File execution method, device, electronic device and computer program product

Abstract

The present invention discloses a file execution method, device, electronic device and computer program product, which belong to the field of computer software. The method includes: detecting the execution instruction of the first file; in response to detecting the execution instruction of the first file, judging whether the size of the first file is less than a preset size threshold; if it is judged that the size of the first file is less than the preset size threshold, obtaining the path of the second file stored in the preset protection folder in the preset white list according to the identification information of the first file, and the second file is a safe and reliable first file; judging whether to allow the execution of the first file according to the read content of the first file and the read content of the second file. The device includes an instruction detection module, a size judgment module, a path acquisition module and an execution judgment module. The above scheme can solve the problem of high CPU occupancy rate of security software based on the white list mechanism due to frequent calculation of the file feature value when the file is executed, thereby improving the execution efficiency of the security software.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security software, and in particular to a file execution method, device, electronic device and computer program product. Background Art

[0002] Computer security software based on a whitelist mechanism works by using a whitelist to determine which files or programs are trusted. When a computer executes a file, the security software compares the file's signature against a database of whitelisted files. If the file's signature matches any entry on the whitelist, the security software determines the file is trusted and allows it to run or access system resources. Otherwise, it blocks the file from running.

[0003] When a file is executed, the characteristic value of the file needs to be calculated. The characteristic value calculation of the file currently uses hash algorithms such as MD5 (MD5 Message-Digest Algorithm) and SHA-1 (Secure Hash Algorithm 1). These mainstream hash algorithms require a large amount of CPU (Central Processing Unit) resources to obtain the characteristic value when calculating for larger files. Generally, large files in the system are executed less frequently and will run for a long time. However, some small files, such as various commands under Linux, will be frequently started and stopped. For these small files, frequently calculating hash values ​​will result in extremely high CPU resource usage and serious resource consumption.

[0004] High CPU utilization shortens battery life, directly impacting the operation of business software for portable computers relying on limited power or for devices with low computing performance in industrial control. For example, hosts used for process control in the chemical and rail transit sectors have high real-time requirements, and high CPU utilization can impact the system's real-time performance. Some business software includes mechanisms for task execution timeout alerts. High CPU utilization can cause business software to stall, leading to some task failures. Therefore, optimizing whitelist feature value calculations is crucial to address high CPU resource utilization. Summary of the Invention

[0005] In order to at least solve the problems existing in the prior art, the present invention provides a method for executing a file, which includes:

[0006] Detecting an execution instruction of a first file, where the first file is a file to be verified; in response to detecting the execution instruction of the first file, determining whether the size of the first file is less than a preset size threshold; if it is determined that the size of the first file is less than the preset size threshold, obtaining a path of a second file stored in a preset protection folder from a preset whitelist based on identification information of the first file, where the second file is a safe and reliable first file, and the protection folder is established based on file protection technology; determining whether to allow execution of the first file based on the read content of the first file and the read content of the second file.

[0007] Another aspect of the present invention provides a file execution device, comprising:

[0008] An instruction detection module is used to detect an execution instruction of a first file, where the first file is a file to be verified; a size judgment module is used to determine whether the size of the first file is less than a preset size threshold in response to detecting the execution instruction of the first file; a path acquisition module is used to obtain the path of a second file stored in a preset protection folder from a preset whitelist based on the identification information of the first file if it is determined that the size of the first file is less than the preset size threshold, where the second file is a safe and reliable first file; and a first execution judgment module is used to determine whether the execution of the first file is allowed based on the read content of the first file and the read content of the second file.

[0009] In yet another aspect of the present invention, an electronic device is provided, comprising: a processor and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the above-mentioned file execution method.

[0010] On the other hand, the present invention provides a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the above-mentioned file execution method.

[0011] In yet another aspect, the present invention provides a computer program product, comprising a computer program or instructions, wherein the computer program or instructions implement the above-mentioned file execution method when executed by a processor.

