Program detection method and device, computer equipment and storage medium
By capturing function detection process creation and obtaining the type and permission information of the target program, the problem that whitelist detection is prone to false positives is solved, and the accuracy of process trustworthiness detection and the normal operation of computer equipment is ensured.
Patent Information
- Application Number
- CN202311268269.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-09-26
- Publication Date
- 2025-03-28
AI Technical Summary
Existing program detection methods based on whitelist detection are prone to false alarms, affecting the normal operation of computer equipment.
When a process is created is detected by the capture function, the type and permission information of the target program are obtained. If the type of the target program is the target type and carries the target permission identifier, alarm information is output; otherwise, in response to the instruction triggered by the process, the operation corresponding to the instruction is executed.
Effectively predict whether the corresponding program of the process is at risk of being attacked, avoid false alarms, and ensure the normal operation of computer equipment.
Smart Images
Figure CN119720180A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a program detection method, device, computer equipment and storage medium. Background Art
[0002] A special program is a program with special permissions. Based on this special program, the permissions of other programs can be modified. Therefore, when the permissions of the special program are destroyed, other programs will also be affected, thereby affecting the normal operation of the computer. Whether the program is trustworthy can reflect whether the program is at risk of permissions being destroyed. Therefore, how to detect the program to determine whether the program is trustworthy is the focus of research in this field.
[0003] Currently, commonly used detection methods include adding an instruction whitelist to a special program. When the process corresponding to the special program executes instructions outside the whitelist, the special program is determined to be untrustworthy.
[0004] However, the above whitelist-based detection is prone to false positives, affecting the normal operation of computer equipment. Summary of the invention
[0005] The embodiment of the present application provides a program detection method, apparatus, computer equipment and storage medium for realizing the normal operation of the computer equipment. The technical solution is as follows:
[0006] In one aspect, a program detection method is provided, the method comprising:
[0007] In response to detecting that any process is created through a capture function associated with a target system call, a type of a target program is obtained based on the process, the target program being a program corresponding to the process;
[0008] If the type of the target program is the target type, obtain the permission information of the target program; if the type of the target program is the non-target type, respond to the instruction triggered by the process and execute the operation corresponding to the instruction;
[0009] If the permission information of the target program carries the target permission identifier, an alarm message is output; if the permission information of the target program does not carry the target permission identifier, an operation corresponding to the instruction is executed in response to the instruction triggered by the process.
[0010] On the other hand, a program detection device is provided, the device comprising:
[0011] A type acquisition module, for, in response to detecting that any process is created through a capture function associated with a target system call, acquiring the type of a target program based on the process, the target program being a program corresponding to the process;
[0012] A permission determination module, for obtaining permission information of the target program if the type of the target program is the target type, and for executing an operation corresponding to the instruction in response to the instruction triggered by the process if the type of the target program is the non-target type;
[0013] An alarm module, used to output alarm information if the permission information of the target program carries the target permission identifier;
[0014] The operation execution module is used to execute the operation corresponding to the instruction in response to the instruction triggered by the process if the permission information of the target program does not carry the target permission identifier.
[0015] In some embodiments, the operation execution module is further used to stop executing the instruction triggered by the process if the permission information of the target program carries a target permission identifier.
[0016] In some embodiments, the apparatus further comprises:
[0017] A first detection module, used for detecting instructions triggered during the period of stopping the execution of the process;
[0018] The alarm module is used to determine that the current situation is an attack scenario if the instruction is a write instruction for the target content, and output a first alarm message, wherein the first alarm message is used to prompt that the system is suspected of being attacked; if the instruction is a write instruction for content other than the target content, it is determined that the current situation is an error setting scenario, and output a second alarm message, wherein the second alarm message is used to prompt that an error occurs in the permission setting.
[0019] In some embodiments, the apparatus further comprises:
[0020] The second detection module is used to detect the user's authority;
[0021] The alarm module is used to determine that the system is currently in an attack scenario if the user's authority is not the highest authority, and output a first alarm message, wherein the first alarm message is used to prompt that the system is suspected of being attacked; if the user's authority is the highest authority, it is determined that the system is currently in an error setting scenario, and output a second alarm message, wherein the second alarm message is used to prompt that an error has occurred in the authority setting.
