Software process control and monitoring method and device and electronic equipment

Abstract

The invention discloses a software process control and monitoring method and device and electronic equipment. The process information is collected, the management and control strategy is generated and applied to the target client, and a simple and convenient mode is provided for setting the black list and the white list of the process, so that the complexity of manual operation can be reduced, the threshold for configuring the white list is reduced, the management efficiency is improved, and the user experience is improved. And it is ensured that only the software process conforming to the management and control strategy runs on the target client, so that management and control and monitoring of software not conforming to the current application scene are realized. Besides, main running processes are collected to determine black and white lists, and the collected processes are filtered, so that the interference is reduced while the consumption of time and performance during data acquisition is reduced; during matching, according to comprehensive consideration of process names, paths, file attributes and the like, misjudgment is reduced, and the difficulty of disguising as a white list is increased.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a software process control and monitoring method, device and electronic equipment. Background Art

[0002] At present, in order to effectively control users from running software programs unrelated to a specific scenario in a specific scenario, process control technology is needed, which usually controls the software programs that users can run by configuring process blacklists and whitelists. The related technology generally requires users to manually configure process blacklists and whitelists. This method requires manual entry of process names or process path whitelists, which brings about the problems of high threshold for use and cumbersome operation. Summary of the invention

[0003] The main technical problem solved by the implementation method of the present application is how to simply and conveniently set the blacklist and whitelist of a process.

[0004] To solve the above technical problems, the first technical solution adopted in the implementation mode of the present application is: to provide a software process control and monitoring method, including: sending a collection process request command; receiving environmental process information of the second client returned according to the process request command; generating a software control policy according to the environmental process information; sending the software control policy to the second client, so that the second client can control and monitor the software running on the second client according to the software control policy.

[0005] To solve the above technical problems, the second technical solution adopted in the implementation mode of the present application is: to provide a software process control and monitoring method, including: receiving a collection process request command; obtaining environmental process information according to the collection process request command; sending the environmental process information to a first client, so that the first client generates a software control policy according to the environmental process information; receiving the software control policy sent by the first client, and controlling and monitoring the currently running software according to the software control policy.

[0006] To solve the above technical problems, the third technical solution adopted in the implementation mode of the present application is: to provide a software process control and monitoring device, including: a command sending module, used to send a collection process request command; an environment process information acquisition module, used to receive the environment process information of the second client returned according to the process request command; a software control policy generation module, used to generate a software control policy according to the environment process information; a software control policy issuing module, used to send the software control policy to the second client, so that the second client can control and monitor the software running on the second client according to the software control policy.

[0007] To solve the above technical problems, the fourth technical solution adopted in the implementation mode of the present application is: to provide a software process control and monitoring device, including: a command receiving module, used to receive a collection process request command; an environment process information acquisition module, used to obtain environment process information according to the collection process request command; an environment process information sending module, used to send the environment process information to a first client, so that the first client generates a software control policy according to the environment process information; a software control and monitoring module, used to receive the software control policy sent by the first client, and control and monitor the currently running software according to the software control policy.

[0008] To solve the above technical problems, the fifth technical solution adopted in the implementation mode of the present application is: to provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the software process control and monitoring method as described above.

[0009] In order to solve the above technical problems, the sixth technical solution adopted in the implementation mode of the present application is: providing a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by an electronic device, the electronic device executes the software process control and monitoring method as described above.

[0010] To solve the above technical problems, the seventh technical solution adopted in the implementation mode of the present application is: to provide a computer program product, wherein the computer program product includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by an electronic device, the electronic device executes the software process control and monitoring method as described above.