[0012] The technical solution provided by the embodiment of the present invention has the following beneficial effects:

[0013] Detecting the execution instruction of a first file, where the first file is a file to be verified; in response to detecting the execution instruction of the first file, determining whether the size of the first file is less than a preset size threshold; if it is determined that the size of the first file is less than the preset size threshold, obtaining the path of the second file stored in a preset protection folder from a preset whitelist based on the identification information of the first file, the second file is a safe and reliable first file, and the protection folder is established based on file protection technology; determining whether to allow the execution of the first file based on the read content of the first file and the read content of the second file, thereby solving the problem of high CPU usage due to frequent calculation of the file feature value during file execution in security software based on the whitelist mechanism, thereby improving the execution efficiency of the security software. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flowchart of a file execution method provided by one embodiment of the present invention;

[0015] Figure 2 This is a schematic diagram of a whitelist provided by an embodiment of the present invention;

[0016] Figure 3 A whitelist confirmation method based on file protection is provided in one embodiment of the present invention;

[0017] Figure 4 This is a flowchart of a file execution method provided by one embodiment of the present invention;

[0018] Figure 5 It is a structural diagram of a file execution device provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0019] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0020] See also Figure 1 , an embodiment of the present invention provides a file execution method, which is applied to a computer system, and the computer system is installed with security software based on a whitelist mechanism, which is used to determine whether the file is trustworthy when executed to ensure the security of the computer system. The working principle of the whitelist mechanism is to identify whether the process or file in the system has approved attributes, common process names, file names, publisher names, digital signatures, etc. Whitelist technology allows users to approve which processes are allowed to run in the system, and can resist malware and targeted attacks. By default, any unapproved executable files, tools and processes cannot run on the system. This execution method includes the following steps:

[0021] Step 101: Detect an execution instruction of a first file.

[0022] This embodiment does not limit the triggering form of the execution instruction of the first file, which can be a calling form, a clicking form, a self-starting form, etc.

[0023] The first file is an executable file. The execution instruction indicates that the first file is to be executed. Once the execution instruction of the first file is triggered, it will be detected or sensed. When the first file is executed, the security software will verify the first file because it is uncertain whether it is trustworthy. At this time, the first file becomes the file to be verified.

[0024] Step 102 : In response to detecting an execution instruction of a first file, determining whether the size of the first file is smaller than a preset size threshold.

[0025] When the execution instruction of the first file is detected, the size of the first file is compared with a preset size threshold. The size of the first file can be expressed in bytes, that is, it is determined whether the number of bytes of the first file is less than the preset size threshold.

[0026] The process of determining the size threshold can be as follows:

[0027] Generate a test file of T bytes in size, which is secure and reliable. The test file can also be called a temporary file. Then, obtain the time A for reading the test file content, the time B for calculating the test file's real-time characteristic value, the time C for comparing the test file's content byte by byte, the time D for reading the test file's stored characteristic value, and the time E for comparing the test file's real-time characteristic value with the test file's stored characteristic value. The size of T bytes is adjusted. When A+A+C is less than A+B+D+E, the maximum value of the corresponding T-byte size is used as the size threshold. This embodiment does not limit the specific content of the test file. The test file can be generated using a file generator. The file generator can be the mkfile program under the Linux system. It should be noted that due to differences in computer system performance, the determination of the time A for reading the test file content, the time B for calculating the real-time characteristic value, the time C for comparing the test file content, the time D for reading the stored characteristic value, and the time E for comparing the test file's real-time characteristic value with the stored characteristic value need to be obtained through actual testing after the security software is installed. That is to say, when the computing power of the computer system changes, such as when the system software is updated or the hardware is upgraded, the size threshold needs to be obtained again according to the above method.

