Process protection method, device, computer equipment, storage medium and program product

Abstract

The present invention relates to the field of computer technology, and discloses a process protection method, device, computer equipment, storage medium and program product. The method comprises: obtaining the state information of a first process; wherein the state information comprises a first identifier; detecting whether there is a second identifier identical to the first identifier in a process table according to the first identifier; if there is a second identifier identical to the first identifier in the process table, detecting whether the state of the second process corresponding to the second identifier satisfies a preset state; if the state of the second process corresponding to the second identifier satisfies the preset state, stopping the first process.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a process protection method, device, computer equipment, storage medium and program product. Background Art

[0002] Currently, the rule engine is used to analyze the behavior characteristics of processes to distinguish normal from abnormal behaviors. Once an abnormal process is detected, the system will trigger the automatic closure of the process and restrict its resource access rights.

[0003] However, after executing the shutdown or restriction instruction on the monitored abnormal process, the monitoring of the abnormal process will be relaxed, which increases the probability of the abnormal process being restarted or called later. Summary of the invention

[0004] In view of this, the present invention provides a process protection method, apparatus, computer equipment, storage medium and program product.

[0005] In a first aspect, the present invention provides a process protection method, the method comprising: obtaining status information of a first process; wherein the status information comprises a first identifier; detecting whether there is a second identifier identical to the first identifier in a process table based on the first identifier; if there is a second identifier identical to the first identifier in the process table, detecting whether the status of a second process corresponding to the second identifier satisfies a preset status; if the status of the second process corresponding to the second identifier satisfies the preset status, stopping the first process.

[0006] The process protection method provided in this embodiment ensures continuous attention to the monitored process by continuously monitoring the process table and process status. It will not relax monitoring after executing a shutdown or restriction instruction at a certain point in time, but will continuously perform status checks and verifications.

[0007] At the same time, by checking processes with the same identifier in the process table and verifying their status, it can be ensured that multiple processes with the same function will not run at the same time, reducing the possibility of abnormal processes being mistakenly started or called again after being closed.

[0008] In a possible implementation, the method also includes: obtaining the CPU occupancy rate and memory occupancy value of the target process in the process table; wherein the target process is any process in the process table; detecting whether the CPU occupancy rate of the target process exceeds a first preset threshold; detecting whether the memory occupancy value of the target process exceeds a second preset threshold; if the CPU exceeds the first preset threshold and / or the memory occupancy value of the target process exceeds the second preset threshold, generating an alarm message and sending the alarm message to the log.

[0009] The process protection method provided in this embodiment monitors the CPU and memory usage of each process in the system in real time to ensure that the system can respond quickly once a process exceeds a preset resource usage threshold, thereby timely discovering and handling resource abuse and preventing system performance degradation or crash.

[0010] At the same time, when it is detected that the resource usage of the process exceeds the preset threshold, the system will automatically generate an alarm message and send it to the log. This automated alarm mechanism reduces the monitoring burden of administrators while ensuring timely recording and tracking of abnormal situations.

[0011] In a possible implementation, the method further includes: if there is no second identifier identical to the first identifier in the process table, storing the first identifier in the process table, and executing the first process.

[0012] The process protection method provided in this embodiment can avoid starting duplicate processes by checking whether there is a second identifier identical to the first identifier in the process table, thereby preventing waste and conflict of system resources. This ensures that each process is unique and only occupies necessary system resources. When it is determined that there is no second identifier identical to the first identifier in the process table, the system can immediately add the first process to the process table and execute it. This fast response mechanism reduces unnecessary delays and improves the overall efficiency of the system.

[0013] In a possible implementation, the method further includes: if the state of the second process corresponding to the second identifier does not meet the preset state, removing the second identifier of the second process, storing the first identifier in the process table, and executing the first process.

[0014] The process protection method provided in this embodiment removes the identifier of the second process and releases the resources occupied by the second process from the process table when the state of the second process is abnormal and cannot meet the preset state, so that these resources can be reallocated to other processes that need them. This helps to avoid resource deadlock and waste and improves the utilization rate of system resources.