[0022] In some embodiments, the apparatus further comprises:
[0023] The association module is used to associate the capture function with the target system call based on the system swap table replacement technology when the system is started.
[0024] In some embodiments, the type acquisition module is used to:
[0025] Based on the file path of the process, obtaining the file of the target program;
[0026] If the file attribute information of the file includes an identifier corresponding to the target type, determining the type of the target program as the target type;
[0027] If the file attribute information of the file does not include an identifier corresponding to the target type, the type of the target program is determined to be a non-target type.
[0028] On the other hand, a computer device is provided, which includes a processor and a memory, the memory being used to store at least one computer program, and the at least one computer program being loaded and executed by the processor to implement the operations performed by the program detection method in the embodiment of the present application.
[0029] On the other hand, a computer-readable storage medium is provided, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor to implement operations performed by the program detection method in the embodiment of the present application.
[0030] On the other hand, a computer program product or a computer program is provided, which includes a computer program code, and the computer program code is stored in a computer-readable storage medium. A processor of a computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device executes the program detection method provided in various optional implementations of any of the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0032] Figure 1 It is a schematic diagram of an implementation environment of a program detection method provided according to an embodiment of the present application;
[0033] Figure 2 is a flow chart of a program detection method provided according to an embodiment of the present application;
[0034] Figure 3 is a flow chart of a program detection method provided according to an embodiment of the present application;
[0035] Figure 4 It is a flowchart of a program detection method provided according to an embodiment of the present application;
[0036] Figure 5is a block diagram of a program detection device provided according to an embodiment of the present application;
[0037] Figure 6 is a structural block diagram of a computer device provided according to an embodiment of the present application;
[0038] Figure 7 It is a structural diagram of a server provided according to an embodiment of the present application. DETAILED DESCRIPTION
[0039] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.
[0040] In this application, the terms "first", "second", etc. are used to distinguish identical or similar items with basically the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there any limitation on quantity and execution order.
[0041] In the present application, the term "at least one" means one or more, and the term "plurality" means two or more.
[0042] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.
[0043] For ease of understanding, the terms involved in this application are explained below.
[0044] Special programs: programs with special permissions, SUID (Set User ID) programs or programs with SetUID Cap (Set UserID Capability).
[0045] SUID program: A program with SUID permissions, which can replace the file's permission owner.
[0046] SetUID Cap program: A program with functionality that allows the user ID of a process to be changed.
[0047] Hook technology: Hook function, the hook function is part of the Windows message processing mechanism. By setting a "hook", the application can filter all messages and events at the system level and access messages or events that cannot be accessed under normal circumstances.
[0048] EDR (Endpoint Detection and Response): A visualization device used to implement threat detection, security reinforcement, asset discovery, and response forensics.
[0049] Root privileges: The privileges possessed by the super administrator user account. This account has supreme privileges over the entire system and can operate all objects in the system.
[0050] Figure 1 Schematic diagram of an implementation environment of a program detection method provided according to an embodiment of the present application. Figure 1 , the implementation environment includes a computer device 101 and a server 102 .
[0051] The computer device 101 and the server 102 can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.
[0052] In some embodiments, the computer device 101 is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The computer device 101 has an application program installed and running that supports program detection. Schematically, the computer device 101 is a terminal used by a user, and the user can trigger the program detection function by executing instructions on the computer device 101 to display the corresponding detection results, so as to realize the detection of the program corresponding to the process.
[0053] In some embodiments, server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), big data and artificial intelligence platforms. Server 102 is used to provide background services for applications that support program detection. In some embodiments, server 102 undertakes the main computing work and computer device 101 undertakes the secondary computing work; or, server 102 undertakes the secondary computing work and computer device 101 undertakes the main computing work; or, server 102 and computer device 101 use a distributed computing architecture for collaborative computing.
[0054] Those skilled in the art will appreciate that the number of the above terminals may be more or less. For example, the above terminal may be only one, or the above terminals may be dozens or hundreds, or more. The embodiment of the present application does not limit the number of terminals and device types.
[0055] In some embodiments, the wireless network or wired network described above uses standard communication technology and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network. In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged over the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.