[0028] The time required to read the test file content is the same as the time required to read the test file copy content, that is, the content reading time, both are recorded as A; the characteristic value of the test file is calculated to obtain the real-time calculation characteristic value, and then the time required to calculate the characteristic value is obtained, which is B. The real-time calculation characteristic value is stored, and after storage, the characteristic value is called the stored characteristic value, and the stored characteristic value is the same as the real-time calculation characteristic value. When obtaining the byte-by-byte comparison time C of the test file content, it is necessary to generate a test file copy, and compare the copy content with the test file content byte by byte, so as to obtain the comparison time C. The time required to read the stored characteristic value of the test file, that is, the reading time of the stored characteristic value, is recorded as D. The real-time calculation characteristic value of the test file is compared byte by byte with the stored characteristic value, so as to obtain the comparison time E.

[0029] Start by giving T bytes an initial value, obtain it according to the five time-consuming methods mentioned above, and then calculate it. When A+A+C is less than A+B+D+E, continue to increase the size of T bytes, and then repeat the five time-consuming acquisitions and calculations until A+A+C is no longer less than A+B+D+E. Then sort all the T-byte sizes obtained when A+A+C is less than A+B+D+E, and use the maximum value in the sorting result as the size threshold. A+A+C is used to represent: the sum of the time required to read the test file content, the time required to read the test file copy content, and the time required to compare the test file content with the test file copy content byte by byte. A+B+D+E is used to represent: the time required to read the test file content, the time required to calculate the real-time characteristic value of the test file, the time required to read the stored characteristic value of the test file, and the sum of the time E for byte-by-byte comparison of the real-time calculated characteristic value of the test file with the stored characteristic value. That is to say: the security software determines whether it can be executed by calculating the file characteristic value. The main time consumption is: the reading time A of the computer system reading the file once, the calculation time B of calculating the file characteristic value once, the reading time D of the computer system reading the file characteristic value once, and the byte-by-byte comparison time E of the file calculated characteristic value and the file stored characteristic value; the main time consumption of the embodiment of this method is: the reading time A of the computer system reading the file twice, and the comparison time C of performing a byte-by-byte comparison of two files of the same byte length.

[0030] It should be noted that it takes a certain amount of time for security software to query file information through a whitelist (or whitelist list). Since the data structure of the whitelist list is usually a hash linked list, its query time complexity is O(1), which is very short. Therefore, this query time can be ignored when calculating the size threshold.

[0031] Step 103: If it is determined that the size of the first file is smaller than the preset size threshold, the path of the second file stored in the preset protection folder is obtained from the preset whitelist according to the identification information of the first file, and the second file is a safe and reliable first file.

[0032] The size of the first file is compared with a preset size threshold. If the comparison relationship is less than, a match is performed in a preset whitelist based on the identification information of the first file. When the same identification information is matched, a path corresponding to the identification information (mapping relationship) will exist in the whitelist. This path is the path where the second file is stored in a preset protection folder. The protection folder is established based on file protection technology and is used to store the second file. The access rights to it are only obtained by the security software, that is, the content in the protection folder is only accessible to the security software itself. At the beginning, the first file is scanned by the security software and confirmed to be safe and reliable. A copy of the first file is created, called the second file, and stored in the protection folder. The second file is a copy of the first file, and the second file is the safe and reliable first file. The content and size of the second file and the safe and reliable first file are also the same. The identification information of the first file can be the absolute path where the first file is stored. When the execution instruction of the first file is detected, the identification information of the first file can be obtained.

[0033] File protection technology refers to a technology that is implemented through the underlying driver development of the computer operating system to limit the access of specified files and folders to specified processes. This embodiment uses file protection technology to limit the access of specified folders to security software. This folder can also be called a protected folder.