[0011] Different from the related art, the embodiment of the present application provides a method, device and electronic device for software process control and monitoring. By sending a collection process request command, a request can be initiated to the second client to obtain its environmental process information, so that the relevant information of the software process running on the target client can be easily obtained. After receiving the process request command, the second client returns its environmental process information, thereby obtaining detailed information of the software process on the target client, providing a basis for further control and monitoring. According to the collected environmental process information, analysis and comparison are performed, and a software control policy is generated through cooperation with the user to clarify which software processes are allowed or prohibited, thereby realizing the control of the software running on the target client. The generated software control policy can be transmitted by sending it to the second client. According to the received control policy, the second client performs corresponding control and monitoring operations on the software running on it, so that the software process on the target client can be remotely controlled to achieve restrictions on software that does not meet the current application scenario. Therefore, the implementation method of the present application provides a simple and convenient way to set the black and white lists of processes by collecting process information, generating management and control policies and applying them to the target client. This can reduce the complexity of manual operations, lower the threshold for configuring whitelists, improve management efficiency, and ensure that only software processes that comply with the management and control policies are running on the target client, thereby achieving management and monitoring of software that does not comply with the current application scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] One or more embodiments are exemplarily described by corresponding drawings, which do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and the figures in the drawings do not constitute proportional limitations unless otherwise stated.

[0013] Figure 1 This is a system architecture diagram of a software process control and monitoring system provided in an embodiment of the present application;

[0014] Figure 2 It is a timing diagram when the software process control and monitoring system provided in the embodiment of the present application executes the software process control and monitoring method;

[0015] Figure 3 It is a flowchart of a software process control and monitoring method provided by an embodiment of the present application;

[0016] Figure 4 It is a structural diagram of a software process control and monitoring device provided in an embodiment of the present application;

[0017] Figure 5 It is a structural diagram of a software process control and monitoring device provided by another embodiment of the present application;

[0018] Figure 6 It is a hardware structure diagram of an electronic device for executing a software process control and monitoring method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0020] It should be noted that, if there is no conflict, the various features in the embodiments of the present application can be combined with each other, all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device schematic diagram or the order in the flow chart.

[0021] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0022] Software whitelist and blacklist are commonly used security strategies to control the software processes that are allowed or prohibited to run in the system. They are a list or set of rules that define which software processes are allowed or prohibited to execute in the system. Software whitelist: A whitelist is a list of software processes that are allowed to run. Only software processes listed in the whitelist can be executed in the system, and other software processes not listed will be denied or restricted. Whitelist strategies are often used to strictly control the software that can be executed in the system to improve the security of the system and prevent unauthorized software from running. Software blacklist: A blacklist is a list of software processes that are prohibited from running. Software processes listed in the blacklist will be blocked or restricted from executing in the system, while other software processes not listed are allowed to execute. Blacklist strategies are often used to identify and block known malware, viruses or other security risks.

[0023] Whitelists and blacklists can be customized according to actual needs and security policies. By using whitelists and blacklists, you can effectively control and manage the software processes running in the system and improve the security and stability of the system.

[0024] Software blacklists and whitelists can be applied to different fields, such as electronic classroom scenarios, enterprise employee application management, public place terminal management, home network control, scientific research laboratory equipment management, etc. Blacklists and whitelists can be set in these scenarios, and ensure that the set blacklists and whitelists can effectively control the corresponding software processes to meet the needs and security requirements in different environments.

[0025] The related technology is generally completed manually by the user, that is, the required software processes are added to the whitelist one by one. In order not to affect the normal use of the system, the software will also automatically add some system processes to the whitelist. However, this method of manually adding processes to the whitelist has at least the following problems:

[0026] Process identification problem: Determining the software to which a process belongs may face identification difficulties. A piece of software may consist of multiple processes, which may have different names or paths, making it difficult to accurately associate them with a specific software, which may result in the wrong process being added to the blacklist and whitelist, thus affecting the normal operation of the system;

[0027] Insufficient control: By modifying the executable file name or installing it to a whitelist directory, this disguise makes it difficult for the management side to identify and control the software process of the managed side.

[0028] Based on this, the inventor provides a software process control and monitoring method and device in the process of implementing the embodiment of the present application, which mainly collects process information, generates control policies and applies them to the target client, and provides a simple and convenient way to set the black and white list of the process, which can reduce the complexity of manual operation, lower the threshold for configuring the white list, improve management efficiency, and ensure that only software processes that comply with the control policy are running on the target client, thereby achieving control and monitoring of software that does not conform to the current application scenario. In addition, the main running processes are collected to determine the black and white list, and the collected processes are filtered, thereby reducing the time and performance consumption during data collection while also reducing interference, and reducing the difficulty of users in making decisions on black and white lists; when matching, the process name, path, and file attributes are comprehensively considered, thereby reducing misjudgment and increasing the difficulty of disguising as a white list.