[0056] Figure 2 is a flow chart of a program detection method provided according to an embodiment of the present application, such as Figure 2 As shown, in the embodiment of the present application, a computer device is used as an example for explanation. The program detection method comprises the following steps:
[0057] 201. In response to detecting that any process is created through a capture function associated with a target system call, a type of a target program is obtained based on the process, where the target program is a program corresponding to the process.
[0058] In some embodiments, the target system call is a system call related to process creation, such as an exec system call (a system call of a Linux system). When a process is created, the system call is triggered to perform tasks such as job scheduling and providing services. Therefore, based on the target system call, the newly created process can be detected. A process is an execution instance of a program. A program is an executable file stored on a disk. When a program is executed, a system call is required to read it into a memory. This execution process is also the creation of a process.
[0059] In some embodiments, the capture function is a custom function used to implement some specific functions. In an embodiment of the present application, it is used to detect the creation of a new process and obtain the type of the target program corresponding to the process.
[0060] In some embodiments, when a target system call is triggered, a capture function associated with the system call is called, thereby detecting a newly created process, and then based on the process, detecting a target program corresponding to the process, and further obtaining the type of the target program.
[0061] 202. If the type of the target program is a target type, obtain permission information of the target program; if the type of the target program is a non-target type, respond to the instruction triggered by the process and execute an operation corresponding to the instruction.
[0062] Among them, the target type refers to a special program type, that is, a program with special permissions. Since the special program can modify the permissions of other programs, the functions of the kernel state of the computer operating system can be modified through the special program, thereby affecting the normal operation of the computer device. Therefore, it is necessary to detect the target program of this target type to ensure the normal operation of the computer device.
[0063] In some embodiments, if it is found that the type of the target program is the target type after acquisition, the target program is at risk of being attacked, and the permission information of the target program is acquired for the next step of determination.
[0064] In some embodiments, if it is found after acquisition that the type of the target program is a non-target type, the issue of permission modification will not be involved when the target program is executed. Therefore, the program does not face the risk of being attacked and has no impact on the operation of the computer device. It further responds to the instructions triggered by the corresponding process of the program and executes the operations corresponding to the instructions.
[0065] 203. If the permission information of the target program carries the target permission identifier, output alarm information; if the permission information of the target program does not carry the target permission identifier, respond to the instruction triggered by the process and execute the operation corresponding to the instruction.
[0066] Among them, the permission information is used to indicate the access rights of the target program, that is, which authorized users can perform read or write operations on the target program. In an embodiment of the present application, the target permission identifier is used to determine the write permission of the target program, including user group user write permission and non-user group user write permission. For example, the target permission identifier is a S_IWOTH mask, which is used to indicate non-user group user write permission, that is, any user write permission.
[0067] In some embodiments, based on determining that the type of the target program is the target type, the permission information of the target program is further determined. If the permission information of the target program carries the target permission identifier S_IWOTH, the write permission of the target program is the write permission of the non-user group user, that is, any user can modify the target program. In this case, the target program is at risk of being attacked, and an alarm message is output.
[0068] In some embodiments, if the permission information of the target program does not carry the target permission identifier S_IWOTH, the write permission of the target program is the write permission of the user group user, and only the user group user can modify the target program, and further respond to the instruction triggered by the corresponding process of the target program to execute the operation corresponding to the instruction.
[0069] The method provided in the embodiment of the present application can detect the creation behavior of a process based on a capture function and obtain the type of program corresponding to the process. The detection of the process creation behavior is implemented based on the association of the capture function with the target system call. If the program type of the program is the target type and the permission information of the program carries the target permission identifier, an alarm message is output, indicating that the process is at risk of being attacked. If the program type of the program is not the target type or the permission information of the program does not carry the target permission identifier, then in response to the instruction triggered by the process, the operation corresponding to the instruction is executed to enable the process to run normally. This method can predict whether the program corresponding to the process is at risk of being attacked and does not generate false alarms, so that the computer device can run normally.
[0070] Figure 3 is a flow chart of a program detection method provided according to an embodiment of the present application, such as Figure 3 As shown, in the embodiment of the present application, a computer device is used as an example for explanation. The program detection method comprises the following steps:
[0071] 301. Load the Linux driver when the system starts and associate the capture function with the target system call.
[0072] Among them, after the Linux driver is loaded, it can be linked with the system call to realize the association between the target system call and the capture function. Moreover, after the system is shut down, the generated data after the association will be cleared. Therefore, the association operation will be performed every time the system is started.
