File execution method and device, electronic equipment and computer program product

Abstract

The invention discloses a file execution method and device, electronic equipment and a computer program product, and belongs to the field of computer software. The method comprises the steps of detecting an execution instruction of a first file; in response to the detected execution instruction of the first file, judging whether the size of the first file is smaller than a preset size threshold value or not; if it is judged that the size of the first file is smaller than the preset size threshold value, a path, stored in a preset protection folder, of a second file is obtained in a preset white list according to the identification information of the first file, and the second file is the safe and credible first file; according to the read content of the first file and the read content of the second file, whether execution of the first file is allowed or not is judged. The device comprises an instruction detection module, a size judgment module, a path acquisition module and an execution judgment module. According to the scheme, the problem that the CPU occupancy rate is high due to the fact that the feature value of the file is frequently calculated when the file is executed by the security software based on a white list mechanism can be solved, and the execution efficiency of the security software is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security software, and in particular to a file execution method, device, electronic equipment and computer program product. Background Art

[0002] Computer security software based on the whitelist mechanism works by determining which files or programs are trustworthy based on the whitelist list. When a computer executes a file, the security software compares the file's feature value with the whitelist database. If the file's feature value matches any item in the whitelist, the security software determines that the file is trustworthy and allows it to run or access system resources. Otherwise, it is blocked from running.

[0003] When a file is executed, the characteristic value of the file needs to be calculated. The characteristic value calculation of the file currently adopts hash algorithms such as MD5 (MD5 Message-Digest Algorithm) and SHA-1 (Secure Hash Algorithm 1). When these mainstream hash algorithms are used to calculate larger files, a large amount of CPU (Central Processing Unit) resources are required to obtain the characteristic value. Usually, large files in the system are executed less frequently, and they will run for a long time, but some small files, such as various commands under Linux, will be frequently started and stopped. For these small files, frequent and multiple calculations of hash values ​​will result in extremely high CPU resource usage and serious resource consumption.

[0004] High CPU usage will shorten battery life, which will directly affect the operation of business software for portable computers that rely on limited power or devices with low computing performance in the industrial control field. For example, hosts used for process control in the chemical and rail transit fields have high requirements for real-time performance, and high CPU usage may affect the real-time performance of the system. Some business software has a mechanism for task execution timeout alarms. High CPU usage will cause business software to run slowly, which will in turn cause some tasks to fail. Therefore, it is urgent to optimize the calculation of whitelist feature values ​​to cope with the situation of high computer CPU resource usage. Summary of the invention

[0005] In order to at least solve the problems existing in the prior art, the present invention provides a method for executing a file, which includes:

[0006] Detecting an execution instruction of a first file, where the first file is a file to be verified; in response to detecting the execution instruction of the first file, determining whether the size of the first file is less than a preset size threshold; if it is determined that the size of the first file is less than the preset size threshold, obtaining a path of a second file stored in a preset protection folder from a preset whitelist according to identification information of the first file, where the second file is a safe and reliable first file, and the protection folder is established based on file protection technology; determining whether to allow execution of the first file according to the read content of the first file and the read content of the second file.

[0007] Another aspect of the present invention provides a file execution device, which includes:

[0008] An instruction detection module is used to detect an execution instruction of a first file, where the first file is a file to be verified; a size judgment module is used to judge whether the size of the first file is less than a preset size threshold in response to detecting the execution instruction of the first file; a path acquisition module is used to obtain the path of a second file stored in a preset protection folder from a preset whitelist according to the identification information of the first file if it is judged that the size of the first file is less than the preset size threshold, and the second file is a safe and reliable first file; a first execution judgment module is used to judge whether the execution of the first file is allowed according to the read content of the first file and the read content of the second file.

[0009] In yet another aspect of the present invention, an electronic device is provided, comprising: a processor and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the above-mentioned file execution method.

[0010] On the other hand, the present invention provides a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the above-mentioned file execution method.

[0011] In yet another aspect, the present invention provides a computer program product, including a computer program or instructions, wherein the computer program or instructions implement the above-mentioned file execution method when executed by a processor.