[0015] In a possible implementation, the method also includes: obtaining the target CPU occupancy rate and target memory occupancy value corresponding to the target process recorded in the log; detecting whether the target CPU occupancy rate corresponding to the target process recorded in the log and the CPU occupancy rate corresponding to the target process are the same; detecting whether the target memory occupancy value and the memory occupancy value corresponding to the target process are the same; if the target CPU occupancy rate and the CPU occupancy rate corresponding to the target process are not the same, and / or the target memory occupancy value and the memory occupancy value corresponding to the target process are not the same, generating an error prompt message.

[0016] In the process protection method provided in this embodiment, when it is found that the log data is inconsistent with the real-time monitoring data, the system can immediately generate an error prompt message. This helps the administrator to quickly locate the problem and reduce the time and cost of troubleshooting. By comparing the data recorded in the log with the data monitored in real time, the accuracy and consistency of the data can be ensured. This helps to promptly discover and correct possible data errors or inconsistencies, and improve the reliability and accuracy of the system.

[0017] In a second aspect, the present invention provides a process protection device, which includes: a first acquisition module, used to obtain status information of a first process; wherein the status information includes a first identifier; a first detection module, used to detect whether there is a second identifier identical to the first identifier in the process table based on the first identifier; a second detection module, used to detect whether the status of a second process corresponding to the second identifier satisfies a preset state if there is a second identifier identical to the first identifier in the process table; and a stop execution module, used to stop the first process if the status of the second process corresponding to the second identifier satisfies the preset state.

[0018] In one possible implementation, the device also includes: a second acquisition module, used to obtain the CPU and memory occupancy values ​​of the target process in the process table; wherein the target process is any process in the process table; a third detection module, used to detect whether the CPU occupancy rate of the target process exceeds a first preset threshold; a fourth detection module, used to detect whether the memory occupancy value of the target process exceeds a second preset threshold; a generation and sending module, used to generate an alarm message if the CPU occupancy rate exceeds the first preset threshold and / or the memory occupancy value of the target process exceeds the second preset threshold, and send the alarm message to the log.

[0019] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the process protection method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0020] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the process protection method of the first aspect or any corresponding embodiment thereof.

[0021] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the process protection method of the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 is a flowchart of a process protection method according to an embodiment of the present invention;

[0024] Figure 2 is a schematic diagram of a process protection method according to an embodiment of the present invention;

[0025] Figure 3 is a structural block diagram of a process protection device according to an embodiment of the present invention;

[0026] Figure 4 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0028] In modern computer systems and network environments, process management is a key link to ensure system stability, security and effective resource utilization. A process is the basic unit of resource allocation and scheduling in an operating system, and each process performs a specific task or program. However, due to software vulnerabilities, malicious code injection, improper user operations or other external factors, abnormal processes may appear in the system. These abnormal processes may manifest as excessive resource usage, illegal operations, attempts to access restricted resources or unauthorized data transmission, etc., posing a serious threat to the normal operation of the system.

[0029] In order to meet this challenge, it is necessary to develop and implement effective process monitoring systems. These systems can detect and identify abnormal processes in a timely manner by monitoring key indicators such as process behavior, resource usage, network communication, etc. in real time, and then take corresponding measures such as warning, logging, isolating or terminating processes to prevent potential security risks or performance issues.

[0030] Currently, the rule engine is used to analyze the behavior characteristics of processes to distinguish normal from abnormal behaviors. Once an abnormal process is detected, the system will trigger the automatic closure of the process and restrict its resource access rights.

[0031] However, after executing the shutdown or restriction instruction on the monitored abnormal process, the monitoring of the abnormal process will be relaxed, which increases the probability of the abnormal process being restarted or called later.

[0032] Based on this, the present invention provides a process protection method, which ensures continuous attention to the monitored process by continuously monitoring the process table and process status, and will not relax monitoring after executing a shutdown or restriction instruction at a certain point in time, but will continuously perform status checking and verification. At the same time, by checking processes with the same identifier in the process table and verifying their status, it can be ensured that multiple processes with the same function will not be run at the same time, reducing the possibility of abnormal processes being mistakenly started or called again after being closed.