[0029] The following describes the software process control and monitoring method and device of the embodiments of the present application through specific examples.

[0030] See also Figure 1 , Figure 1 1 is a system architecture diagram of a software process control and monitoring system provided in an embodiment of the present application, and a software process control and monitoring method can be applied to the software process control and monitoring system. Figure 1As shown, the software process control and monitoring system includes a first client 10, a backend 20 and a second client 30. The first client 10 is connected to the backend 20 via a network, and the backend 20 is also connected to at least one second client 30 via a network. Among them, multiple second clients 30 can also be connected to each other via a network.

[0031] The first client 10 provides an interactive method for generating a collection process request command through client tools such as mobile applications, mobile clients, and browsers, so that users can generate collection process request commands according to specific application scenarios. For example, a target mobile client for software process control and monitoring is installed on a mobile terminal. The user interacts with the target mobile client on the mobile terminal to generate a command for collecting environmental process information of one or more remote target computer devices, obtains the environmental process information of the one or more remote target computer devices according to the command, generates a software control policy according to the environmental process information, and sends the software control policy to the one or more remote target computer devices, so that the one or more remote target computer devices can control and monitor the running software according to the software control policy. Among them, the one or more remote target computer devices can be the second client 30.

[0032] like Figure 1 As shown, when executing a software process control and monitoring operation, the first client 10 obtains the terminal information of the second client 30 (such as the IP address of the second client 30) from the backend 20, and the first client 10 directly connects with the second client 30 according to the IP address of the second client 30, thereby sending a collection process request command to the second client 30, and the second client 30 responds to the collection process request command, obtains the environment process information, and sends the environment process information to the first client 10, and the first client 10 generates a software control policy according to the environment process information, and sends the software control policy to the second client 30, so that the second client 30 controls and monitors the software running on the second client 30 according to the software control policy. Among them, the backend 20 can manage and store the terminal information of the second client 30, and it can be used as a central server or database to maintain and manage the relevant information of the second client 30, including the IP address, configuration information, status, etc. The backend 20 can provide an interface for the first client 10 to access to obtain the terminal information of the second client 30.

[0033] The back end 20 can be a server, which can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0034] The first client 10 and the second client 30 may be intelligent terminal devices such as personal computers, laptop computers, etc. The first client 10 and the second client 30 may be located in the same local area network, and both the first client 10 and the second client 30 are in a powered-on state.

[0035] When there are multiple second clients 30, the first client 10 may send a collection process request command to any one of the second clients 30, and obtain the environment process information returned by the second client 30 according to the collection process request command. By default, the environment process information of multiple second clients 30 is the same, so only one of the second clients 30 needs to return the environment process information. The software control policy is sent to multiple second clients 30.

[0036] Figure 1 The software process control and monitoring system shown is only an example of executing the software process control and monitoring method. Figure 1 The software process control and monitoring method of the embodiment of the present application is explained based on the software process control and monitoring system shown.

[0037] See also Figure 2 , Figure 2 This is a timing diagram of the software process control and monitoring system provided in the embodiment of the present application executing the software process control and monitoring method. Figure 2 , the embodiment of the present application provides a software process control and monitoring method, specifically, as Figure 3 As shown, including:

[0038] S101. A first client sends a collection process request command.

[0039] The collect process request command refers to a request to send a command to the target client to obtain its environmental process information as part of the control and monitoring system. This command is used to trigger the target client to perform corresponding operations to collect information about the running software process and return it to the requester. Specifically, the collect process request command can be a network request or instruction, which establishes a communication connection with the target client and sends a specific command or request to it. The command can be transmitted through a network protocol (such as HTTP, TCP / IP) or other communication mechanism. The content of the command may include a request identifier, specific instruction parameters, or other necessary information to ensure that the target client can understand and correctly execute the request. After receiving the collect process request command, the target client will perform corresponding operations according to the content of the command. This may involve obtaining information about the running software process, such as process name, path, ID, etc., and returning this information to the requester as a response, so that the requester can obtain detailed information about the software process running on the target client for subsequent control and monitoring processing.