[0073] In some embodiments, the capture function is associated with the target system call based on kernel hook technology. For example, the association is achieved based on system call table replacement technology. Based on the system call number of the exec system call in the system call table, the interface of the exec system call in the system call table is retrieved, and the pointer at the interface is connected to the interface of the capture function, thereby achieving association.
[0074] Based on the kernel hook technology, the system can be started in any kernel version and program detection can be implemented, thereby improving the compatibility of the system.
[0075] 302. In response to detecting that any process is created through a capture function associated with a target system call, program information of a target program is obtained based on the process, where the target program is a program corresponding to the process.
[0076] The program information includes the type of the target program and permission information, etc., and is stored in the form of a file. The file can be retrieved based on the file path, and the file path is stored in the process information of the process.
[0077] In some embodiments, the process information of the process is stored in the task_struct structure of the operating system kernel, which is used to provide the file path of the process when the target system call is triggered. Therefore, when the process is created, the file path of the process can be obtained based on the target system call, and the file of the target program can be obtained based on the file path. For example, the file path name is obtained based on the task_struct->mm->exe_file->f_path field, which is the path descriptor of the target program, and the file is obtained based on the obtained file path name.
[0078] Among them, the content in the target program file is the program information, which can be accessed based on some specific functions and obtained after the access. For example, the program information of the target program is queried based on the api vfs_getattr(task_struct->mm->exe_file->f_path,&stat) function, and after the path descriptor task_struct->mm->exe_file->f_path of the target program is passed into the above function, the program information of the target program will be filled into the stat structure, and then the next step of judgment will be made based on the stat structure.
[0079] 303. The program information is passed to a rule engine, and the rule engine is used to detect the target program based on the program information.
[0080] Among them, the rule engine is an encapsulated library used to execute custom rules to implement the detection function of the embodiment of the present application. The content of the custom rules includes whether the type of the target program is the target type and whether the target program carries the target permission identifier. The program information transmitted is analyzed based on the rule to detect the type of the target program.
[0081] 304. If the type of the target program is determined to be the target type through the rule engine, the permission information of the target program is obtained.
[0082] If the program information of the target program includes an identifier corresponding to the target type, the type of the target program is determined as the target type.
[0083] In some embodiments, the identifier corresponding to the target type is a symbolic mask of the program. For example, the above-mentioned stat structure has been filled with the program information of the target program. Therefore, it is only necessary to identify the information in the structure. For example, based on the stat.mode&S_ISUID field, it is possible to determine whether the target program is a SUID program. The stat in the field is the above-mentioned stat structure. The field is used to determine whether the stat structure has a S_ISUID identifier, wherein the S_ISUID identifier is embodied in a mask form, and the stat structure includes the S_ISUID identifier. If the output result is 1, it can be determined that the target program is a SUID program, and the type of the target program is determined to be the target type. Further, the permission information of the target program is obtained, which is the same as step 203. If the stat structure does not include the S_ISUID identifier, the output result is 0, and the type of the target program is determined to be a non-target type.
[0084] In some embodiments, the type of the target program can also be determined based on the process information of the process. For example, based on the API ns_capable (task_struct->cred->user_ns, cap) function, it is queried whether the process has cap capability, and the cap capability refers to the ability to modify the user ID of the process, such as setuid_cap capability or setgid_cap capability. In the embodiment of the present application, based on the CAP_SETUID (cap) field in the function, it is queried whether the process has setuid_cap capability. If the setuid_cap capability exists, the target program is determined to be the target type. If the setuid_cap capability does not exist, the target program is determined to be a non-target type. Among them, CAP_SETUID can be a setuid_cap mask.
[0085] 305. If the permission information of the target program carries the target permission identifier, stop executing the instruction triggered by the process corresponding to the target program and output alarm information.