[0033] According to an embodiment of the present invention, a process protection method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] In this embodiment, a process protection method is provided, which can be used in computer devices, such as computers, servers, etc. Figure 1 FIG. 1 is a flow chart of a process protection method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0035] Step S101, obtaining status information of a first process; wherein the status information includes a first identifier.

[0036] The first process may represent the process that needs to be created and started currently. The state information may represent the state data at a certain moment, including but not limited to the process identifier (PID), the process state (such as running, waiting, ready, etc.), the resource situation occupied by the process, etc. The first identifier may indicate the unique identifier of the first process, wherein the first identifier may be the PID, etc. Specifically, the state information of the first process is obtained through an interface or command provided by the operating system.

[0037] As an example, a system call interface provided by the operating system may be used, such as getpid() and ps commands in Linux, which are not specifically limited here.

[0038] Step S102: Detect, based on the first identifier, whether there is a second identifier in the process table that is the same as the first identifier.

[0039] The process table can represent a data structure maintained by the operating system, which is used to store the status information of all processes in the current system. Specifically, the process table can be traversed to find whether there is a second identifier that is the same as the first identifier (PID). Other methods can also be used to determine whether there is a second identifier that is the same as the first identifier (PID). This is not specifically limited here and can be implemented by those skilled in the art. For example, in a Linux system, ps-p can be used. <pid>command to check whether the process with the specified PID exists.

[0040] Step S103: if there is a second identifier that is the same as the first identifier in the process table, it is detected whether the state of the second process corresponding to the second identifier satisfies a preset state.

[0041] The preset state can represent a pre-set process state condition, which is used to determine whether the second process meets a certain specific state. Among them, the preset state can be that the second process is running and no damage has occurred, etc., which is not specifically limited here. The second process can represent a process that already exists in the process table. Among them, the second process has a corresponding second identifier. If a second identifier that is the same as the first identifier is found, it is further checked whether the state of the second process meets the preset state. For example, if the preset state is "running", you can use ps -o stat=-p <pid>command to get the status of the second process and determine whether it is "R" (running).

[0042] Step S104: if the state of the second process corresponding to the second identifier satisfies a preset state, the first process is stopped.

[0043] If the state of the second process meets the preset condition, it indicates that the first process is not needed, and therefore, there is no need to execute the first process. Therefore, an operation of stopping the first process is executed.

[0044] As an example, the first process may be stopped using a process termination interface or command provided by the operating system.

[0045] As an example, a signal may be sent to the first process to give it a chance to perform cleanup operations before terminating.

[0046] For example, in Linux, you can use kill -9 <pid>command to forcibly terminate the process with the specified PID. However, it should be noted that this method may cause the process to fail to complete the necessary cleanup operations. A more gentle method is to use kill <pid>command, sends the default TERM signal to the process, giving it a chance to clean up before terminating.

[0047] The process protection method provided in this embodiment ensures continuous attention to the monitored process by continuously monitoring the process table and process status. It will not relax monitoring after executing a shutdown or restriction instruction at a certain point in time, but will continuously perform status checks and verifications.

[0048] At the same time, by checking processes with the same identifier in the process table and verifying their status, it can be ensured that multiple processes with the same function will not run at the same time, reducing the possibility of abnormal processes being mistakenly started or called again after being closed.

[0049] In a possible implementation, the method further includes:

[0050] Step a1, obtaining the CPU occupancy rate and memory occupancy value of the target process in the process table; wherein the target process is any process in the process table.

[0051] The target process can be any process in the process table, that is, the computer device can detect the CPU occupancy rate and memory occupancy value of each process in the process table in real time. Among them, the CPU occupancy rate represents the percentage of time that the process occupies CPU resources in a period of time. The memory occupancy value represents the size of the memory currently occupied by the process, which can be specifically expressed in units such as bytes (Byte), kilobytes (KB), and megabytes (MB). Specifically, the CPU occupancy rate and memory occupancy value of the target process can be obtained from the process table through the interface or command provided by the operating system.