[0012] The technical solution provided by the embodiment of the present invention has the following beneficial effects:

[0013] Detecting the execution instruction of a first file, the first file is a file to be verified; in response to detecting the execution instruction of the first file, determining whether the size of the first file is less than a preset size threshold; if it is determined that the size of the first file is less than the preset size threshold, obtaining the path of the second file stored in a preset protection folder from a preset whitelist according to the identification information of the first file, the second file is a safe and reliable first file, and the protection folder is established based on file protection technology; determining whether to allow the execution of the first file according to the read content of the first file and the read content of the second file, thereby solving the problem of high CPU usage due to frequent calculation of the feature value of the file when the security software based on the whitelist mechanism is executed, thereby improving the execution efficiency of the security software. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flowchart of a method for executing a file provided by an embodiment of the present invention;

[0015] Figure 2 This is a schematic diagram of a whitelist provided by an embodiment of the present invention;

[0016] Figure 3 A whitelist confirmation method based on file protection is provided in one embodiment of the present invention;

[0017] Figure 4 It is a flowchart of a method for executing a file provided by an embodiment of the present invention;

[0018] Figure 5 It is a schematic diagram of the structure of a file execution device provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0019] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0020] See also Figure 1 , an embodiment of the present invention provides a file execution method, which is applied to a computer system, and the computer system is installed with security software based on a whitelist mechanism, which is used to determine whether the file is trustworthy when executed to ensure the security of the computer system. The working principle of the whitelist mechanism is to identify whether the process or file in the system has approved attributes, common process names, file names, publisher names, digital signatures, etc. Whitelist technology allows users to approve which processes are allowed to run in the system, and can resist malware and targeted attacks. By default, any unapproved executable files, tools, and processes cannot run on the system. This execution method includes the following steps:

[0021] Step 101, detecting an execution instruction of a first file.

[0022] This embodiment does not limit the triggering form of the execution instruction of the first file, which may be a calling form, a clicking form, a self-starting form, etc.

[0023] The first file is an executable file, and the execution instruction is used to indicate that the first file is to be executed. After the execution instruction of the first file is triggered, it will be detected or sensed. When the first file is executed, since it is uncertain whether it is credible, the security software will verify the first file. At this time, the first file is the file to be verified.

[0024] Step 102 , in response to detecting an execution instruction of a first file, determining whether the size of the first file is smaller than a preset size threshold.

[0025] When the execution instruction of the first file is detected, the size of the first file is compared with a preset size threshold. The size of the first file can be expressed in bytes, that is, it is determined whether the number of bytes of the first file is less than the preset size threshold.

[0026] The process of determining the size threshold can be as follows:

[0027] Generate a test file of T bytes in size, which is safe and reliable. The test file can also be called a temporary file. Then obtain the reading time A of the test file content, the calculation time B of the real-time calculation characteristic value of the test file, the byte-by-byte comparison time C of the test file content, the reading time D of the storage characteristic value of the test file, and the byte-by-byte comparison time E of the real-time calculation characteristic value of the test file and the storage characteristic value of the test file; adjust the size of T bytes, when A+A+C is less than A+B+D+E, the maximum value of the corresponding T byte size is used as the size threshold. This embodiment does not limit the specific content of the test file. The test file can be generated by a file generator. The file generator can be a mkfile program under the Linux system. It should be noted that due to the difference in computer system performance, the determination of the reading time A of the test file content, the calculation time B of the real-time calculation characteristic value, the comparison time C of the test file content, the reading time D of the storage characteristic value, and the comparison time E of the real-time calculation characteristic value of the test file and the storage characteristic value needs to be obtained through actual testing after the security software is installed. That is to say, when the computing power of the computer system changes, such as when the system software is updated or the hardware is upgraded, the size threshold needs to be obtained again according to the above method.

[0028] The time required to read the test file content is the same as the time required to read the test file copy content, that is, the content reading time, both are recorded as A; the characteristic value of the test file is calculated to obtain the real-time calculation characteristic value, and then the time required to calculate the characteristic value is obtained, which is B. The real-time calculated characteristic value is stored, and the characteristic value after storage is called the stored characteristic value, and the stored characteristic value is the same as the real-time calculated characteristic value. When the byte-by-byte comparison time C of the test file content is obtained, it is necessary to generate a test file copy, and compare the copy content with the test file content byte by byte, so as to obtain the comparison time C. The time required to read the stored characteristic value of the test file, that is, the reading time of the stored characteristic value, is recorded as D. The real-time calculated characteristic value of the test file is compared byte by byte with the stored characteristic value, so as to obtain the comparison time E.

