Program white list updating method and device, computer equipment and readable storage medium

Abstract

The invention relates to a program white list updating method and device, computer equipment and a readable storage medium. The method comprises the steps that when it is detected that a current program runs, corresponding path information is obtained, Hash calculation is conducted according to the path information to obtain a current Hash value, and when a second program white list of a first level does not contain the current Hash value and a first program white list of the first level contains the current Hash value, the second program white list of the first level does not contain the current Hash value. The first level is adjacent to the second level, the first level is lower than the second level, the first program white list comprises a second program white list, and under the condition that the running count reaches a counter threshold value associated with the second level, a current hash value is added and stored in the second program white list; the second level associated counter threshold is greater than the first level associated counter threshold. Automatic updating is carried out by constructing the universal hash value table and setting the counter threshold value, and the updating efficiency of the program white list is improved.

Description

Technical Field

[0001] The present application relates to the field of security management and control technology, and in particular to a program whitelist updating method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] During the startup of a system program or application, the host security software checks the program in the program whitelist to determine whether it is legal. The search for the program whitelist usually uses a fast algorithm such as a hash table. The algorithm performance is greatly affected by the number of programs in the whitelist. When the number of programs in the whitelist exceeds a certain number, the user will feel obvious lag. In order to improve the detection efficiency of the program, the existing technology divides the program into multiple levels of whitelists and performs detection in sequence.

[0003] However, the current method of dividing the program into multiple levels of whitelists for program operation detection has the problem of low efficiency in updating the program whitelist. Summary of the invention

[0004] Based on this, it is necessary to provide a program whitelist updating method, apparatus, computer device, computer-readable storage medium and computer program product that can improve the updating efficiency of the program whitelist in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for updating a program whitelist, comprising:

[0006] When any current program is detected to be running, the path information of the current program is obtained;

[0007] Perform hash calculation based on the path information to obtain the current hash value corresponding to the current program;

[0008] When the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value, and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value, obtaining the running count of the current program; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist;

[0009] When the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0010] In one embodiment, the method further comprises:

[0011] Based on the query result of the current hash value in the program whitelist, it is determined whether to execute the current program.

[0012] In one embodiment, the query result of the current hash value in the program whitelist is obtained by the following steps:

[0013] Using the current hash value, query the program whitelist corresponding to the highest level in turn to the program whitelist corresponding to the next level;

[0014] If the hash value stored in the program whitelist corresponding to the currently queried level includes the current hash value, the currently queried level is determined as the first level, and the previous level of the currently queried level is determined as the second level, the query is terminated and the corresponding first query result is generated;

[0015] After all program whitelists are traversed and no hash value stored in any program whitelist contains the current hash value, the query is terminated and a corresponding second query result is generated.

[0016] In one embodiment, judging whether to execute the current program according to the query result of querying the current hash value in the program whitelist includes:

[0017] If the query result is the first query result, the current program is allowed to execute;

[0018] If the query result is the second query result, the current program is refused to be executed.

[0019] In an exemplary embodiment, the method further comprises:

[0020] In the event that the running count does not reach the counter threshold associated with the second level, the second program whitelist is not updated.

[0021] In one embodiment, the path information includes path name information and file content information;

[0022] Perform hash calculation based on the path information to obtain the current hash value corresponding to the current program, including:

[0023] Perform hash calculation based on the path name information to obtain a path hash value, and perform hash calculation based on the file content information to obtain a file hash value;

[0024] Using the path hash value and the file hash value, the current hash value corresponding to the current program is constructed.