[0034] The process of building a whitelist is as follows:

[0035] In response to the addition of the first file, i.e., the security software scanned the computer system and did not find the first file previously in the computer system, but discovered the first file during this scan and determined that the first file was safe and trustworthy. A determination is made as to whether the size of the first file is less than a preset size threshold. In response to the size of the first file being less than the preset size threshold, a copy of the first file is created and stored in a protected folder. The copy of the first file is referred to as a second file. In other words, a second file is generated in the protected folder. The identification information of the first file and the path of the second file are updated in the whitelist. In response to the size of the first file being not less than the preset size threshold, a feature value of the first file is calculated as a storage feature value in the whitelist, and the identification information of the first file and the storage feature value of the first file are updated in the whitelist.

[0036] In one embodiment, the security software scans the executable files in the computer system, first determines whether the executable files are safe and trustworthy, then determines the size of the executable files and compares it with the size threshold. For executable files with a byte count smaller than the size threshold, the files are copied to a protected folder and the executable file information is added to a whitelist, i.e., the mapping information of the absolute path of the file to the protected folder is stored in the whitelist, such as Figure 2 As shown, executable file information includes the absolute path of the executable file in the computer system and the path to the protected folder where the executable file is copied. For executable files with a byte count greater than the size threshold, the executable file's feature value is calculated and the executable file information is added to the whitelist. The executable file information includes the absolute path of the executable file in the system and the executable file's feature value.

[0037] In one embodiment, if the byte size of an executable file is less than a threshold value T, the corresponding whitelist information items are: serial number, absolute path of the executable file, byte size of the executable file, and path of the executable file in the protected folder. If the byte size of the executable file is greater than the threshold value T, the corresponding whitelist information items are: serial number, absolute path of the executable file, byte size of the executable file, and executable file characteristic value. In another embodiment, each entry in the whitelist includes: serial number, absolute path of the executable file, byte size of the executable file, executable file characteristic value, and path of the executable file in the protected folder. If any of these items of information do not exist, they are left blank. Although this configuration increases redundant information, the added redundant information takes up very little storage space and is easier to search and maintain.

[0038] Based on the above whitelist construction process, it can also be:

[0039] Determine whether the expected startup frequency of the first file meets a preset frequency threshold; in response to meeting the preset frequency threshold, jump to step to generate a second file located in a protection folder; after the step of generating the second file located in the protection folder, it also includes: in response to not meeting the preset frequency threshold, calculate the characteristic value of the first file as the storage characteristic value in the whitelist, and update the identification information of the first file and the storage characteristic value of the first file in the whitelist.

[0040] A frequency threshold is set, which is used to represent the number of times the executable file is executed within the first time period. The frequency threshold can be obtained through process management software. For executable files whose byte count is less than the size threshold and whose expected execution frequency within the first time period is greater than the frequency threshold, they are copied to a protected folder. A second file is formed in the protected folder, which is also an executable file, and the executable file information is added to the whitelist. For other executable files, the feature value of the executable file is calculated, and the executable file information is added to the whitelist. The whitelist is constructed through the above steps, wherein copying the executable file to the protected folder can mean copying the entire executable file to the protected folder, or sampling the executable file to obtain a sampled data set, and copying the sampled data set to the protected folder. This method can further reduce the space and time required for file copying. The file can be sampled at intervals of the first length and the second length value, wherein the second length value can be as small as 1 byte, to obtain a sampled data set. The above sampling method can be determined according to actual conditions and is not limited in this embodiment. When sampling files, the sampling interval must ensure that the sampled data does not result in tampered files not being identified. This embodiment does not specifically limit the method for determining the sampling interval, which may be an existing technology.

[0041] The process of building a whitelist can be as follows:

[0042] When an executable file is updated, added, or deleted in the computer system, the whitelist is modified based on the size threshold, specifically:

[0043] When an executable file with a byte count smaller than the first threshold is updated, added, or deleted, the corresponding copy file in the protection folder is updated, added, or deleted accordingly, and the information of the executable file in the whitelist is updated, added, or deleted accordingly.