[0040] The target client may be any client of the second client. The IP address of the target client may be input on the display interface of the first client, thereby establishing a connection between the first client and the target client for subsequent interactive operations.

[0041] S102: The second client receives the process request command, and obtains environmental process information according to the collection process request command.

[0042] The second client parses the process request command to understand the operations to be performed and related parameters, including the format of the parsed command, identifiers or other instruction parameters. According to the requirements of the command, the second client can perform corresponding operations to collect information about the running software process, which may include obtaining the name, path, ID, status, resource usage and other related information of the process. The second client can also sort and organize the collected environment process information for subsequent processing and transmission, such as storing the environment process information in a data structure, such as a list, dictionary or other data type. The second client can also send the organized environment process information back to the requester as a response, and the response can be encapsulated using an appropriate protocol or format to ensure that the first client can correctly parse and process the received information.

[0043] The specific implementation method of obtaining the environment process information may vary depending on the system design, network communication protocol, and specific requirements of the target client. For example, in the client application, the relevant functions or APIs provided by the programming language can be used to perform the collection and processing of process information. At the operating system level, system calls or other system interfaces can be used to obtain process information.

[0044] In some embodiments of the present application, obtaining environmental process information according to the collection process request command includes: obtaining a program file path list from a process list, desktop shortcuts, start menu shortcuts, and registry key paths according to the collection process request command; obtaining file attributes of each file in the program file path list; wherein the program file path list and the file attributes constitute the environmental process information.

[0045] The second client can obtain a list of currently running processes through system calls or related APIs. These process lists usually include the name, ID, and other related information of the process. The second client can also check the user's desktop and start menu shortcuts to obtain path information related to the program. These shortcuts usually contain the path to the program file. The second client can also access the registry of the operating system to obtain key path information related to the program. In the registry, you can find key values ​​related to the installed program, which may contain the path information of the program file.

[0046] According to the collected process list, desktop shortcut, start menu shortcut and registry key path information, the second client can extract the file path list related to the program. These file paths can include executable files, library files and other program-related resource files. For each file in the acquired program file path list, the second client can read its file attributes. File attributes can include file size, creation time, modification time, access rights, file description, digital signature, company, copyright information, product name, original name and other information. These attributes can provide more detailed information about the file. The program file path list and the file attributes constitute the environment process information. The second client can organize this information into a suitable data structure, such as a list or a dictionary, for subsequent processing and transmission.

[0047] When obtaining the environment process information according to the above method, it may vary depending on the operating system, programming language, and requirements of the target client. For example, in the Windows operating system, the Windows API can be used to obtain process information, read registry information, and access file attributes. In the Linux operating system, the corresponding system calls or command line tools can be used to perform similar operations.

[0048] The scheme for obtaining environmental process information in the embodiment of the present application includes collecting the program file path list obtained from the process list, desktop shortcut, start menu shortcut and registry key path, and obtaining the file attributes of each file. These information constitute the environmental process information for subsequent management and control and monitoring processing. On the one hand, the program file path list is obtained from the process list, desktop shortcut, start menu shortcut and registry key path, and only the main running processes are collected. Compared with a full disk scan, the scanning time and system resource consumption can be greatly reduced. The main running processes are usually programs frequently used by users, and they have a greater impact on the system. By only collecting the program file path list of these processes, the location and attributes of key software in the system can be more accurately understood, avoiding the collection of a large amount of irrelevant or useless information. Collecting only the main running processes can also simplify the subsequent data analysis and management process, and reduce the difficulty of users to decide on black and white lists. By focusing on the main running processes, the software running in the system can be more effectively monitored and managed, which helps to timely discover potential security risks and malicious activities and take corresponding protective measures. On the other hand, obtaining file attributes as part of the environmental process information can provide important basis and reference for subsequent software control strategies. By analyzing file attributes, it can help determine the identity and characteristics of the process, thereby more accurately judging whether the process complies with the control strategy.