[0029] Start by giving T bytes an initial value, and then obtain and calculate according to the above five time-consuming methods. When A+A+C is less than A+B+D+E, continue to increase the size of T bytes, and then repeat the five time-consuming acquisitions and calculations until A+A+C is no longer less than A+B+D+E. Then sort all the T-byte sizes obtained when A+A+C is less than A+B+D+E, and use the maximum value in the sorting result as the size threshold. A+A+C is used to represent: the time required to read the test file content, the time required to read the test file copy content, and the time required to compare the test file content with the test file copy content byte by byte. A+B+D+E is used to represent: the time required to read the test file content, the time required to calculate the real-time calculation characteristic value of the test file, the time required to read the stored characteristic value of the test file, and the sum of the time E for comparing the real-time calculation characteristic value of the test file with the stored characteristic value. That is to say: the security software determines whether it can be executed by calculating the file characteristic value, and the main time consumption is: the reading time A of the computer system reading the file once, the calculation time B of calculating the file characteristic value once, the reading time D of the computer system reading the file characteristic value once, and the byte-by-byte comparison time E of the file calculated characteristic value and the file storage characteristic value; the main time consumption of the embodiment of the present method is: the reading time A of the computer system reading the file twice, and the comparison time C of performing a byte-by-byte comparison of two files of the same byte length.

[0030] It should be noted that it takes a certain amount of time for security software to query file information through a whitelist (or whitelist list). Since the data structure of the whitelist list is usually a hash linked list, its query time complexity is O(1), which is very short. Therefore, this query time can be ignored when calculating the size threshold.

[0031] Step 103, if it is determined that the size of the first file is smaller than a preset size threshold, the path of the second file stored in the preset protection folder is obtained from a preset whitelist according to the identification information of the first file, and the second file is a safe and reliable first file.

[0032] The size of the first file is compared with a preset size threshold. If the comparison relationship is less than, a match is performed in a preset whitelist according to the identification information of the first file. When the same identification information is matched, there will be a path in the whitelist that corresponds to the identification information (mapping relationship), and the path is the path of the second file stored in the preset protection folder. The protection folder is established based on file protection technology and is used to store the second file. The access rights to it are only obtained by the security software, that is, the content in the protection folder is only accessible to the security software itself. At the beginning, the first file is scanned by the security software and confirmed to be safe and reliable. Then a copy of the first file is created, which is called the second file and stored in the protection folder. The second file is a copy of the first file, and the second file is a safe and reliable first file. The content and size of the second file and the safe and reliable first file are also the same. The identification information of the first file can be the absolute path where the first file is stored. When the execution instruction of the first file is detected, the identification information of the first file can be obtained.

[0033] File protection technology refers to a technology that is implemented through the underlying driver development of the computer operating system to allow only specified processes to access specified files and folders. This embodiment limits the specified folder to be accessible only by security software based on file protection technology. This folder can also be called a protected folder.

[0034] The process of building a whitelist is as follows:

[0035] In response to the addition of the first file, that is, the security software scanned the computer system and did not find the first file in the computer system before, the first file was found in this scan, and the first file was determined to be safe and reliable. It is determined whether the size of the first file is less than a preset size threshold. In response to the size of the first file being less than the preset size threshold, a copy of the first file is created and stored in a protection folder. The copy of the first file is called a second file. In other words, a second file located in the protection folder is generated, and the identification information of the first file and the path of the second file are updated in the white list. In response to the size of the first file being not less than the preset size threshold, a feature value of the first file is calculated as a storage feature value in the white list, and the identification information of the first file and the storage feature value of the first file are updated in the white list.

[0036] In one embodiment, the security software scans the executable files in the computer system, first determines whether the executable files are safe and reliable, then determines the size of the executable files and compares it with the size threshold, and for executable files whose byte count is less than the size threshold, copies them to the protection folder, and adds the executable file information to the whitelist, that is, stores the path mapping information of the file absolute path to the protection folder in the whitelist, such as Figure 2 As shown, the executable file information includes: the absolute path of the executable file in the computer system, and the path of the executable file copied to the protection folder. For executable files whose bytes are greater than the size threshold, the feature value of the executable file is calculated, and the executable file information is added to the whitelist. The executable file information includes: the absolute path of the executable file in the system, and the feature value of the executable file.