[0052] As an example, the system call interface provided by the operating system, such as the top and ps commands in Linux, or reading the / proc / [pid] / stat file, is used to obtain the CPU usage and memory usage values ​​of the target process in the process table.

[0053] As an example, a third-party monitoring tool or library function, such as the psutil library of Python, is used to obtain the CPU usage and memory usage values ​​of the target process in the process table.

[0054] For example, in Linux, you can use ps -o pid, pcpu, rss = -p <pid>command to obtain the PID, CPU usage, and memory usage value (RSS) of the target process.

[0055] Step a2, detecting whether the CPU occupancy rate of the target process exceeds a first preset threshold.

[0056] The first preset threshold value may represent a threshold value of whether the CPU occupancy rate of the target process is faulty. The first preset threshold value may be M or N, etc., which is not specifically limited here. Specifically, the CPU occupancy rate of the target process is compared with the first preset threshold value to determine whether it exceeds the first preset threshold value.

[0057] Step a3, detecting whether the memory usage value of the target process exceeds a second preset threshold.

[0058] The second preset threshold value may represent a threshold value of whether the memory usage value of the target process has a fault. The first preset threshold value may be K or L, etc., which is not specifically limited here. Specifically, the memory usage value of the target process is compared with the second preset threshold value to determine whether it exceeds the second preset threshold value.

[0059] Step a4: if the CPU exceeds the first preset threshold and / or the memory usage value of the target process exceeds the second preset threshold, an alarm message is generated and sent to the log.

[0060] The alarm information may represent a warning or notification containing relevant information generated when the CPU usage or memory usage value of the target process is detected to exceed a preset threshold. The alarm information may be that the CPU usage or memory usage value of the target process is too high, etc., which is not specifically limited here.

[0061] Specifically, when it is detected that the CPU occupancy rate or memory occupancy value of the target process exceeds a preset threshold, an alarm message containing the target process information, the exceeded threshold, the current time, etc. is generated and sent to the log system for recording.

[0062] For example, in Python, you can use logging, error("Alarm information: process PID = %d, CPU usage = %d%, memory usage = %dMB exceeds the preset threshold", pid, cpu_usage, memory_usage / 1024 / 1024) to record alarm information. Among them, pid, cpu_usage and memory_usage are the PID, CPU usage and memory usage value (in bytes) of the target process respectively. Among them, adjust the log level (such as error) and log format according to the actual situation.

[0063] The process protection method provided in this embodiment monitors the CPU and memory usage of each process in the system in real time to ensure that the system can respond quickly once a process exceeds a preset resource usage threshold, thereby timely discovering and handling resource abuse and preventing system performance degradation or crash.

[0064] At the same time, when it is detected that the resource usage of the process exceeds the preset threshold, the system will automatically generate an alarm message and send it to the log. This automated alarm mechanism reduces the monitoring burden of administrators while ensuring timely recording and tracking of abnormal situations.

[0065] In a possible implementation, the method further includes: if there is no second identifier identical to the first identifier in the process table, storing the first identifier in the process table, and executing the first process.

[0066] If there is no second identifier that is the same as the first identifier in the process table, that is, there is no second process that is the same as the first identifier in the process table, then the PID (or other unique identifier) ​​of the first process can be added as a new entry in the process table. After confirming that the identifier of the target process has been added to the process table, the process is allowed or started to continue execution. For example: In a Linux system, a Python script is used to monitor processes. The script first checks whether the PID of the target process exists in the process table. If not, subprocess.Popen() (or other similar methods) is used to start the target process and add its PID to the process table (which can be a Python list or dictionary to simulate the function of the process table). Then, the script continues to monitor the CPU and memory usage of the process.

[0067] The process protection method provided in this embodiment can avoid starting duplicate processes by checking whether there is a second identifier identical to the first identifier in the process table, thereby preventing waste and conflict of system resources. This ensures that each process is unique and only occupies necessary system resources. When it is determined that there is no second identifier identical to the first identifier in the process table, the system can immediately add the first process to the process table and execute it. This fast response mechanism reduces unnecessary delays and improves the overall efficiency of the system.