[0086] In some embodiments, similar to step 203, if it is determined that the permission information of the target program carries a target permission identifier, then the target program of the target type is writable by any user and there is a risk of being attacked, then the execution of the instructions triggered by the process corresponding to the program is stopped, and further, the instructions triggered during the period of stopping the execution of the process are detected. The detection operation is used to determine the scenario in which the process is located, thereby providing corresponding alarm information based on the scenario, wherein, if the instruction is a write instruction for the target program, it is determined that it is currently in an attack scenario, and a first alarm message is output, and the first alarm message is used to prompt that the system is suspected of being attacked; if the instruction is a write instruction for content other than the target program, it is determined that it is currently in an error setting scenario, and a second alarm message is output, and the second alarm message is used to prompt that an error has occurred in the permission setting, wherein the alarm message is output by the rule engine, and is received by the EDR and displayed visually, thereby realizing real-time feedback of the alarm information.
[0087] In some embodiments, after determining that the target process of the target type is at risk of being attacked, the scenario in which the process is located can also be determined by detecting user permissions, wherein the permissions of the user who triggers the process creation instruction are detected. If the user's permissions are not Root permissions, the user has an attack purpose, and the user can be determined to be an attacker, then it is determined that the process is currently in an attack scenario, and the first alarm information is also output; if the user's permissions are Root permissions, then the user does not have an attack purpose, then it is determined that the process is currently in an error setting scenario, and the second alarm information is also output.
[0088] In some embodiments, before outputting the alarm information, the rule engine can also record the file path of the process, add the file path to the alarm information and output it to the EDR, which helps the administrator locate the program corresponding to the process after receiving the alarm information.
[0089] In some embodiments, the determination of the scenario in which the process is located can ensure that errors in setting special program permissions and attacks by attackers can be captured by the system without generating false alarms and affecting the normal operation of the computer device.
[0090] 306. If the permission information of the target program does not carry the target permission identifier, in response to the instruction triggered by the process corresponding to the target program, execute the operation corresponding to the instruction.
[0091] In some embodiments, similar to step 203, if it is determined that the permission information of the target program does not carry the target permission identifier, the target program does not have the risk of being attacked, and further responds to the instruction triggered by the process corresponding to the target program to execute the operation corresponding to the instruction.
[0092] 307. If the type of the target program is determined to be a non-target type through the rule engine, in response to the instruction triggered by the process corresponding to the target program, an operation corresponding to the instruction is executed.
[0093] In some embodiments, similar to the determination method of step 304, if the program information of the target program does not include an identifier corresponding to the target type, the type of the target program is determined to be a non-target type. Similar to step 202, it can be determined that the target program does not have a risk of being attacked, and further in response to the instruction triggered by the process corresponding to the target program, the operation corresponding to the instruction is executed.
[0094] In some embodiments, after the rule engine detects the target program, a label can be added to the target program before outputting the detection result, and the label is used to indicate whether the target program is credible. If the target program is determined to be a target type and carries a target permission identifier based on the detection process, an untrusted label is added to the target program. If the process of the target program is triggered again, the rule engine can directly determine the target program as untrusted based on the added label, and then alarm. If the target program is determined to be a non-target type or a target type but does not carry a target permission identifier based on the detection process, a trusted label is added to the target program. If the process of the target program is triggered again, the rule engine can directly determine the target program as credible based on the added label, and the subsequent detection process will not be continued, which greatly reduces the processing pressure of the rule engine and saves computing resources.
[0095] In some embodiments, the process of implementing program detection in steps 301-307 can be found in Figure 4 , Figure 4 is a flowchart of a program detection method provided according to an embodiment of the present application, such as Figure 4 As shown, the main process of the method is: first start the system and start loading the driver. After loading the driver, associate the target system call with the capture function, so as to use the associated capture function to respond to the process creation behavior and detect that the process is created. Then, based on the process, detect the program corresponding to the process, that is, the target program, and judge the target program. If the target program type is the target type, further determine whether the target program carries the target permission identifier. If the target program type is not the target type, execute the operation corresponding to the process instruction. If the target program carries the target permission identifier, output an alarm message. If the target program does not carry the target permission identifier, execute the operation corresponding to the process instruction.
[0096] The method provided in the embodiment of the present application, after the system is started, associates the capture function with the target system call, so that the capture function can accurately detect the creation behavior of the process, thereby obtaining the information of the process, and then detects the program type and permission information of the program corresponding to the process. If the program type of the program is the target type and the permission information of the program carries the target permission identifier, an alarm information is output based on the EDR. If the program type of the program is not the target type or the permission information of the program does not carry the target permission identifier, the operation corresponding to the instruction is executed in response to the instruction triggered by the process. The system created by this method can be started in different kernels, and after predicting whether the program corresponding to the process is at risk of being attacked, real-time feedback is provided to the user, and no false alarms are generated, and the normal operation of the computer device is not affected.