[0037] In one embodiment, if the byte size of the executable file is less than the threshold value T, the corresponding information items in the whitelist are: serial number, absolute path of the executable file, byte size of the executable file, and path of the executable file in the protection folder; if the byte size of the executable file is greater than the threshold value T, the corresponding information items in the whitelist are: serial number, absolute path of the executable file, byte size of the executable file, and executable file feature value. In another embodiment, each entry in the whitelist includes: serial number, absolute path of the executable file, byte size of the executable file, executable file feature value, and path of the executable file in the protection folder. If one of the information does not exist, it is left blank. Although such a setting will increase redundant information, the increased redundant information occupies very little storage space and is easy to search and maintain.

[0038] Based on the above whitelist construction process, it can also be:

[0039] Determine whether the expected startup frequency of the first file meets a preset frequency threshold; in response to meeting the preset frequency threshold, jump to step to generate a second file located in a protection folder; after the step of generating the second file located in the protection folder, it also includes: in response to not meeting the preset frequency threshold, calculate the characteristic value of the first file as the storage characteristic value in the whitelist, and update the identification information of the first file and the storage characteristic value of the first file in the whitelist.

[0040] A frequency threshold is set, which is used to indicate the number of times the executable file is executed in the first time period, and the frequency threshold can be obtained through the process management software. For executable files whose number of bytes is less than the size threshold and whose expected execution frequency in the first time period is greater than the frequency threshold, they are copied to the protection folder, and a second file is formed in the protection folder, which is also an executable file, and the information of the executable file is added to the white list; for other executable files, the characteristic value of the executable file is calculated, and the information of the executable file is added to the white list. The construction of the white list is completed through the above steps, wherein the executable file is copied to the protection folder for copying the entire executable file to the protection folder, and the executable file can also be sampled to obtain a sampled data set, and the sampled data set is copied to the protection folder. This method can further reduce the space and time required for file copying. The file can be sampled at intervals of the first length and according to the second length value, wherein the second length value can be as small as 1 byte, to obtain a sampled data set. The above sampling method can be determined according to actual conditions, and this embodiment does not limit this. When sampling files, the sampling interval needs to ensure that the sampled data does not cause the tampered files to be unrecognized. This embodiment does not specifically limit the method for determining the sampling interval, which can be an existing technology.

[0041] The process of building a whitelist can be as follows:

[0042] When an executable file is updated, added, or deleted in the computer system, the whitelist is modified according to the size threshold, specifically:

[0043] When an executable file with a byte count less than the first threshold is updated, added or deleted, the corresponding copy file in the protection folder is updated, added or deleted accordingly, and the information of the executable file in the whitelist is updated, added or deleted accordingly.

[0044] When an executable file whose byte count is greater than the size threshold is updated, added, or deleted, the feature value of the executable file is updated, added, or deleted accordingly, and the information of the executable file in the whitelist is updated, added, or deleted accordingly.

[0045] Step 104 , judging whether to allow the execution of the first file according to the read content of the first file and the read content of the second file.

[0046] Specifically, the implementation of this step includes but is not limited to:

[0047] The read content of the first file is obtained, and the read content of the first file is compared with the read content of the second file. In response to the comparison result being consistent, execution of the first file is allowed, otherwise, execution is prohibited.

[0048] The first file and the second file are both executable files. When two executable files of the same byte length are compared byte by byte, all bytes of the two executable files may be compared; or the first file may be sampled. The sampling method is described in step 103, which will not be described here. The sampled first file is compared byte by byte with the sampled second file stored in the protection folder.

[0049] The method further comprises the following steps:

[0050] If the size of the file is determined to be not less than a preset size threshold, the real-time calculated characteristic value of the first file is obtained; it is determined whether there is a stored characteristic value matching the real-time calculated characteristic value in the preset whitelist, the stored characteristic value being obtained by calculating the characteristic value of the secure and reliable first file, that is, the stored characteristic value is the same as the real-time calculated characteristic value of the secure and reliable first file, which is calculated for the second file; in response to the presence of a stored characteristic value matching the real-time calculated characteristic value in the preset whitelist, execution of the first file is allowed, otherwise, execution is prohibited.