[0044] When an executable file with a byte count greater than the size threshold is updated, added, or deleted, the feature value of the executable file is updated, added, or deleted accordingly, and the information of the executable file in the whitelist is updated, added, or deleted accordingly.

[0045] Step 104 : Determine whether to allow execution of the first file based on the read content of the first file and the read content of the second file.

[0046] Specifically, the implementation of this step includes but is not limited to:

[0047] Obtain the read content of the first file, compare the read content of the first file with the read content of the second file, and in response to a comparison result that is consistent, allow execution of the first file; otherwise, prohibit execution.

[0048] The first file and the second file are both executable files. When performing a byte-by-byte comparison of two executable files of the same byte length, a full byte comparison of the two executable files can be performed. Alternatively, the first file can be sampled. The sampling method is described in step 103 and will not be described in detail here. The sampled first file is compared byte-by-byte with the sampled second file stored in the protected folder.

[0049] The method further comprises the following steps:

[0050] If the size of the file is determined to be not less than a preset size threshold, the real-time calculated characteristic value of the first file is obtained; it is determined whether there is a stored characteristic value matching the real-time calculated characteristic value in the preset white list, the stored characteristic value being obtained by calculating the characteristic value of the secure and reliable first file, that is, the stored characteristic value is the same as the real-time calculated characteristic value of the secure and reliable first file, which is calculated for the second file; in response to the presence of a stored characteristic value matching the real-time calculated characteristic value in the preset white list, execution of the first file is allowed; otherwise, execution is prohibited.

[0051] The characteristic value can be calculated using a hash algorithm, such as MD5, SHA-1 and other hash algorithms, or by sampling the file to obtain a sample data set, and then using the hash algorithm to calculate the characteristic value of the sample data set to obtain the characteristic value. This method can further reduce the time required for calculating the file characteristic value. Among them, the file can be sampled at intervals of the first length and the second length value can be sampled at a minimum of 1 byte to obtain a sample data set. The above specific implementation method can be determined according to actual conditions, and this embodiment does not limit this. When sampling a file, the sampling interval must ensure that the sampled data does not cause the tampered file to be unrecognized. This embodiment does not specifically limit the method for determining the sampling interval, and it can be an existing technology.

[0052] In other embodiments, when the size of the executable file is equal to the size threshold, the path of the second file stored in the preset protection folder can be obtained from the preset whitelist based on the identification information of the first file; and whether the execution of the first file is allowed is determined based on the read content of the first file and the read content of the second file.

[0053] First, the size of the executable file is determined and compared with a size threshold. If the size of the executable file is smaller than the size threshold, the security software retrieves information about the executable file from the whitelist, including the path where the executable file is copied to the protected folder. Based on this path, a copy file (or second file) is obtained. The copy file is compared byte by byte with the executable file. If they match, the executable file is allowed to execute; if they do not, execution is blocked. In another embodiment, a copy data set can be obtained based on the path information, and the executable file to be judged is sampled to obtain a sample data set. The copy data set and the sample data set are compared byte by byte. If they match, the executable file is allowed to execute; if they do not, execution is blocked.

[0054] When the size of an executable file exceeds a size threshold, the security software calculates a characteristic value of the executable file and obtains information about the executable file, including the characteristic value, from a whitelist. The calculated characteristic value is compared with the characteristic value in the whitelist. If they match, the executable file is allowed to execute; if they do not match, execution is blocked. In another embodiment, the executable file may be sampled to obtain a sampled data set, and the characteristic value of the sampled data set is calculated. The characteristic value is then compared with the characteristic value of the corresponding sampled data set obtained from the whitelist. If they match, the executable file is allowed to execute; if they do not match, execution is blocked.

[0055] See also Figure 3 The embodiment of the present invention provides a whitelist confirmation method based on file protection.