[0097] Figure 5 is a block diagram of a program detection device provided according to an embodiment of the present application. The device is used to execute the steps of the above program detection method. Figure 5 , the device comprises:
[0098] The type acquisition module 501 is used for, in response to detecting that any process is created through a capture function associated with a target system call, acquiring the type of a target program based on the process, where the target program is a program corresponding to the process;
[0099] The permission determination module 502 is used to obtain permission information of the target program if the type of the target program is the target type, and to execute an operation corresponding to the instruction in response to the instruction triggered by the process if the type of the target program is the non-target type;
[0100] An alarm module 503 is used to output an alarm message if the permission information of the target program carries a target permission identifier;
[0101] The operation execution module 504 is used to execute the operation corresponding to the instruction in response to the instruction triggered by the process if the permission information of the target program does not carry the target permission identifier.
[0102] In some embodiments, the operation execution module is further used to stop executing the instruction triggered by the process if the permission information of the target program carries the target permission identifier.
[0103] In some embodiments, the apparatus further comprises:
[0104] A first detection module, used to detect instructions triggered during the period of stopping the execution process;
[0105] The alarm module is used to determine that the current situation is an attack scenario if the instruction is a write instruction for the target content, and output a first alarm message, and the first alarm message is used to prompt that the system is suspected of being attacked; if the instruction is a write instruction for content other than the target content, it is determined that the current situation is an error setting scenario, and output a second alarm message, and the second alarm message is used to prompt that an error occurs in the permission setting.
[0106] In some embodiments, the apparatus further comprises:
[0107] The second detection module is used to detect the user's authority;
[0108] The alarm module is used to determine that the system is currently in an attack scenario if the user's authority is not the highest authority, and output a first alarm message. The first alarm message is used to prompt that the system is suspected of being attacked; if the user's authority is the highest authority, it is determined that the system is currently in an error setting scenario, and output a second alarm message. The second alarm message is used to prompt that an error has occurred in the authority setting.
[0109] In some embodiments, the apparatus further comprises:
[0110] The association module is used to associate the capture function with the target system call based on the system swap table replacement technology when the system starts.
[0111] In some embodiments, the type acquisition module is used to:
[0112] Get the target program's file based on the process's file path;
[0113] If the file attribute information of the file includes an identifier corresponding to the target type, the type of the target program is determined as the target type;
[0114] If the file attribute information of the file does not include an identifier corresponding to the target type, the type of the target program is determined to be a non-target type.
[0115] It should be noted that: the program detection device provided in the above embodiment only uses the division of the above functional modules as an example when detecting a program. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the program detection device provided in the above embodiment and the program detection method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.
[0116] Figure 61 is a block diagram of a computer device 600 provided according to an embodiment of the present application. The computer device 600 may be a portable mobile terminal, such as a smart phone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer or a desktop computer. The computer device 600 may also be referred to as a user device, a portable terminal, a laptop terminal, a desktop terminal or other names.
[0117] Typically, the computer device 600 includes a processor 601 and a memory 602 .
[0118] The processor 601 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 601 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 601 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 601 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 601 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.
[0119] The memory 602 may include one or more computer-readable storage media, which may be non-transitory. The memory 602 may also include a high-speed random access memory and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 602 is used to store at least one computer program, which is used to be executed by the processor 601 to implement the program detection method provided in the method embodiment of the present application.
[0120] In some embodiments, the computer device 600 may further optionally include: a peripheral device interface 603 and at least one peripheral device. The processor 601, the memory 602 and the peripheral device interface 603 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface 603 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 604, a display screen 605, a camera assembly 606, an audio circuit 607 and a power supply 608.
[0121] The peripheral device interface 603 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 601 and the memory 602. In some embodiments, the processor 601, the memory 602, and the peripheral device interface 603 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 601, the memory 602, and the peripheral device interface 603 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.
[0122] The radio frequency circuit 604 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 604 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency circuit 604 converts the electrical signal into an electromagnetic signal for transmission, or converts the received electromagnetic signal into an electrical signal. In some embodiments, the radio frequency circuit 604 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. The radio frequency circuit 604 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 604 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.