[0051] The characteristic value can be calculated by using a hash algorithm, such as MD5, SHA-1 and other hash algorithms, or by sampling the file to obtain a sampled data set, and then using a hash algorithm to calculate the characteristic value of the sampled data set to obtain the characteristic value. This method can further reduce the time required for calculating the file characteristic value. Among them, the file can be sampled at intervals of the first length and according to the second length value, wherein the second length value can be as small as 1 byte, to obtain a sampled data set. The above specific implementation methods can be determined according to actual conditions, and this embodiment does not limit this. When sampling a file, the sampling interval needs to ensure that the sampled data does not cause the tampered file to be unrecognized. This embodiment does not specifically limit the method for determining the sampling interval, which can be an existing technology.

[0052] In other embodiments, when the size of the executable file is equal to the size threshold, the path of the second file stored in a preset protection folder can be obtained from a preset whitelist based on the identification information of the first file; and whether to allow the execution of the first file is determined based on the read content of the first file and the read content of the second file.

[0053] First, the size of the executable file is determined and compared with the size threshold. When the size of the executable file is less than the size threshold, the security software obtains the information of the executable file according to the whitelist, including the path of the executable file copied to the protection folder, obtains the copy file (or the second file) according to the path, and compares the copy file with the executable file byte by byte. If they are consistent, the executable file is allowed to execute, and if they are inconsistent, its execution is blocked. In another embodiment, a copy data set can also be obtained according to the path information, and the executable file to be judged is sampled to obtain a sample data set, and the copy data set and the sample data set are compared byte by byte. If they are consistent, the executable file is allowed to execute, and if they are inconsistent, its execution is blocked.

[0054] When the size of the executable file is greater than the size threshold, the security software calculates the feature value of the executable file, obtains the information of the executable file, including the feature value, according to the whitelist, and compares the calculated feature value with the feature value in the whitelist. If they are consistent, the executable file is allowed to execute; if they are inconsistent, the execution is blocked. In another embodiment, the executable file can also be sampled to obtain a sampled data set, the feature value of the sampled data set is calculated, and compared with the feature value of the corresponding sampled data set obtained from the whitelist. If they are consistent, the executable file is allowed to execute; if they are inconsistent, the execution is blocked.

[0055] See also Figure 3 The embodiment of the present invention provides a whitelist confirmation method based on file protection.

[0056] The security software based on file protection starts running; the threshold T is determined: a temporary file of T bytes is generated, and the reading time of the file is recorded as A seconds, the characteristic value calculation time is B seconds, the byte-by-byte comparison time of the file content is C seconds, the characteristic value reading time is D seconds, and the characteristic value byte-by-byte comparison time is E seconds. T bytes are adjusted, and the T bytes obtained when A+A+C is less than A+B+D+E is the maximum is the threshold;

[0057] Trusted baseline establishment: Scan the executable files in the system, calculate their feature values, and generate a whitelist. For files smaller than T bytes, copy a copy to the protection folder. And store the mapping information of the absolute path of the file to the protection folder. The content in the protection folder is only accessible to the security software itself. For files greater than or equal to T bytes, calculate their feature values ​​and save them to the whitelist.

[0058] Execution verification of files smaller than the threshold T bytes: query the whitelist to obtain the path of the executable file in the protection folder, read the content of the executable file and compare it with the corresponding file in the protection folder. If they are consistent, execution is allowed, otherwise execution is not allowed;

[0059] Files larger than the threshold T bytes are checked: the file's feature value is calculated and the whitelist is checked to see if there is a matching feature value. If there is a match, execution is allowed; otherwise, execution is not allowed.

[0060] Whitelist update: When a new file is added, the file is copied to the protection folder if it is less than the threshold T, and the mapping information from the absolute path of the file to the protection folder path is updated. If it is greater than or equal to the threshold T, its feature value is calculated, and the mapping information from the absolute path to the feature value is stored. When a file is deleted, the whitelist information is deleted, and if it is less than the value T, the file in the protection folder must be deleted first;

[0061] File-based security software stops functioning.

[0062] See also Figure 4 , an embodiment of the present invention provides a method for executing a file, which comprises the following steps:

[0063] The executable file runs;

[0064] The security software driver senses the execution of processes with executable files;

[0065] In response to the executable file bytes being less than a threshold value T and the existence of a path located in a protection folder; querying the whitelist to obtain the path of the executable file located in the protection folder; comparing the content of the executable file with the content of the executable file in the protection folder path, and allowing execution in response to the above comparison being consistent, otherwise, prohibiting execution.