[0025] In a second aspect, the present application also provides a program whitelist updating device, comprising:

[0026] A path information acquisition module is used to acquire the path information of the current program when it is detected that any current program is running;

[0027] A hash calculation module is used to perform hash calculation according to the path information to obtain the current hash value corresponding to the current program;

[0028] A run count acquisition module, used for acquiring the run count of the current program when the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist;

[0029] The updating module is used to add and store the current hash value in the second program whitelist when the running count reaches the counter threshold associated with the second level; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0030] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] When any current program is detected to be running, the path information of the current program is obtained;

[0032] Perform hash calculation based on the path information to obtain the current hash value corresponding to the current program;

[0033] When the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value, and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value, obtaining the running count of the current program; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist;

[0034] When the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0036] When any current program is detected to be running, the path information of the current program is obtained;

[0037] Perform hash calculation based on the path information to obtain the current hash value corresponding to the current program;

[0038] When the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value, and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value, obtaining the running count of the current program; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist;

[0039] When the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0040] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] When any current program is detected to be running, the path information of the current program is obtained;

[0042] Perform hash calculation based on the path information to obtain the current hash value corresponding to the current program;

[0043] When the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value, and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value, obtaining the running count of the current program; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist;

[0044] When the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0045] The program whitelist update method, device, computer equipment, computer-readable storage medium and computer program product described above, when any current program is detected to be running, the path information of the current program is obtained, hash calculation is performed according to the path information, and the current hash value corresponding to the current program is obtained. When the hash value stored in the second program whitelist corresponding to the first level does not contain the current hash value, and the hash value stored in the first program whitelist corresponding to the first level contains the current hash value, the running count of the current program is obtained, wherein the first level and the second level are two adjacent levels, the first level is lower than the second level, the first program whitelist contains the second program whitelist, and when the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist, and the counter threshold associated with the second level is greater than the counter threshold associated with the first level. By establishing a hash value table common to multi-level program whitelists, inquiries can be quickly performed when performing inquiries and updates, and repeated programs correspond to the same hash value, saving the storage space of the system. In addition, by setting a reasonable counter threshold, the automatic update of program whitelists between different levels is realized, which greatly reduces the cost of manual operation, thereby improving the update efficiency of program whitelists. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 An application environment diagram of a program whitelist updating method in one embodiment;

[0048] Figure 2 A schematic diagram of a process flow of a program whitelist updating method in one embodiment;

[0049] Figure 3 A schematic diagram of a process of querying a program whitelist in one embodiment;

[0050] Figure 4 A schematic diagram of the principle of a multi-level program whitelist in one embodiment;

[0051] Figure 5 It is a flowchart of a method for updating a program whitelist in another embodiment;

[0052] Figure 6 is a structural block diagram of a program whitelist updating device in an embodiment;

[0053] Figure 7FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The program whitelist updating method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The data storage system stores multiple levels of program whitelists, including adjacent first and second levels, the first level is lower than the second level, and the first program whitelist corresponding to the first level contains the second program whitelist corresponding to the second level. The program whitelist to which the program belongs is divided according to the running count corresponding to the program, and the counter threshold associated with the second level is greater than the counter threshold associated with the first level. The user initiates a user application to the server 104 through the terminal 102, and the server 104 generates the current program according to the user application. When the server 104 detects that any current program is running, the path information of the current program is obtained, and a hash calculation is performed according to the path information to obtain the current hash value corresponding to the current program. When the hash value stored in the second program whitelist corresponding to the second level does not contain the current hash value, and the hash value stored in the first program whitelist corresponding to the first level contains the current hash value, the running count of the current program is obtained, and when the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0056] In an exemplary embodiment, Figure 2 As shown, a program whitelist update method is provided, which is applied to Figure 1The server 104 in the example is used as an example to illustrate the method, which includes the following steps S201 to S204. Among them:

[0057] Step S201, when it is detected that any current program is running, the path information of the current program is obtained.

[0058] Among them, the program can be understood as a set of instructions pre-written by relevant technical personnel, and the computer uses these instructions to perform specific tasks. The computer understands and executes these instructions through an interpreter or compiler. The path information can be understood as the location description of the file or directory where the target information that the current program wants to obtain is located.