[0049] In some embodiments of the present application, the method further includes: filtering the system processes and processes without interfaces in the environment process information to obtain filtered environment process information. Among them, the system process is usually part of the operating system itself or other system-level components, and has nothing to do with the software mainly run by the user. By filtering out the system processes, the accuracy of the environment process information can be improved, making it more focused on the software actually used by the user. Processes with interfaces are usually processes that users can see and interact with. By filtering out processes without interfaces, the focus can be on the main software visible to the user, thereby accurately obtaining software that is more closely related to the user. Among them, processes without interfaces include tool programs, and tool programs can also be filtered out to avoid including unnecessary tools and auxiliary programs in the environment process information. This can simplify the subsequent data analysis and processing process and focus on analyzing the software that is truly relevant to the user.

[0050] Among them, for the processes of the operating system itself, whether it is a system process can be determined by comparing the process name, process path or process identifier. Depending on the operating system, specific filtering rules can be written or the API provided by the operating system can be used to identify the system process. By excluding these system processes, processes that are not related to the software mainly run by the user can be filtered out. Processes with interfaces usually interact with users, such as opening windows, displaying graphical interfaces, etc. The API or command provided by the operating system can be used to obtain the window handle or interface-related information of the process. By judging whether the process has an interface, filtering is performed, only processes with interfaces are retained, and background running or service-type processes are filtered out. Tool programs are usually auxiliary programs or system management tools, which are not related to the user's main business software. They can be filtered by comparing information such as process names, process paths or process descriptions, or according to a pre-defined list of tool programs. These tool programs are excluded from the environment process information, and the focus is on the software that is actually related to the user. The above filtering methods can be adjusted and optimized according to the specific operating system and programming environment. The filtering of process information can be achieved in combination with the API, command line tools or third-party tools provided by the operating system. According to the needs and specific scenarios, suitable filtering rules and strategies can be selected to ensure that the filtered environment process information is more accurate.

[0051] S103: The second client sends the environment process information to the first client.

[0052] The second client can send the above-mentioned environment process information including the program file path list and file attributes to the first client, and can further filter the environment process information according to the above steps, and then send the filtered environment process information to the first client. Of course, the second client can also directly send the obtained environment process information to the first client.

[0053] S104: The first client receives the environment process information and generates a software management and control strategy according to the environment process information.

[0054] Among them, generating a software control strategy based on the environmental process information includes: displaying the environmental process information obtained on the first client, including displaying the process name, path, file attributes and other information, so that the user of the first client can configure the blacklist and whitelist according to the displayed environmental process information, that is, select the process belonging to the blacklist and the process belonging to the whitelist. In this embodiment, the software control strategy is mainly actively configured by the user of the first client, and the user can manage the processes running in the system more flexibly according to his understanding and needs of the environmental process. The user can configure according to his own needs instead of relying on preset rules or restrictions.

[0055] Optionally, the software control policy can also be automatically configured and generated. Generating the software control policy according to the environment process information includes: analyzing the environment process information, comparing the process name and the file attribute of the environment process information with a predefined black and white list, so as to configure and obtain a black and white list for controlling the second client software.

[0056] First, the collected environment process information is analyzed, including relevant information such as process names and file attributes. Predefined black and white lists can be established in advance to determine which processes are allowed or prohibited. The black list contains a list of processes that are not allowed to run, and the white list contains a list of processes that are allowed to run. These lists can be defined based on security policies, organizational needs, or industry best practices. Then the process name and file attributes in the environment process information are compared with the predefined black and white lists. Among them, the process name can use a string matching algorithm or regular expression to determine whether it matches the entry in the black and white list. The file attributes can compare the file description, digital signature, company, copyright information, product name, original name, creation time, modification time and other attributes with the conditions defined in the black and white list. According to the comparison results, a black and white list for controlling the second client software is configured. The processes that match the black list are included in the prohibited list, and the processes that match the white list are included in the allowed list. In this way, the operation of specific software can be restricted or authorized to meet security policies and control requirements. Among them, the generated black and white lists can be updated and maintained regularly to adapt to environmental changes and new software versions. In addition, the configuration of blacklists and whitelists can also work in conjunction with other security measures (such as firewalls, intrusion detection systems, etc.) to improve overall security and control effectiveness.