[0066] In response to the executable file bytes being not less than the threshold T; calculating the executable file feature value, and querying whether there is a feature value matching the feature value in the white list, and if the two are the same, in response to the presence of a matching feature value in the white list, allowing execution, otherwise, prohibiting execution.

[0067] See also Figure 5 An embodiment of the present invention provides a file execution device, which includes: an instruction detection module 201, a size judgment module 202, a path acquisition module 203 and a first execution judgment module 204.

[0068] Among them, the instruction detection module 201 is used to detect the execution instruction of the first file, and the first file is the file to be verified. The size judgment module 202 is used to judge whether the size of the first file is less than the preset size threshold in response to the execution instruction of the first file detected. The path acquisition module 203 is used to obtain the path of the second file stored in the preset protection folder in the preset white list according to the identification information of the first file if it is judged that the size of the first file is less than the preset size threshold. The second file is a safe and reliable first file, and the protection folder is established based on file protection technology. The first execution judgment module 204 is used to judge whether the execution of the first file is allowed based on the read content of the first file and the read content of the second file.

[0069] Optionally, the execution judgment module 204 is specifically used for:

[0070] Obtain the read content of the first file; compare the read content of the first file with the read content of the second file; in response to the comparison result being consistent, allow the execution of the first file, otherwise, prohibit the execution.

[0071] Optionally, the device further comprises:

[0072] The method further includes: a second execution judgment module, which is specifically used to:

[0073] If it is determined that the size of the first file is not less than a preset size threshold, obtain the real-time calculated characteristic value of the first file; determine whether there is a stored characteristic value matching the real-time calculated characteristic value in the preset whitelist, the stored characteristic value being obtained by performing characteristic value calculation on the secure and reliable first file; in response to the presence of a stored characteristic value matching the real-time calculated characteristic value in the preset whitelist, allow execution of the first file, otherwise, prohibit execution.

[0074] Optionally, the device further includes: a whitelist updating module, which is specifically used to:

[0075] In response to a newly added first file and the first file being a safe and reliable file; determining whether the size of the first file is less than a preset size threshold; in response to the size of the first file being less than the preset size threshold, generating a second file located in a protection folder, and updating the identification information of the first file and the path of the second file in the white list; in response to the size of the first file being not less than the preset size threshold, calculating a characteristic value of the first file as a storage characteristic value, and updating the identification information and storage characteristic value of the first file in the white list.

[0076] Optionally, the identification information of the first file is an absolute path where the first file is stored.

[0077] Optionally, the device further includes: a frequency determination module, which is specifically used to:

[0078] Determine whether the expected startup frequency of the first file meets a preset frequency threshold; in response to meeting the preset frequency threshold, jump to step to generate a second file located in the protection folder;

[0079] Accordingly, the device further includes: a whitelist adding module, which, after generating the second file located in the protection folder, is specifically used to:

[0080] In response to not meeting the preset frequency threshold, a feature value of the first file is calculated as a storage feature value, and the identification information and the storage feature value of the first file are updated in the whitelist.

[0081] The device also includes: a size threshold determination module, which is specifically used to:

[0082] Generate a test file of T bytes; obtain the reading time A of the test file content, the calculation time B of the real-time calculated characteristic value of the test file, the byte-by-byte comparison time C of the test file content, the reading time D of the stored characteristic value of the test file, and the byte-by-byte comparison time E of the real-time calculated characteristic value and the stored characteristic value of the test file; adjust the size of T bytes, when A+A+C is less than A+B+D+E, the maximum value of all corresponding T-byte sizes is used as the size threshold.

[0083] It should be noted that: when the file execution device provided in the above embodiment confirms whether the file can be executed, it only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the file execution device provided in the above embodiment and the file execution method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0084] An embodiment of the present invention provides an electronic device, comprising: a memory and a processor. The processor is connected to the memory and is configured to execute the execution method of the above-mentioned file based on the instructions stored in the memory. The number of processors can be one or more, and the processor can be single-core or multi-core. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as a read-only memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip. The memory can be an example of the following computer-readable medium.

[0085] The embodiment of the present invention provides a computer-readable storage medium, on which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the execution method of the above-mentioned file. Computer-readable storage media include: permanent and non-permanent, removable and non-removable media can implement information storage by any method or technology. The information can be a computer-readable instruction, a data structure, a module of a program or other data. Examples of computer storage media include, but are not limited to: phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk-read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassette, disk storage or other magnetic storage device or any other non-transmission medium, which can be used to store information that can be accessed by a computing device.