[0123] The display screen 605 is used to display the UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 605 is a touch display screen, the display screen 605 also has the ability to collect touch signals on the surface or above the surface of the display screen 605. The touch signal can be input to the processor 601 as a control signal for processing. At this time, the display screen 605 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 605 can be one, set on the front panel of the computer device 600; in other embodiments, the display screen 605 can be at least two, respectively set on different surfaces of the computer device 600 or in a folding design; in other embodiments, the display screen 605 can be a flexible display screen, set on the curved surface or folding surface of the computer device 600. Even, the display screen 605 can also be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 605 can be made of materials such as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode, organic light-emitting diode).
[0124] The camera assembly 606 is used to capture images or videos. In some embodiments, the camera assembly 606 includes a front camera and a rear camera. Typically, the front camera is disposed on the front panel of the terminal, and the rear camera is disposed on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize the panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 606 may also include a flash. The flash may be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.
[0125] The audio circuit 607 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 601 for processing, or input them into the radio frequency circuit 604 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there may be multiple microphones, which are respectively arranged at different parts of the computer device 600. The microphone may also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 601 or the radio frequency circuit 604 into sound waves. The speaker may be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 607 may also include a headphone jack.
[0126] The power supply 608 is used to power various components in the computer device 600. The power supply 608 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 608 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged through a wired line, and a wireless rechargeable battery is a battery that is charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.
[0127] In some embodiments, the computer device 600 further includes one or more sensors 609 , including but not limited to: an acceleration sensor 610 , a gyroscope sensor 611 , a pressure sensor 612 , an optical sensor 613 , and a proximity sensor 614 .
[0128] The acceleration sensor 610 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established by the computer device 600. For example, the acceleration sensor 610 can be used to detect the components of gravity acceleration on the three coordinate axes. The processor 601 can control the display screen 605 to display the user interface in a horizontal view or a vertical view according to the gravity acceleration signal collected by the acceleration sensor 610. The acceleration sensor 610 can also be used to collect game or user motion data.
[0129] The gyro sensor 611 can detect the body direction and rotation angle of the computer device 600, and the gyro sensor 611 can cooperate with the acceleration sensor 610 to collect the user's 3D actions on the computer device 600. The processor 601 can implement the following functions based on the data collected by the gyro sensor 611: motion sensing (such as changing the UI according to the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.
[0130] The pressure sensor 612 can be set on the side frame of the computer device 600 and / or the lower layer of the display screen 605. When the pressure sensor 612 is set on the side frame of the computer device 600, it can detect the user's grip signal of the computer device 600, and the processor 601 performs left and right hand recognition or shortcut operations according to the grip signal collected by the pressure sensor 612. When the pressure sensor 612 is set on the lower layer of the display screen 605, the processor 601 controls the operability controls on the UI interface according to the user's pressure operation on the display screen 605. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.
[0131] The optical sensor 613 is used to collect the ambient light intensity. In one embodiment, the processor 601 can control the display brightness of the display screen 605 according to the ambient light intensity collected by the optical sensor 613. Specifically, when the ambient light intensity is high, the display brightness of the display screen 605 is increased; when the ambient light intensity is low, the display brightness of the display screen 605 is reduced. In another embodiment, the processor 601 can also dynamically adjust the shooting parameters of the camera assembly 606 according to the ambient light intensity collected by the optical sensor 613.
[0132] The proximity sensor 614, also called a distance sensor, is usually disposed on the front panel of the computer device 600. The proximity sensor 614 is used to collect the distance between the user and the front of the computer device 600. In one embodiment, when the proximity sensor 614 detects that the distance between the user and the front of the computer device 600 is gradually decreasing, the processor 601 controls the display screen 605 to switch from the screen-on state to the screen-off state; when the proximity sensor 614 detects that the distance between the user and the front of the computer device 600 is gradually increasing, the processor 601 controls the display screen 605 to switch from the screen-off state to the screen-on state.
[0133] Those skilled in the art will understand that Figure 6 The structure shown in the figure does not constitute a limitation on the computer device 600, and the computer device 600 may include more or less components than those shown in the figure, or combine some components, or adopt a different arrangement of components.