[0057] In an embodiment of the present application, by analyzing process information, predefining black and white lists, comparing process information with black and white lists, and configuring black and white lists for managing the second client software based on the comparison results, the operation of specific software can be restricted or authorized to improve the security and management capabilities of the system.

[0058] S105: The first client sends the software management and control policy to the second client.

[0059] The first client sends the software control policy to the second client connected to it. When the blacklist and whitelist in the first client are updated, the first client also sends the updated blacklist and whitelist to the second client connected to it.

[0060] In some embodiments, the first client can synchronize the software control policy to all second clients through the heartbeat logic, and ensure that the software control policy of the second client is the latest state. Specifically, a heartbeat mechanism can be defined, which allows the first client to establish communication with all second clients and sends heartbeat signals regularly. The heartbeat signal contains the current software control policy information, which can be a summary of the policy, a version number or a complete policy file, depending on the specific requirements and implementation methods. All second clients will receive the heartbeat signal from the first client and parse the software control policy information therein. The second client also compares the received policy version with its current policy version. If the received version is newer, the local software control policy needs to be updated. If the policy version of the second client is older, it can extract the latest policy information from the heartbeat signal and apply it to the local software control policy, which can include operations such as updating the black and white list, adding or deleting the list of allowed or prohibited software. Once the software control policy is updated, the second client can send a confirmation message to the first client to indicate that the policy has been successfully synchronized. Through such a heartbeat logic, the first client can regularly send updates to the software control policy to all second clients to ensure that the policy of the second client is always the latest. This synchronization mechanism can provide the advantages of centralized management and distributed deployment, while ensuring that all second clients are in a consistent management state.

[0061] In some embodiments, the heartbeat logic can also achieve the confidentiality and integrity of the software management and control policy. For example, using secure communication protocols and encryption algorithms to protect the transmission of heartbeat signals, technologies such as Transport Layer Security (TLS) or Virtual Private Network (VPN) can be used to ensure the confidentiality of heartbeat signals during transmission. During the sending and receiving of heartbeat signals, appropriate identity authentication can also be performed to ensure the legitimacy of both communicating parties, which can be achieved using digital certificates, tokens or other identity authentication mechanisms. The specific content of the software management and control policy can be encrypted so that even if it is intercepted during transmission, the plaintext content of the policy cannot be easily obtained.

[0062] S106: The second client receives the software control policy, and controls and monitors the currently running software according to the software control policy.

[0063] Among them, controlling and monitoring the currently running software according to the software control policy specifically includes: when receiving the software control policy, scanning the current process snapshot and terminating the illegal process; judging whether the process belongs to the blacklist or the whitelist according to the software control policy, if the process belongs to the whitelist, releasing the process, if the process belongs to the blacklist, intercepting the process. Among them, obtaining the process snapshot of the current system includes a list of running processes and information related to these processes, such as process name, path and file attributes. Compare the process information in the snapshot with the blacklist defined by the policy. If any process is found to be an illegal process defined in the blacklist, the driver monitors the creation action of the illegal process and directly intercepts the creation to ensure that they no longer run.

[0064] S107, the second client sends the processes that are neither in the whitelist nor in the blacklist to the first client. For the processes that are neither in the whitelist nor in the blacklist, they are reported to the first client. In this way, these unknown processes can be further reviewed and processed on the first client to determine whether to add them to the whitelist or blacklist of the policy.

[0065] S108: The first client receives the process that does not belong to the whitelist or the blacklist, receives a selection operation of the first client user on the reported process, and responds to the selection operation to determine to add the process to the whitelist or the blacklist.