[0086] An embodiment of the present invention provides a computer-readable storage medium, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the above-mentioned file protection-based whitelist quick confirmation method.

[0087] It is known from common technical knowledge that the present invention can be implemented by other embodiments that do not deviate from its spirit or essential features. Therefore, the above disclosed embodiments are only illustrative in all respects and are not exclusive. All changes within the scope of the present invention or within the scope equivalent to the present invention are included in the present invention.

Claims

1. A method for executing a file, characterized in that: The execution method comprises: detecting an execution instruction of a first file, where the first file is a file to be verified; In response to detecting the execution instruction of the first file, determining whether the size of the first file is smaller than a preset size threshold; If it is determined that the size of the first file is smaller than a preset size threshold, a path of the second file stored in a preset protection folder is obtained from a preset whitelist according to the identification information of the first file, the second file is a secure and reliable first file, and the protection folder is established based on file protection technology; Whether to allow execution of the first file is determined according to the read content of the first file and the read content of the second file.

2. The execution method according to claim 1, characterized in that: The determining whether to allow execution of the first file according to the read content of the first file and the read content of the second file includes: Obtaining the read content of the first file; comparing the read content of the first file with the read content of the second file; In response to the comparison result being consistent, execution of the first file is allowed; otherwise, execution is prohibited.

3. The execution method according to claim 1, characterized in that: The method further comprises: If it is determined that the size of the first file is not less than a preset size threshold, obtaining a real-time calculated feature value of the first file; Determine whether there is a stored characteristic value matching the real-time calculated characteristic value in a preset whitelist, wherein the stored characteristic value is obtained by calculating a characteristic value of the secure and reliable first file; In response to a stored characteristic value matching the real-time calculated characteristic value in a preset whitelist, execution of the first file is permitted; otherwise, execution is prohibited.

4. The execution method according to claim 1, characterized in that: The method further comprises: In response to a newly added first file being a secure and credible file; Determining whether the size of the first file is less than a preset size threshold; In response to the size of the first file being smaller than a preset size threshold, generating a second file located in the protection folder, and updating the identification information of the first file and the path of the second file in the whitelist; In response to the size of the first file being not less than a preset size threshold, a feature value of the first file is calculated as a storage feature value, and identification information of the first file and the storage feature value are updated in the whitelist.

5. The execution method according to claim 1, characterized in that: The identification information of the first file is the absolute path where the first file is stored.

6. The execution method according to claim 4, characterized in that: After the size of the first file is smaller than a preset size threshold, and before the second file located in the protection folder is generated, the method further includes: Determining whether the expected startup frequency of the first file meets a preset frequency threshold; In response to meeting the preset frequency threshold, jumping to the step of generating a second file located in the protection folder; After generating the second file located in the protection folder, the method further includes: In response to not meeting the preset frequency threshold, a feature value of the first file is calculated as a storage feature value, and identification information of the first file and the storage feature value are updated in the whitelist.

7. The execution method according to claim 1, characterized in that: The method further comprises: Generate a test file of T-byte size; Obtain the reading time of the test file content A, the calculation time of the real-time calculated characteristic value of the test file B, the byte-by-byte comparison time of the test file content C, the reading time of the stored characteristic value of the test file D, and the byte-by-byte comparison time of the real-time calculated characteristic value of the test file and the stored characteristic value E; The size of the T bytes is adjusted. When A+A+C is smaller than A+B+D+E, the maximum value of all corresponding T byte sizes is used as the size threshold.

8. A file execution device, characterized in that: The execution device comprises: An instruction detection module, used for detecting an execution instruction of a first file, where the first file is a file to be verified; a size determination module, configured to determine whether the size of the first file is smaller than a preset size threshold in response to detecting the execution instruction of the first file; a path acquisition module, configured to acquire, if it is determined that the size of the first file is smaller than a preset size threshold, a path of the second file stored in a preset protection folder from a preset whitelist according to the identification information of the first file, wherein the second file is a safe and reliable first file; The first execution judgment module is used to judge whether to allow the execution of the first file according to the read content of the first file and the read content of the second file.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory for storing executable instructions of the processor; The processor is configured to execute the file execution method described in any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the file execution method described in any one of claims 1 to 7 is implemented.

Images