[0068] In a possible implementation, the method further includes: if the state of the second process corresponding to the second identifier does not meet the preset state, removing the second identifier of the second process, storing the first identifier in the process table, and executing the first process.

[0069] For the second process corresponding to the second identifier found, check whether its current state (such as running, suspended, stopped, etc.) meets the preset conditions for starting the first process. If the state of the second process does not meet the conditions for starting the first process, delete the identifier of the process from the process table to release resources or avoid conflicts. For example: In a Linux system, a Python script is used to manage processes. The script first checks whether there is a second process corresponding to the second identifier in the process table and checks its state. If the state of the second process does not meet the preset state (for example, it should be in a running state but is actually stopped), the script deletes the entry of the process and starts the first process.

[0070] The process protection method provided in this embodiment removes the identifier of the second process and releases the resources occupied by the second process from the process table when the state of the second process is abnormal and cannot meet the preset state, so that these resources can be reallocated to other processes that need them. This helps to avoid resource deadlock and waste and improves the utilization rate of system resources.

[0071] In a possible implementation, the method further includes:

[0072] Step b1, obtaining the target CPU occupancy rate and target memory occupancy value corresponding to the target process recorded in the log.

[0073] The log may represent a file or database that records various events, errors, warnings, or debugging information generated during the operation of a system or application. Among them, the target CPU occupancy rate may represent the usage rate or occupancy rate of the target process recorded in the log on the central processing unit (CPU). The target memory occupancy value may represent the usage or occupancy value of the target process recorded in the log on the memory. Specifically, the CPU occupancy rate and memory occupancy value related to the target process are read from the log file.

[0074] As an example, use regular expressions or string parsing methods to extract specific information from log files.

[0075] As an example, if the logs are stored in a structured format (such as JSON, XML), the corresponding parsing library can be used to read the data.

[0076] As an example, resource usage of a specific process is obtained through an API or query language of a log management system.

[0077] Step b2, detecting whether the target CPU occupancy rate corresponding to the target process recorded in the log is the same as the CPU occupancy rate corresponding to the target process.

[0078] Compare the CPU usage recorded in the log with the CPU usage of the currently monitored process to see if they are consistent. For example, if the CPU usage of the currently monitored process with PID 12345 is 30%, and the one recorded in the log is 25%, then they are not the same.

[0079] Step b3, detecting whether the target memory usage value is the same as the memory usage value corresponding to the target process.

[0080] Compare the memory usage recorded in the log with the memory usage of the currently monitored process to see if they are consistent. For example, if the memory usage of the currently monitored process with PID 12345 is 600MB, and the value recorded in the log is 500MB, then they are not the same.

[0081] Step b4: if the target CPU occupancy rate is different from the CPU occupancy rate corresponding to the target process, and / or the target memory occupancy value is different from the memory occupancy value corresponding to the target process, an error prompt message is generated.

[0082] The error message may represent a warning or error message generated by the system or application to notify a user or administrator when a mismatch or abnormality is detected. Specifically, when a mismatch in CPU usage and / or memory usage is detected, an error message is generated and displayed. For example: the resource usage of the process of PID 12345 does not match. The CPU usage recorded in the log is 25%, and the current value is 30%; the memory usage value recorded in the log is 500MB, and the current value is 600MB.

[0083] In the process protection method provided in this embodiment, when it is found that the log data is inconsistent with the real-time monitoring data, the system can immediately generate an error prompt message. This helps the administrator to quickly locate the problem and reduce the time and cost of troubleshooting. By comparing the data recorded in the log with the data monitored in real time, the accuracy and consistency of the data can be ensured. This helps to promptly discover and correct possible data errors or inconsistencies, and improve the reliability and accuracy of the system.

[0084] Please refer to Figure 2 , Figure 2 is a schematic diagram of a process protection method provided according to an embodiment of the present invention.

[0085] In a possible implementation, the present invention can be applied to a Linux terminal. Specifically, the following steps can be performed:

[0086] S1, start the process protection program.

[0087] S2, use the top command to display the CPU and memory usage of each process. More specifically, use the top command in the Linux terminal to update the process table that needs to be protected in real time.