[0134] Figure 7It is a structural diagram of a server provided according to an embodiment of the present application. The server 700 may have relatively large differences due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) 701 and one or more memories 702, wherein the memory 702 stores at least one computer program, and the at least one computer program is loaded and executed by the processor 701 to implement the program detection method provided by the above-mentioned various method embodiments. Of course, the server may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output, and the server may also include other components for implementing device functions, which will not be repeated here.
[0135] The embodiment of the present application also provides a computer-readable storage medium, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor of a computer device to implement the operation performed by the computer device in the program detection method of the above embodiment. For example, the computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.
[0136] In some embodiments, the computer program involved in the embodiments of the present application may be deployed and executed on a computer device, or on multiple computer devices located at one location, or on multiple computer devices distributed at multiple locations and interconnected by a communication network. Multiple computer devices distributed at multiple locations and interconnected by a communication network may constitute a blockchain system.
[0137] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer program code, and the computer program code is stored in a computer-readable storage medium. The processor of the computer device reads the computer program code from the computer-readable storage medium, and the processor executes the computer program code, so that the computer device executes the program detection method provided in the above various optional implementations.
[0138] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.
[0139] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.
Claims
1. A program detection method, characterized in that: The method comprises: In response to detecting that any process is created through a capture function associated with a target system call, obtaining a type of a target program based on the process, the target program being a program corresponding to the process; If the type of the target program is a target type, obtaining permission information of the target program; if the type of the target program is a non-target type, responding to the instruction triggered by the process, executing an operation corresponding to the instruction; If the permission information of the target program carries the target permission identifier, an alarm message is output; if the permission information of the target program does not carry the target permission identifier, an operation corresponding to the instruction is executed in response to the instruction triggered by the process.
2. The method according to claim 1, characterized in that The method further comprises: If the permission information of the target program carries a target permission identifier, the execution of the instruction triggered by the process is stopped.
3. The method according to claim 2, characterized in that The method further comprises: detecting instructions triggered during the period of stopping execution of the process; The output alarm information includes: If the instruction is a write instruction for the target content, it is determined that the current scenario is an attack scenario, and a first alarm message is output, where the first alarm message is used to prompt that the system is suspected of being attacked; If the instruction is a write instruction for content other than the target content, it is determined that the current scenario is in a setting error, and a second alarm message is output, where the second alarm message is used to prompt that an error occurs in the permission setting.
4. The method according to claim 1, characterized in that: The method further comprises: Check the user's permissions; The output alarm information includes: If the user's authority is not the highest authority, it is determined that the system is currently in an attack scenario, and a first alarm message is output, where the first alarm message is used to prompt that the system is suspected of being attacked; If the user's authority is the highest authority, it is determined that the current setting is in an error scenario, and a second alarm message is output, where the second alarm message is used to prompt that an error occurs in the authority setting.
5. The method according to claim 1, characterized in that The method further comprises: When the system starts, the capture function is associated with the target system call based on the system swap table replacement technology.
6. The method according to claim 1, characterized in that The acquiring the type of the target program based on the process includes: Based on the file path of the process, obtaining the file of the target program; If the file attribute information of the file includes an identifier corresponding to the target type, determining the type of the target program as the target type; If the file attribute information of the file does not include an identifier corresponding to the target type, the type of the target program is determined to be a non-target type.
7. A program detection device, characterized in that: The device comprises: A type acquisition module, configured to, in response to detecting that any process is created through a capture function associated with a target system call, acquire a type of a target program based on the process, the target program being a program corresponding to the process; a permission determination module, configured to obtain permission information of the target program if the type of the target program is a target type, and to execute an operation corresponding to the instruction in response to the instruction triggered by the process if the type of the target program is a non-target type; An alarm module, configured to output an alarm message if the permission information of the target program carries a target permission identifier; The operation execution module is used to execute the operation corresponding to the instruction in response to the instruction triggered by the process if the permission information of the target program does not carry the target permission identifier.
8. A computer device, characterized in that: The computer device includes a processor and a memory, the memory is used to store at least one computer program, and the at least one computer program is loaded by the processor to execute the program detection method according to any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store at least one computer program, and the at least one computer program is used to execute the program detection method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the program detection method according to any one of claims 1 to 6 is implemented.