[0056] The file protection-based security software starts running. The threshold T is determined by generating a temporary file of T bytes. The file reading time is recorded as A seconds, the characteristic value calculation time is recorded as B seconds, the file content byte-by-byte comparison time is recorded as C seconds, the characteristic value reading time is recorded as D seconds, and the characteristic value byte-by-byte comparison time is recorded as E seconds. The T bytes are adjusted to obtain the maximum value of A+A+C less than A+B+D+E, which is the threshold value.

[0057] Trusted Baseline Establishment: Scan executable files in the system, calculate their signatures, and generate a whitelist. For files smaller than a terabyte, copy a copy to a protected folder. This also stores the mapping information between the absolute file path and the protected folder. The contents of the protected folder are accessible only to the security software itself. For files larger than or equal to a terabyte, calculate their signatures and store them in the whitelist.

[0058] Execution verification for files smaller than the threshold of T bytes: Query the whitelist to obtain the path of the executable file in the protected folder, read the contents of the executable file and compare it with the corresponding file in the protected folder. If they match, execution is allowed; otherwise, execution is not allowed.

[0059] Files larger than the threshold of T bytes are checked: the file's signature is calculated and the whitelist is checked for matching signatures. If a match is found, execution is allowed; otherwise, execution is not allowed.

[0060] Whitelist update: When a new file is added, if the file size is less than the threshold T, the file is copied to the protected folder and the mapping information between the absolute file path and the protected folder path is updated. If the file size is greater than or equal to the threshold T, its characteristic value is calculated and the mapping information between the absolute path and the characteristic value is stored. When a file is deleted, the whitelist information is deleted. If the file size is less than the threshold T, the file in the protected folder must be deleted first.

[0061] File-based security software stops running.

[0062] See also Figure 4 , an embodiment of the present invention provides a method for executing a file, which includes the following steps:

[0063] The executable file runs;

[0064] The security software driver senses the execution of processes with executable files;

[0065] In response to the executable file bytes being smaller than a threshold value T and the existence of a path located in a protected folder; querying a whitelist to obtain the path of the executable file located in the protected folder; comparing the contents of the executable file with the contents of the executable file in the protected folder path; and allowing execution if the comparison is consistent; otherwise, prohibiting execution.

[0066] In response to the executable file bytes being not less than the threshold T; calculating the executable file feature value, and querying whether there is a feature value matching the feature value in the white list. If the two are the same, execution is allowed in response to the presence of a matching feature value in the white list, otherwise, execution is prohibited.

[0067] See also Figure 5 An embodiment of the present invention provides a file execution device, which includes: an instruction detection module 201, a size judgment module 202, a path acquisition module 203 and a first execution judgment module 204.

[0068] Among them, the instruction detection module 201 is used to detect the execution instruction of the first file, and the first file is the file to be verified. The size judgment module 202 is used to determine whether the size of the first file is less than a preset size threshold in response to the detection of the execution instruction of the first file. The path acquisition module 203 is used to obtain the path of the second file stored in the preset protection folder from the preset whitelist based on the identification information of the first file if it is determined that the size of the first file is less than the preset size threshold. The second file is a safe and reliable first file, and the protection folder is established based on file protection technology. The first execution judgment module 204 is used to determine whether the execution of the first file is allowed based on the read content of the first file and the read content of the second file.

[0069] Optionally, the execution judgment module 204 is specifically configured to:

[0070] Obtaining the read content of the first file; comparing the read content of the first file with the read content of the second file; in response to the comparison result being consistent, allowing execution of the first file; otherwise, prohibiting execution.

[0071] Optionally, the device further includes:

[0072] The method further includes: a second execution judgment module, which is specifically configured to:

[0073] If it is determined that the size of the first file is not less than a preset size threshold, the real-time calculated characteristic value of the first file is obtained; it is determined whether there is a stored characteristic value matching the real-time calculated characteristic value in the preset whitelist, where the stored characteristic value is obtained by performing characteristic value calculation on the secure and reliable first file; in response to the presence of a stored characteristic value matching the real-time calculated characteristic value in the preset whitelist, execution of the first file is allowed; otherwise, execution is prohibited.