[0088] More specifically, the CPU and memory usage of the process displayed in step S2 are also fed back to the monit tool to manage and monitor processes, files, directories and file systems. The monit tool feeds back the status of the process, the address of the process system file and the directory to step S4.

[0089] S3 automatically monitors and manages processes by setting CPU and memory usage thresholds for each process through the supervisord instruction.

[0090] Specifically, the specific usage steps of the supervisor instruction in step S3 are:

[0091] 1) Install supervisor.

[0092] 1) Install supervisor;

[0093] 2) Create a configuration file in the / etc / supervisor / conf.d / directory;

[0094] command= / usr / bin / my_program;

[0095] autostart = true;

[0096] autorestart = true;

[0097] stderr_logfile= / var / log / my_program.err.log;

[0098] stdout_logfile= / var / log / my_program.out.log;

[0099] 3) Update the configuration and start it.

[0100] S4, track the process status through the PID file to prevent the same process from being started repeatedly.

[0101] That is, before starting a new instance, it will first check whether the PID file exists. If the PID file already exists, it means that the previous process is still running. At this time, the program will read the PID in the PID file and try to check whether the process is still active to avoid starting duplicate processes. After the program reads the value in the PID file, it will check whether the PID corresponds to a running process. If the process corresponding to the PID is still running, the program will not start a new instance. If the program correctly deletes the PID file when exiting, the PID file will not exist even if the process crashes or is forcibly terminated. In this way, the next time it is started, it will not mistakenly think that the process is still running, thereby preventing repeated startup.

[0102] Specifically, when the process status is tracked by using the PID file in step S4, the following sub-steps are performed.

[0103] 1) Create a script;

[0104] have:

[0105] #! / bin / bash;

[0106] PIDFILE=" / var / run / my_program.pid";

[0107] if [-f $PIDFILE]; then;

[0108] echo "Process is already running.";

[0109] exit 1;

[0110] Fi;

[0111] / usr / bin / my_program&

[0112] echo$!>$PIDFILE.

[0113] 2) Clean up the PID file when the program exits.

[0114] S5, use log monitoring to record and monitor process output and error information.

[0115] Furthermore, in step S5, systemd is also required to manage system services and processes, and the process output and error information recorded by log monitoring are fed back to the systemd management system. The systemd management system synchronously feeds back the adjustment content and the state of the process to step S2.

[0116] That is, use log monitoring to record and monitor process output and error information. This step also requires the use of systemd to manage system services and processes. The process output and error information recorded by log monitoring are fed back to the systemd management system; the systemd management system will synchronously feed back the adjustment content and process status to step 2.

[0117] In this embodiment, a process protection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0118] This embodiment provides a process protection device, such as Figure 3 As shown, it includes: a first acquisition module 301, used to obtain the status information of the first process; wherein the status information includes a first identifier; a first detection module 302, used to detect whether there is a second identifier that is identical to the first identifier in the process table according to the first identifier; a second detection module 303, used to detect whether the status of the second process corresponding to the second identifier satisfies a preset status if there is a second identifier that is identical to the first identifier in the process table; and a stop execution module 304, used to stop the first process if the status of the second process corresponding to the second identifier satisfies the preset status.

[0119] In one possible implementation, the device also includes: a second acquisition module, used to obtain the CPU and memory occupancy values ​​of the target process in the process table; wherein the target process is any process in the process table; a third detection module, used to detect whether the CPU occupancy rate of the target process exceeds a first preset threshold; a fourth detection module, used to detect whether the memory occupancy value of the target process exceeds a second preset threshold; a generation and sending module, used to generate an alarm message if the CPU occupancy rate exceeds the first preset threshold and / or the memory occupancy value of the target process exceeds the second preset threshold, and send the alarm message to the log.

[0120] In a possible implementation, the apparatus further includes: a first execution module, configured to store the first identifier in the process table and execute the first process if there is no second identifier identical to the first identifier in the process table.

[0121] In a possible implementation, the device further includes: a second execution module, configured to remove the second identifier of the second process, store the first identifier in the process table, and execute the first process if the state of the second process corresponding to the second identifier does not meet a preset state.