[0059] Optionally, when a user initiates a user request to the server 104 through the terminal 102, when the server 104 generates a current program according to the user request, it can be considered that the running of any current program is detected, that is, the running of the current program here is not actually executed on the server 104, but is understood as the generation of a current program to be run. The server 104 obtains the path information of the current program, laying a data foundation for the subsequent calculation of the unique hash value of the current program, thereby speeding up the update speed of the program whitelist.

[0060] Step S202, performing hash calculation according to the path information to obtain a current hash value corresponding to the current program.

[0061] Among them, hash calculation can be understood as the process of converting data (input) of any size into an output value (hash value or hash code) of a fixed size through a hash function, which is usually a short string or number. Common hash algorithms include MD5: Although it is fast, it is no longer recommended for security purposes due to potential collision problems. SHA-1: It is more secure than MD5, but it has also been found to have collision vulnerabilities and is now mostly used in non-security situations. SHA-256: It belongs to the SHA-2 series, provides higher security, and is widely used in encryption-related fields. SHA-3: The current new generation of hash algorithms has stronger security.

[0062] For example, the server 104 converts the path information into a format suitable for hash calculation, and performs hash calculation on the converted path information to obtain the current hash value corresponding to the current program. Regardless of the size of the input data, the length of the hash value is always fixed, which improves the efficiency of storage and comparison, and lays a data foundation for the subsequent comparison of the hash value stored in the program whitelist with the current hash value.

[0063] Step S203, when the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value, and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value, obtain the running count of the current program; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist.

[0064] Among them, the first level and the second level are two relative levels, the first level is adjacent to the second level, the first level is lower than the second level, and the first program whitelist corresponding to the first level contains the second program whitelist corresponding to the second level; the run count can be understood as the number of times the program is run, which is the historical number of runs plus 1.

[0065] Optionally, when the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value, that is, there is no program record of the current program in the second program whitelist, and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value, that is, the current program exists in the first program whitelist, the running count of the current program is obtained. The hash value corresponding to the program is used to determine whether there is a program record of the current program in the program whitelist, avoiding the risk of data leakage caused by directly using the program for comparison, because the hash value cannot be directly reverse-calculated to obtain the original input data, thereby improving the privacy and security of the data.

[0066] Step S204, when the running count reaches the counter threshold associated with the second level, add and store the current hash value in the second program whitelist; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0067] Among them, the counter threshold can be understood as the set boundary between the program whitelists of different levels. If this boundary is exceeded, the corresponding level will be entered. The larger the level, the more frequently the saved program records are used, so the corresponding associated counter threshold is larger.

[0068] For example, when the running count reaches the counter threshold associated with the second level, that is, the current program belongs to the second level corresponding to the number of high-frequency calls, the current hash value is added to the second program whitelist, that is, the program record of the current program is added to the second program whitelist. By setting a reasonable counter threshold associated with the level, the program whitelist at the corresponding level is automatically updated, which improves the rationality and speed of updating the program whitelist. In addition, it is convenient to start the query from the second program whitelist with a smaller number when querying next time, which speeds up the legal query speed of the program and ensures the timeliness of the system's response.

[0069] In the above program whitelist update method, when any current program is detected to be running, the path information of the current program is obtained, and a hash calculation is performed according to the path information to obtain the current hash value corresponding to the current program. When the hash value stored in the second program whitelist corresponding to the first level does not contain the current hash value, and the hash value stored in the first program whitelist corresponding to the first level contains the current hash value, the running count of the current program is obtained, wherein the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist contains the second program whitelist. When the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist, and the counter threshold associated with the second level is greater than the counter threshold associated with the first level. By establishing a hash value table common to multi-level program whitelists, inquiries can be quickly performed during query updates, and repeated programs correspond to the same hash value, saving the storage space of the system. In addition, by setting a reasonable counter threshold, the automatic update of program whitelists between different levels is realized, which greatly reduces the cost of manual operation, thereby improving the update efficiency of program whitelists.