[0074] Optionally, the device further includes: a whitelist updating module, which is specifically configured to:

[0075] In response to a newly added first file and the first file being a safe and reliable file; determining whether the size of the first file is less than a preset size threshold; in response to the size of the first file being less than the preset size threshold, generating a second file located in a protection folder, and updating the identification information of the first file and the path of the second file in the white list; in response to the size of the first file being not less than the preset size threshold, calculating a characteristic value of the first file as a storage characteristic value, and updating the identification information and storage characteristic value of the first file in the white list.

[0076] Optionally, the identification information of the first file is an absolute path where the first file is stored.

[0077] Optionally, the device further includes a frequency determination module, which is specifically configured to:

[0078] Determining whether the expected activation frequency of the first file meets a preset frequency threshold; in response to meeting the preset frequency threshold, jumping to step of generating a second file in the protected folder;

[0079] Accordingly, the device further includes: a whitelist adding module, which, after generating the second file located in the protection folder, is specifically configured to:

[0080] In response to not meeting the preset frequency threshold, a feature value of the first file is calculated as a stored feature value, and the identification information and the stored feature value of the first file are updated in the whitelist.

[0081] The device further includes a size threshold determination module, which is specifically configured to:

[0082] Generate a test file of T bytes in size; obtain the reading time A of the test file content, the calculation time B of the real-time calculated eigenvalue of the test file, the byte-by-byte comparison time C of the test file content, the reading time D of the stored eigenvalue of the test file, and the byte-by-byte comparison time E of the real-time calculated eigenvalue and the stored eigenvalue of the test file; adjust the size of T bytes, and when A+A+C is less than A+B+D+E, the maximum value of all corresponding T-byte sizes is used as the size threshold.

[0083] It should be noted that the file execution device provided in the above embodiment only uses the division of the above functional modules as an example to illustrate when confirming whether a file can be executed. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the file execution device provided in the above embodiment and the file execution method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0084] An embodiment of the present invention provides an electronic device comprising: a memory and a processor. The processor is connected to the memory and is configured to execute the execution method of the above-mentioned file based on the instructions stored in the memory. The number of processors may be one or more, and the processor may be single-core or multi-core. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip. The memory may be an example of the computer-readable medium described below.

[0085] An embodiment of the present invention provides a computer-readable storage medium having stored thereon at least one instruction, at least one program, code set, or instruction set, which is loaded and executed by a processor to implement the execution method of the above-mentioned file. Computer-readable storage media include: permanent and non-permanent, removable and non-removable media can implement information storage by any method or technology. The information can be a computer-readable instruction, data structure, program module, or other data. Examples of computer storage media include, but are not limited to: phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc-read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, disk storage or other magnetic storage device, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device.

[0086] An embodiment of the present invention provides a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set. The at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the above-mentioned file protection-based whitelist rapid confirmation method.

[0087] It is understood from common technical knowledge that the present invention may be implemented by other embodiments that do not depart from its spirit or essential features. Therefore, the embodiments disclosed above are, in all respects, merely illustrative and not exclusive. All modifications within the scope of the present invention or equivalent to the scope of the present invention are intended to be encompassed by the present invention.

Claims

1. A method for executing a file, characterized in that: The execution method includes: detecting an execution instruction of a first file, where the first file is a file to be verified; In response to detecting the execution instruction of the first file, determining whether the size of the first file is smaller than a preset size threshold; If it is determined that the size of the first file is smaller than a preset size threshold, obtaining a path for storing the second file in a preset protected folder from a preset whitelist based on the identification information of the first file, the second file being a secure and credible first file, and the protected folder being established based on file protection technology; determining whether to allow execution of the first file based on the read content of the first file and the read content of the second file; The determining whether to allow execution of the first file according to the read content of the first file and the read content of the second file includes: Obtaining the read content of the first file; comparing the read content of the first file with the read content of the second file; In response to a comparison result of consistency, allowing execution of the first file; otherwise, prohibiting execution; The file execution method further includes: if it is determined that the size of the first file is not less than a preset size threshold, obtaining a real-time calculated feature value of the first file; Determining whether there is a stored characteristic value in a preset whitelist that matches the real-time calculated characteristic value, the stored characteristic value being obtained by calculating a characteristic value of the secure and reliable first file; In response to a stored characteristic value matching the real-time calculated characteristic value in a preset whitelist, execution of the first file is permitted; otherwise, execution is prohibited.