[0122] In a possible implementation, the above-mentioned device also includes: a third acquisition module, used to obtain the target CPU occupancy rate and target memory occupancy value corresponding to the target process recorded in the log; a fifth detection module, used to detect whether the target CPU occupancy rate corresponding to the target process recorded in the log and the CPU occupancy rate corresponding to the target process are the same; a sixth detection module, used to detect whether the target memory occupancy value is the same as the memory occupancy value corresponding to the target process; an error prompt information generation module, used to generate an error prompt information if the target CPU occupancy rate and the CPU occupancy rate corresponding to the target process are different, and / or the target memory occupancy value and the memory occupancy value corresponding to the target process are different.

[0123] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0124] The process protection device in this embodiment is presented in the form of a functional unit, where the functional unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0125] The embodiment of the present invention also provides a computer device having the above Figure 3 The process protection device shown.

[0126] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0127] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0128] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0129] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0130] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0131] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0132] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0133] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0134] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.< / pid> < / pid> < / pid> < / pid> < / pid>

Claims

1. A process protection method, characterized in that: The method comprises: Acquire state information of a first process; wherein the state information includes a first identifier; Detecting, according to the first identifier, whether there is a second identifier identical to the first identifier in the process table; If a second identifier identical to the first identifier exists in the process table, detecting whether a state of a second process corresponding to the second identifier satisfies a preset state; If the state of the second process corresponding to the second identifier meets the preset state, the first process is stopped.

2. The process protection method according to claim 1, characterized in that: The method further comprises: Obtaining the CPU occupancy rate and memory occupancy value of the target process in the process table; wherein the target process is any process in the process table; Detecting whether the CPU occupancy rate of the target process exceeds a first preset threshold; Detecting whether the memory usage value of the target process exceeds a second preset threshold; If the CPU exceeds a first preset threshold and / or the memory usage value of the target process exceeds a second preset threshold, an alarm message is generated and sent to a log.

3. The process protection method according to claim 1, characterized in that: The method further comprises: If the second identifier that is identical to the first identifier does not exist in the process table, the first identifier is stored in the process table, and the first process is executed.

4. The process protection method according to claim 1, characterized in that: The method further comprises: If the state of the second process corresponding to the second identifier does not meet the preset state, the second identifier of the second process is removed, the first identifier is stored in the process table, and the first process is executed.

5. The process protection method according to claim 1, characterized in that: The method further comprises: Get the target CPU usage and target memory usage corresponding to the target process recorded in the log; Detecting whether the target CPU occupancy rate corresponding to the target process recorded in the log is the same as the CPU occupancy rate corresponding to the target process; Check whether the target memory usage value is the same as the memory usage value corresponding to the target process; If the target CPU occupancy rate is different from the CPU occupancy rate corresponding to the target process, and / or the target memory occupancy value is different from the memory occupancy value corresponding to the target process, an error prompt message is generated.

6. A process protection device, characterized in that: The device comprises: A first acquisition module, used to acquire state information of a first process; wherein the state information includes a first identifier; A first detection module, used for detecting whether there is a second identifier identical to the first identifier in the process table according to the first identifier; A second detection module, configured to detect whether a state of a second process corresponding to a second identifier that is identical to the first identifier satisfies a preset state if a second identifier that is identical to the first identifier exists in the process table; The execution stop module is used to stop the first process if the state of the second process corresponding to the second identifier meets a preset state.

7. The process protection device according to claim 6, characterized in that: The device also includes: A second acquisition module is used to obtain the CPU and memory usage values ​​of the target process in the process table; wherein the target process is any process in the process table; A third detection module, used to detect whether the CPU of the target process exceeds a first preset threshold; A fourth detection module, used to detect whether the memory usage value of the target process exceeds a second preset threshold; A generating and sending module is used to generate an alarm message and send the alarm message to a log if the central processing unit exceeds a first preset threshold value and / or the memory usage value of the target process exceeds a second preset threshold value.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the process protection method according to any one of claims 1 to 5 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the process protection method according to any one of claims 1 to 5.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the process protection method according to any one of claims 1 to 5.

Images