[0070] In one embodiment, whether to execute the current program is determined based on the query result of the current hash value in the program whitelist.

[0071] Optionally, when performing the above-mentioned program whitelist update, a check is also performed at the same time to see whether the program is allowed to be executed. The server 104 determines whether to execute the current program based on the query result of the current hash value in the entire program whitelist stored in the data storage system. Rather than directly executing the current program, the legitimacy of the program is first verified to avoid the problem of system crashes that may be caused by executing illegal programs, thereby ensuring the legitimacy of the response.

[0072] In one embodiment, if Figure 3 As shown, through steps S301 to S303, the query result of the current hash value in the program whitelist is obtained:

[0073] Step S301 , using the current hash value, querying from the program whitelist corresponding to the highest level to the program whitelist corresponding to the next level in sequence.

[0074] For example, server 104 uses the current hash value to start searching from the program whitelist corresponding to the highest level. If no result is found, the program whitelist corresponding to the next level is searched in sequence. Searching from the programs recorded in the high-frequency program whitelist can effectively reduce the number of hash values ​​that need to be compared. Moreover, since the entire multi-level program whitelist framework uses the same hash value table, programs that do not meet the corresponding records at the upper level do not need to be repeatedly compared and verified at the next level, which further speeds up the query.

[0075] Step S302, when the hash value stored in the program whitelist corresponding to the currently queried level contains the current hash value, the currently queried level is determined as the first level, and the previous level of the currently queried level is determined as the second level, the query is ended and the corresponding first query result is generated.

[0076] Step S303, when all program whitelists are traversed and no hash value stored in any program whitelist contains the current hash value, the query is terminated and a corresponding second query result is generated.

[0077] Optionally, there are two ways for the server 104 to jump out of the multi-level program whitelist query. One is: when the hash value stored in the program whitelist corresponding to the currently queried level contains the current hash value, that is, when the program whitelist corresponding to the currently queried level has a program record of the current program, the currently queried level is determined as the first level, and the previous level of the currently queried level is determined as the second level, and the second program whitelist corresponding to the second level is updated according to the method of step S203 to step S204, and the query is terminated and the corresponding first query result is generated; the second is: after traversing all program whitelists, there is no hash value stored in any program whitelist containing the current hash value, that is, when there is no program record of the current program in the current multi-level program whitelist, it is explained that the current program is an illegal program, and the update process is not entered, and the query is terminated and the corresponding second query result is generated. Through the query of the multi-level program whitelist, the legitimacy of the current program can be judged more accurately. If the hash value of the program is not found in any whitelist, the system can promptly identify potential security risks and avoid the execution of illegal programs. In addition, a multi-level query mechanism is adopted, allowing the system to verify in multiple levels of whitelists, reducing the possibility of false alarms and improving the system's recognition accuracy of illegal programs, thereby enhancing the robustness and stability of the system.

[0078] In an exemplary embodiment, whether to execute the current program is determined based on the query result of the current hash value in the program whitelist, including: if the query result is the first query result, allowing the current program to be executed; if the query result is the second query result, refusing to execute the current program.

[0079] For example, if the query result is the first query result, that is, if there is a program record of the current program in the current multi-level program whitelist, it means that the current program to be executed is a legal program and the execution of the current program is allowed; if the query is the second query result, that is, the server 104 traverses the entire program whitelist and there is no current program record, it means that the current program to be executed is an illegal program and the execution of the current program is refused.

[0080] By determining whether to execute the current program based on the query results, the following technical effects are achieved:

[0081] 1. Ensure that the program to be executed is legitimate by verifying that the program's hash value matches the record in the whitelist. This process effectively reduces the risk of malware or unauthorized program execution.

[0082] 2. Ensure that only verified and trusted programs can be executed, protect the system from potential threats, and thus improve the overall security of the system.

[0083] 2. Allowing legal programs to execute and rejecting illegal programs helps maintain user trust and ensures that users can perform necessary operations smoothly without worrying about system security being affected.