2. The execution method according to claim 1, characterized in that: The method further comprises: In response to a newly added first file being a secure and credible file; Determining whether the size of the first file is smaller than a preset size threshold; In response to the size of the first file being smaller than a preset size threshold, generating a second file located in the protection folder, and updating identification information of the first file and a path of the second file in the whitelist; In response to the size of the first file being not less than a preset size threshold, a feature value of the first file is calculated as a storage feature value, and identification information of the first file and the storage feature value are updated in the whitelist.

3. The execution method according to claim 1, characterized in that: The identification information of the first file is the absolute path where the first file is stored.

4. The execution method according to claim 2, characterized in that: After the size of the first file is smaller than a preset size threshold, and before the second file is generated in the protection folder, the method further includes: Determining whether the expected startup frequency of the first file meets a preset frequency threshold; In response to meeting the preset frequency threshold, jumping to the step of generating a second file located in the protection folder; After generating the second file located in the protection folder, the method further includes: In response to not meeting the preset frequency threshold, a feature value of the first file is calculated as a stored feature value, and the identification information of the first file and the stored feature value are updated in the whitelist.

5. The execution method according to claim 1, characterized in that: The method further comprises: Generate a test file of T-byte size; Obtain the time A for reading the test file content, the time B for calculating the real-time calculated characteristic value of the test file, the time C for comparing the test file content byte by byte, the time D for reading the stored characteristic value of the test file, and the time E for comparing the real-time calculated characteristic value of the test file with the stored characteristic value byte by byte; The size of the T bytes is adjusted. When A+A+C is smaller than A+B+D+E, the maximum value of all corresponding T bytes is used as the size threshold.

6. A file execution device, characterized in that: The execution device includes: an instruction detection module, configured to detect an execution instruction of a first file, where the first file is a file to be verified; a size determination module, configured to determine whether the size of the first file is smaller than a preset size threshold in response to detecting the execution instruction of the first file; a path acquisition module, configured to, if it is determined that the size of the first file is smaller than a preset size threshold, obtain, from a preset whitelist based on the identification information of the first file, a path of a second file stored in a preset protected folder, wherein the second file is a secure and reliable first file, and the protected folder is established based on file protection technology; a first execution judgment module, configured to judge whether to allow execution of the first file based on the read content of the first file and the read content of the second file; The first execution judgment module is specifically configured to: Obtaining the read content of the first file; comparing the read content of the first file with the read content of the second file; In response to a comparison result of consistency, allowing execution of the first file; otherwise, prohibiting execution; The file execution device further includes a second execution judgment module, which is specifically configured to: If it is determined that the size of the first file is not less than a preset size threshold, obtaining a real-time calculated feature value of the first file; Determining whether there is a stored characteristic value in a preset whitelist that matches the real-time calculated characteristic value, the stored characteristic value being obtained by calculating a characteristic value of the secure and reliable first file; In response to a stored characteristic value matching the real-time calculated characteristic value in a preset whitelist, execution of the first file is permitted; otherwise, execution is prohibited.

7. An electronic device, characterized in that: The electronic device includes: a processor and a memory for storing executable instructions of the processor; The processor is configured to execute the file execution method according to any one of claims 1 to 5.

8. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the file execution method according to any one of claims 1 to 5 is implemented.

Images