[0066] In some embodiments, the process that does not belong to the whitelist or the blacklist can also be compared with the process operation violation record to determine whether the process is a violation process. The process operation violation record refers to information recording the violation behavior or abnormal activity of the process during operation. The process operation violation record may specifically include:

[0067] Records the system calls executed by the process during its running, including the called function, parameter values, and operation type. For example, it records that a process uses a system call to access the hard disk, and the parameter specifies an illegal file path.

[0068] According to the current application scenario and policy requirements, record whether the behavior of the process meets expectations. For example, in an electronic classroom, record the behavior of students logging into game software to determine whether the behavior meets the teaching needs.

[0069] Record the communication activities between the process and the external system or network, including the data sent and received, the communication protocol, the target address and other information. For example, in a scientific research laboratory, record the data sent by the device to the external device through the chat software to determine whether there is unauthorized communication or abnormal data transmission.

[0070] S109: Update the software management and control policy according to the result of adding the process to the whitelist or the blacklist.

[0071] S110: The first client sends the updated software management and control policy to the second client, so that the second client manages and monitors the software running on the second client according to the updated software management and control policy.

[0072] The software process control and monitoring method provided in the embodiment of the present application mainly provides a simple and convenient way to set the black and white list of the process by collecting process information, generating a control strategy and applying it to the target client, which can reduce the complexity of manual operation, lower the threshold for configuring the white list, improve management efficiency, and ensure that only software processes that comply with the control strategy are running on the target client, thereby achieving control and monitoring of software that does not comply with the current application scenario. In addition, the main running processes are collected to determine the black and white list, and the collected processes are filtered, thereby reducing the time and performance consumption during data collection while also reducing interference; when matching, the process name, path, and file attributes are comprehensively considered, thereby reducing misjudgment and increasing the difficulty of disguising as a white list.

[0073] See also Figure 4 The embodiment of the present application provides a software process control and monitoring device, which can be applied to the above-mentioned first client. The software process control and monitoring device 20 includes:

[0074] A command sending module 21, used for sending a collection process request command;

[0075] An environment process information acquisition module 22, used to receive the environment process information of the second client returned according to the process request command;

[0076] A software control strategy generating module 23, used to generate a software control strategy according to the environment process information;

[0077] The software control policy sending module 24 is used to send the software control policy to the second client, so that the second client can control and monitor the software running on the second client according to the software control policy.

[0078] See also Figure 5 Another embodiment of the present application provides a software process control and monitoring device, which can be applied to the above-mentioned second client. The software process control and monitoring device 30 includes:

[0079] A command receiving module 31 is used to receive a collection process request command;

[0080] An environment process information acquisition module 32, used to acquire environment process information according to the collection process request command;

[0081] An environment process information sending module 33 is used to send the environment process information to the first client, so that the first client generates a software management and control strategy according to the environment process information;

[0082] The software control and monitoring module 34 is used to receive the software control policy sent by the first client, and control and monitor the currently running software according to the software control policy.

[0083] It should be noted that the above-mentioned software process control and monitoring device can execute the software process control and monitoring method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in the embodiment of the software process control and monitoring device, please refer to the software process control and monitoring method provided in the embodiment of the present application.

[0084] See also Figure 6 , Figure 6 4 is a hardware structure diagram of an electronic device 40 for executing a software process control and monitoring method provided in an embodiment of the present application. The electronic device may be the first client or the second client. Figure 6 As shown, the electronic device 40 includes:

[0085] One or more processors 41 and memory 42, Figure 6 A processor 31 is taken as an example.

[0086] The processor 41 and the memory 42 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0087] The memory 42 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the software process control and monitoring method in the embodiment of the present application. The processor 41 executes various functional applications and data processing of the electronic device by running the non-volatile software programs, instructions and modules stored in the memory 42, that is, realizing the software process control and monitoring method in the above method embodiment.

[0088] The memory 42 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created according to the use of the software process control and monitoring device, etc. In addition, the memory 42 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 42 may optionally include a memory remotely arranged relative to the processor 41, and these remote memories may be connected to the software process control and monitoring device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0089] The one or more modules are stored in the memory 42, and when executed by the one or more processors 41, the software process control and monitoring device method in any of the above method embodiments is executed.