[0084] In one embodiment, the method further comprises: if the running count does not reach the counter threshold associated with the second level, not updating the second program whitelist.

[0085] Optionally, when the running count does not reach the counter threshold associated with the second level, that is, the frequency of the current program being called does not reach the second program whitelist corresponding to the second level, there is no need to transfer the program record of the current program from the first program whitelist to the second program whitelist. By clearly setting the counter threshold, it is ensured that the program records of different whitelists are arranged in order according to the actual frequency of the program being used, maintaining a clear management logic and hierarchical relationship, and not transferring programs that do not meet the frequency standard from the first program whitelist to the second program whitelist, which can reduce the consumption of system resources.

[0086] In one of the embodiments, the path information includes path name information and file content information; performing a hash calculation based on the path information to obtain a current hash value corresponding to the current program includes: performing a hash calculation based on the path name information to obtain a path hash value, and performing a hash calculation based on the file content information to obtain a file hash value; using the path hash value and the file hash value to construct a current hash value corresponding to the current program.

[0087] The path name information may be understood as a character string used to locate a specific file or directory in a computer file system, and the file content information may be understood as the specific content information contained in a specific file.

[0088] For example, the server 104 performs a hash calculation based on the path name information to obtain the corresponding path hash value, and performs a hash calculation based on the file content information to obtain the corresponding file hash value. The path hash value and the file hash value can be connected by a simple string to obtain the current hash value corresponding to the current program, or the combined result can be subjected to another hash calculation to generate the current hash value corresponding to the current program. By combining the hash of the file path and the content, it is ensured that the hash value generated by each program is unique. This uniqueness is very important in scenarios such as file management and program verification, and can effectively avoid file conflicts and duplications.

[0089] In an exemplary embodiment, Figure 4 As shown, a schematic diagram of a multi-level program whitelist principle is provided, including a first-level whitelist, a second-level whitelist and a third-level whitelist (the first-level, second-level and third-level here are all specific embodiments, and it is not limited to only in this case that the program whitelist update method of the present application can be implemented), wherein:

[0090] (1) Full-whitelist:

[0091] This whitelist contains all legitimate programs that may run on the host. Through existing technologies such as intelligent learning or manual editing, a static and complete first-level program whitelist is created.

[0092] (2) Secondary whitelist (Short-whitelist, also known as short list):

[0093] The secondary whitelist is initialized to empty and is created through dynamic intelligent learning technology.

[0094] When a program is running, the host security software first searches the secondary whitelist. If the program is not found, it searches the primary whitelist. If found, the program record is moved from the primary whitelist to the secondary whitelist. This completes the dynamic creation of the secondary whitelist.

[0095] After the host has been running for a period of time, the second-level whitelist contains programs that users frequently run, but the overall number of whitelists is generally much smaller than the complete first-level whitelist, thereby improving the startup performance of daily running programs.

[0096] (3) Level 3 whitelist (HighFrequency-whitelist, high frequency whitelist, optional):

[0097] This level of whitelist is optional and mainly solves the application scenario where there are many programs running on the host and the startup performance of frequently running programs needs to be guaranteed. In this scenario, the number of secondary whitelists is still large, which may affect the startup performance of frequently running programs.

[0098] In the secondary whitelist, a running counter is established for each program record, and the host security software updates the counter in real time. When it is found that the running count of a program exceeds the set threshold, the program record is transferred from the secondary whitelist to the tertiary whitelist. This completes the dynamic creation of the tertiary whitelist.

[0099] The third-level whitelist includes programs that users run frequently. In applicable application scenarios, by controlling the threshold of the run count, the overall whitelist quantity is much smaller than the second-level whitelist, which ensures the startup performance of frequently run programs.

