meets the security rules, the registry protection software allows the execution of the operation request. Otherwise, the registry protection software does not allow the execution of the operation request and generates response information. The operation execution module 207 is used for the registry protection software to send the response information to the operation end, and the operation end executes the corresponding protection operation according to the response information.

[0080] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store static information and dynamic information data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in the above method embodiment are implemented.

[0081] Those skilled in the art will understand that Figure 3The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0082] In addition, the present invention also provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiment when executing the computer program.

[0083] In addition, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0084] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0085] The present invention is not limited to the structures which have been described above and shown in the drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A software-based registry protection method, characterized in that: include: The operation end captures the operation request of the registry and sends the identification information of the operation request to the registry protection software; Based on the registry protection software, the security rules of the identification information are judged to obtain the rule judgment result; Based on the result of the rule judgment, if the identification information complies with the security rule, the registry protection software allows the execution of the operation request; otherwise, the registry protection software does not allow the execution of the operation request and generates a response message; The registry protection software sends the response information to the operation end, and the operation end performs corresponding protection operations according to the response information.

2. The software-based registry protection method according to claim 1, characterized in that: The registry-based protection software performs security rule judgment on the identification information, and obtains the rule judgment result including: Compare the character length of the identification information with the preset security rules in the registry protection software. If the character length of the identification information is less than the character length of the preset security rules, it means that the registry operation request complies with the preset security rules. Otherwise, character content recognition is performed on the identification information and the preset security rules respectively. Semantic analysis is performed on the character content of the identification information and the character content of the preset security rules respectively, and based on the results of the semantic analysis, it is determined whether the identification information contains the semantic features defined in the preset security rules. If so, the permission status in the identification information is analyzed. Otherwise, it means that the operation request of the registry does not comply with the preset security rules.

3. The software-based registry protection method according to claim 2, characterized in that: The character length comparison of the identification information with the preset security rules in the registry protection software includes: Separately process the identification information and the security rules preset in the registry protection software; Using the predefined character calculation rules, calculate the length of each segmented string; The length of the segmented character string of the identification information is compared with the length of the segmented character string according to the preset security rule in the registry protection software to obtain a comparison result.

4. The software-based registry protection method according to claim 3, characterized in that: The process of segmenting the identification information and the preset security rules in the registry protection software includes: Preprocessing is performed on the identification information and the preset security rules in the registry protection software respectively, wherein the preprocessing is to delete invisible characters.

5. The software-based registry protection method according to claim 4, characterized in that: The performing semantic analysis on the character content of the identification information and the character content of the preset security rule respectively, and judging whether the identification information contains the semantic features defined in the preset security rule according to the semantic analysis result includes: Construct and train a language processing model, and use the trained language processing model to encode the character content of the recognition information and the character content of the preset security rules to generate a semantic vector; Calculate the semantic similarity between the identification information and the preset security rules according to the generated semantic vector; The semantic similarity is compared with a preset similarity threshold. If the semantic similarity is greater than the preset similarity threshold, it means that the identification information contains the semantic features defined in the preset. Otherwise, it means that the identification information does not contain the semantic features defined in the preset.

6. The software-based registry protection method according to claim 5, characterized in that: The constructing and training of the language processing model, using the trained language processing model to encode the character content of the identification information and the character content of the preset security rules respectively, and generating a semantic vector includes: Perform word segmentation and entity full-word coverage on the text in the collection registry knowledge text library to obtain semantic training samples; Performing semantic training on a pre-trained language model using semantic training samples; the pre-trained language model includes an encoder and an output layer, the encoder is used to extract a semantic vector, and the output layer is used to generate a corresponding output according to the semantic vector; The trained language processing model is used to extract the semantic features of the character content of the recognition information and the character content of the preset security rules, and convert them into semantic vectors.

7. The software-based registry protection method according to claim 6, characterized in that: The text in the collection registry knowledge text library is segmented and entity full-word covered to obtain semantic training samples including: Collect a knowledge text base about the registry; Performing text processing and word segmentation processing on the text in the registry knowledge text library, wherein the text processing includes removing irrelevant characters in the text; For the text after word segmentation, identify and mark the entity words related to the registration form, and use the covering tags to cover the entity words; The text after word segmentation and entity vocabulary coverage is used as semantic training samples.

8. The software-based registry protection method according to claim 7, characterized in that: The calculation formula for calculating the semantic similarity between the identification information and the preset security rules based on the generated semantic vector is: ； In the formula, S represents the semantic similarity between the identification information and the preset security rules; V i Semantic vector representing identification information; V ik The eigenvalue of the kth semantic vector in the semantic vector representing the identification information; V j A semantic vector representing a preset security rule; V jk The eigenvalue of the kth semantic vector in the semantic vector representing the preset security rule; n represents the total number of semantic vectors of identification information.

9. The software-based registry protection method according to claim 1, characterized in that: The analysis of the permission status in the identification information includes: Parse the permission type in the identification information to obtain the requested permission; Extract and parse the permission definitions in the preset security rules; Compare the requested permissions with the permissions defined in the rules. If the requested permissions meet the permission definitions in the preset security rules, it means that the operation request is allowed to be executed and is controlled according to the preset control mode. Otherwise, it means that the operation request of the registry does not meet the preset security rules.

10. A software-based registry protection system, characterized in that: include: An operation request capture module is used for the operation end to capture the operation request of the registry and send the identification information of the operation request to the registry protection software; A rule judgment module is used to perform security rule judgment on the identification information based on the registry protection software to obtain the rule judgment result; A response information generation module is used to determine the result based on the rules. If the identification information meets the security rules, the registry protection software allows the execution of the operation request. Otherwise, the registry protection software does not allow the execution of the operation request and generates response information. The operation execution module is used for the registry protection software to send response information to the operation end, and the operation end executes corresponding protection operations according to the response information.

Images