[0090] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0091] The electronic devices of the embodiments of the present application exist in various forms, including personal computers, laptop computers, smart phones, etc.

[0092] The embodiment of the present application provides a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more processors, such as Figure 6 A processor 41 in the embodiment may enable the one or more processors to execute the software process control and monitoring method in any of the above method embodiments.

[0093] An embodiment of the present application provides a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by the electronic device, the electronic device is enabled to execute the software process control and monitoring method in any of the above-mentioned method embodiments.

[0094] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0095] Through the description of the above implementation methods, ordinary technicians in this field can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, it can also be implemented by hardware. Ordinary technicians in this field can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Under the concept of the present application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes in different aspects of the present application as described above, which are not provided in detail for the sake of simplicity. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features can be replaced by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A software process control and monitoring method, characterized in that: include: Send a collection process request command; Receiving the environment process information of the second client returned according to the process request command; Generate a software control strategy according to the environmental process information; The software control policy is sent to the second client, so that the second client controls and monitors the software running on the second client according to the software control policy.

2. The method according to claim 1, characterized in that The receiving the environment process information of the second client returned according to the process request command includes: Receive the environment process information of the second client returned according to the process request command, wherein the environment process information is a program file path list collected by the second client from a process list, a desktop shortcut, a start menu shortcut, and a registry key path.

3. The method according to claim 2, characterized in that The program file path list includes file attributes of each file.

4. The method according to claim 3, characterized in that: Generating a software control strategy according to the environment process information includes: The environment process information is analyzed, and the process name and the file attribute of the environment process information are compared with a predefined black and white list to configure and obtain a black and white list for managing and controlling the second client software.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: receiving the process reported by the second client; receiving a selection operation of the first client user on the reported process, and in response to the selection operation, adding the reported process to a whitelist or a blacklist; Update the software control policy according to the result of adding the reported process to the whitelist or blacklist; Send the updated software management and control policy to the second client.

6. A software process control and monitoring method, characterized in that: include: Receive a collection process request command; Acquire environmental process information according to the collection process request command; Sending the environment process information to the first client, so that the first client generates a software management and control policy according to the environment process information; Receive the software control policy sent by the first client, and control and monitor the currently running software according to the software control policy.

7. The method according to claim 6, characterized in that The acquiring of the environment process information according to the collection process request command includes: A program file path list obtained by collecting from a process list, a desktop shortcut, a start menu shortcut, and a registry key path according to the collect process request command; Obtain the file attributes of each file in the program file path list; The program file path list and the file attributes constitute the environment process information.

8. The method according to claim 6 or 7, characterized in that: The method further comprises: The system processes and processes without interfaces in the environment process information are filtered to obtain filtered environment process information.

9. The method according to claim 6, characterized in that The receiving the software control policy sent by the first client, and controlling and monitoring the currently running software according to the software control policy, includes: When receiving the software control policy, scan the current process snapshot and terminate the illegal process; Determine whether the process belongs to the blacklist or the whitelist according to the software control policy, and if the process belongs to the whitelist, release the process; if the process belongs to the blacklist, intercept the process; If the process does not belong to the whitelist or the blacklist, report the process to the first client.

10. A software process control and monitoring device, characterized in that: include: A command sending module, used for sending a collection process request command; An environment process information acquisition module, used to receive the environment process information of the second client returned according to the process request command; A software control strategy generation module, used to generate a software control strategy according to the environment process information; The software control policy sending module is used to send the software control policy to the second client, so that the second client can control and monitor the software running on the second client according to the software control policy.

11. A software process control and monitoring device, characterized in that: include: A command receiving module, used for receiving a collection process request command; An environment process information acquisition module, used to acquire environment process information according to the collection process request command; An environment process information sending module, used for sending the environment process information to the first client, so that the first client generates a software management and control strategy according to the environment process information; The software control and monitoring module is used to receive the software control policy sent by the first client, and control and monitor the currently running software according to the software control policy.

12. An electronic device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in any one of claims 1-9.

Images