[0100] In addition, in the application scenario of the above three-level whitelist, such as Figure 5 As shown, a specific implementation method for updating a program whitelist is provided, including:

[0101] 1. Step 1 Whitelist initialization:

[0102] Through the existing intelligent learning technology, the creation of the first-level whitelist is completed; the second-level and third-level whitelists are initialized to be empty. In this solution, the program whitelist uses a hash table to store program records.

[0103] 2. Step 2 calculates the hash index (hash-id) of the running program:

[0104] When the program is running, the hash-id (i.e. the current hash value mentioned above) is calculated based on the program's path name. In this solution, the multi-level whitelist uses the same hash table size, so the hash-id calculation only needs to be done once, exchanging storage space for performance.

[0105] 3. Step 3: Find the program record in the third-level whitelist (optional):

[0106] Search for the program record by hash-id. End if found.

[0107] 4. Step 4: Find the program record in the secondary whitelist:

[0108] Search for the program record by hash-id. If found, jump to Step 7.

[0109] 5. Step 5: Find the program record in the first-level whitelist:

[0110] Search for the program record by hash-id. If not found, then end.

[0111] 6. Step 6 Update the secondary whitelist:

[0112] The program record is transferred from the first-level whitelist to the second-level whitelist, and the running counter of the program record is increased by 1.

[0113] 7. Step 7 Check the running counter recorded by the program:

[0114] If the running counter recorded by the program does not exceed the set threshold, it ends.

[0115] 8. Step 8 Update the third-level whitelist:

[0116] Transfer program records from the secondary whitelist to the tertiary whitelist.

[0117] Compared with the prior art, this application has the following advantages:

[0118] 1. Multi-level whitelists use hash tables of the same size, so that the same hash index can be used to find program records, which can speed up the search speed of the corresponding program in the program whitelist, thereby improving the update speed of the program whitelist.

[0119] 2. The program record update of the program whitelist between multiple levels is realized through appropriate counter thresholds, which reduces the errors that may be caused by manual operations and thus speeds up the update reliability of the program whitelist.

[0120] 3. Use dynamic intelligent technology to dynamically create a secondary program whitelist, which ensures the adaptability and reliability of the secondary program whitelist, and also greatly reduces the manpower cost of building the secondary program whitelist.

[0121] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0122] Based on the same inventive concept, the embodiment of the present application also provides a program whitelist updating device for implementing the program whitelist updating method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more program whitelist updating device embodiments provided below can refer to the limitations of the program whitelist updating method above, and will not be repeated here.

[0123] In an exemplary embodiment, Figure 6 As shown, a program whitelist updating device is provided, comprising: a path information acquisition module 601, a hash calculation module 602, a run count acquisition module 603 and an update module 603, wherein:

[0124] The path information acquisition module 601 is used to acquire the path information of the current program when it is detected that any current program is running;

[0125] A hash calculation module 602 is used to perform hash calculation according to the path information to obtain a current hash value corresponding to the current program;

[0126] A run count acquisition module 603 is used to acquire the run count of the current program when the hash value stored in the second program whitelist corresponding to the second level does not include the current hash value and the hash value stored in the first program whitelist corresponding to the first level includes the current hash value; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist;

[0127] The updating module 604 is used to add and store the current hash value in the second program whitelist when the running count reaches the counter threshold associated with the second level; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

[0128] In one embodiment, the program whitelist updating device further includes a query module, which is used to determine whether to execute the current program according to a query result of querying the program whitelist based on the current hash value.

[0129] In one embodiment, the query module further includes a loop query submodule, a first query result generation submodule and a second query result generation submodule, wherein:

[0130] The loop query submodule is used to use the current hash value to query the program whitelist corresponding to the highest level to the program whitelist corresponding to the next level in sequence.

[0131] The first query result generating submodule is used to determine the currently queried level as the first level and the previous level of the currently queried level as the second level when the hash value stored in the program whitelist corresponding to the currently queried level contains the current hash value, end the query and generate the corresponding first query result.

[0132] The second query result generating submodule is used to terminate the query and generate the corresponding second query result when all program whitelists are traversed and no hash value stored in any program whitelist contains the current hash value.

[0133] In an exemplary embodiment, the query module is further configured to allow execution of the current program if the query result is a first query result, and to refuse execution of the current program if the query result is a second query result.

[0134] In one embodiment, the program whitelist updating device further comprises a non-updating module, configured to not update the second program whitelist if the running count does not reach the counter threshold associated with the second level.

[0135] In one embodiment, the path information includes path name information and file content information. The hash calculation module 602 is also used to perform hash calculation based on the path name information to obtain a path hash value, and to perform hash calculation based on the file content information to obtain a file hash value; and to construct a current hash value corresponding to the current program using the path hash value and the file hash value.

[0136] Each module in the above-mentioned program whitelist updating device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0137] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store path information, current hash value, first program whitelist, second program whitelist, running count and counter threshold data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a program whitelist update method is implemented.

[0138] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0139] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the program whitelist updating method in the above embodiment when executing the computer program.

[0140] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the program whitelist updating method in the above embodiment is implemented.

[0141] In one embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the program whitelist updating method in the above embodiment is implemented.

[0142] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0143] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0144] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0145] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A program whitelist updating method, characterized in that: The method comprises: When any current program is detected to be running, path information of the current program is obtained; Perform hash calculation according to the path information to obtain a current hash value corresponding to the current program; In a case where a hash value stored in a second program whitelist corresponding to the second level does not include the current hash value, and a hash value stored in a first program whitelist corresponding to the first level includes the current hash value, obtaining a running count of the current program; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist; When the running count reaches the counter threshold associated with the second level, the current hash value is added and stored in the second program whitelist; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

2. The method according to claim 1, characterized in that The method further comprises: According to the query result of querying the current hash value in the program whitelist, it is determined whether to execute the current program.

3. The method according to claim 2, characterized in that Obtain the query result of the current hash value in the program whitelist by following the steps below: Using the current hash value, query the program whitelist corresponding to the highest level in turn to the program whitelist corresponding to the next level; In the case where the hash value stored in the program whitelist corresponding to the currently queried level includes the current hash value, the currently queried level is determined as the first level, and the previous level of the currently queried level is determined as the second level, the query is terminated and the corresponding first query result is generated; After all the program whitelists are traversed and no hash value stored in the program whitelist contains the current hash value, the query is terminated and a corresponding second query result is generated.

4. The method according to claim 3, characterized in that The step of determining whether to execute the current program based on a query result of the current hash value in a program whitelist comprises: If the query result is the first query result, allowing the current program to be executed; If the query result is the second query result, the current program is refused to be executed.

5. The method according to claim 1, characterized in that The method further comprises: In case the running count does not reach the counter threshold associated with the second level, the second program whitelist is not updated.

6. The method according to claim 1, characterized in that The path information includes path name information and file content information; The performing hash calculation according to the path information to obtain a current hash value corresponding to the current program includes: Performing a hash calculation based on the path name information to obtain a path hash value, and performing a hash calculation based on the file content information to obtain a file hash value; The path hash value and the file hash value are used to construct a current hash value corresponding to the current program.

7. A program whitelist updating device, characterized in that: The device comprises: A path information acquisition module, used to acquire the path information of any current program when detecting that any current program is running; A hash calculation module, used to perform hash calculation according to the path information to obtain a current hash value corresponding to the current program; A run count acquisition module, configured to acquire the run count of the current program when a hash value stored in a second program whitelist corresponding to the second level does not include the current hash value and a hash value stored in a first program whitelist corresponding to the first level includes the current hash value; the first level and the second level are two adjacent levels, the first level is lower than the second level, and the first program whitelist includes the second program whitelist; An updating module is used to add and store the current hash value in the second program whitelist when the running count reaches the counter threshold associated with the second level; the counter threshold associated with the second level is greater than the counter threshold associated with the first level.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images