Process processing method and device, equipment, storage medium and program product

Abstract

The invention provides a process processing method, device and equipment, a storage medium and a program product, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and auxiliary driving. The method comprises the following steps: performing abnormal process detection on a plurality of running processes to obtain a detection result; when the detection result represents that an abnormal process in an abnormal state exists in the multiple processes, adding an abnormal identifier to the abnormal process and an associated process associated with the abnormal process; based on the exception identifier, determining a target process from the plurality of processes, the target process and a parent process of the target process both having the exception identifier; performing function limitation processing on the target process to block a security attack behavior aiming at the target process through the function limitation processing; according to the method and the device, the detection effect of the process subjected to the security attack and the blocking effect of the security attack behavior can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a process processing method, device, equipment, storage medium and program product. Background Art

[0002] With the development of computer and network technology, computer and network security have received more and more attention. In the related technology, for a running process, every time an abnormal process under security attack is detected, the abnormal process is directly forced to terminate to block the security attack. However, when the abnormal process is parasitic on the main process (also called the business process), if the abnormal process is directly forced to terminate, the main process may also be terminated, making the main process unable to run; and for segmented attack behaviors, it is easy to miss a certain segment of the attack behavior, resulting in a poor blocking effect of security attack behaviors. Summary of the invention

[0003] The embodiments of the present application provide a process processing method, device, electronic device, computer-readable storage medium and computer program product, which can improve the detection effect of processes subject to security attacks and the blocking effect of security attack behaviors.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present application provides a process processing method, including:

[0006] Perform abnormal process detection on multiple running processes and obtain detection results;

[0007] When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, adding an abnormal identifier to the abnormal process and an associated process associated with the abnormal process;

[0008] The abnormal state indicates that the process in the abnormal state is under security attack, and the abnormal flag indicates that the process with the abnormal flag is in the abnormal state;

[0009] Based on the exception identifier, determining a target process from the multiple processes, wherein both the target process and a parent process of the target process have the exception identifier;

[0010] Function restriction processing is performed on the target process to block security attack behaviors against the target process through the function restriction processing.

[0011] The present application also provides a process processing device, including:

[0012] A detection module is used to detect abnormal processes in multiple running processes and obtain detection results;

[0013] an identification adding module, configured to add an abnormal identification to the abnormal process and the associated processes associated with the abnormal process when the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes;

[0014] The abnormal state indicates that the process in the abnormal state is under security attack, and the abnormal flag indicates that the process with the abnormal flag is in the abnormal state;

[0015] A determination module, configured to determine a target process from the multiple processes based on the abnormality identifier, wherein both the target process and a parent process of the target process have the abnormality identifier;

[0016] The function restriction module is used to perform function restriction processing on the target process so as to block security attack behaviors against the target process through the function restriction processing.

[0017] The present application also provides an electronic device, including:

[0018] A memory for storing computer executable instructions;

[0019] The processor is used to implement the process processing method provided in the embodiment of the present application when executing the computer executable instructions stored in the memory.

[0020] An embodiment of the present application also provides a computer-readable storage medium storing computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the process processing method provided by the embodiment of the present application is implemented.

[0021] An embodiment of the present application also provides a computer program product, including computer executable instructions or a computer program, which, when executed by a processor, implements the process processing method provided in the embodiment of the present application.

[0022] The embodiments of the present application have the following beneficial effects:

[0023] By applying the above-mentioned embodiments of the present application, abnormal process detection is performed on multiple running processes. When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, an abnormal identifier is added to the abnormal process and the associated processes associated with the abnormal process; based on the abnormal identifier, a target process is determined from multiple processes so that the target process and the parent process of the target process both have an abnormal identifier, thereby performing functional restriction processing on the target process to block security attacks against the target process through functional restriction processing.

[0024] Here, a process with an abnormal flag is in an abnormal state, and a process in an abnormal state is under security attack. In this way, 1) when an abnormal process is detected, an abnormal flag is added to the abnormal process and the associated processes associated with the abnormal process, which not only reduces the missed detection of processes under security attack, but also improves the detection efficiency of processes under security attack; 2) Because the target process and the parent process of the target process must both have an abnormal flag, the function of the target process is restricted. Even when the abnormal process parasitizes the main process so that the main process has an abnormal flag, the main process is not terminated. Therefore, for the case where the abnormal process parasitizes the main process, the impact of security attack behavior blocking on the main process can be reduced. In summary, through the present application, the detection effect of the process under security attack and the blocking effect of security attack behavior can be improved while reducing the impact of security attack behavior blocking on the main process. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of the architecture of the process processing system provided in an embodiment of the present application;

[0026] Figure 2 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0027] Figure 3 It is a flowchart of a process processing method provided in an embodiment of the present application;

[0028] Figure 4 It is a flowchart of a process processing method provided in an embodiment of the present application;

[0029] Figure 5 It is a flowchart of a process processing method provided in an embodiment of the present application;

[0030] Figure 6 is a display schematic diagram of a target process tree provided in an embodiment of the present application;

[0031] Figure 7 It is a flowchart of a process processing method provided in an embodiment of the present application;

[0032] Figure 8 It is a flowchart of a process processing method provided in an embodiment of the present application;

[0033] Fig. 9 It is a flowchart of the process processing method provided in the embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0035] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0036] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0037] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meanings as those commonly understood by those skilled in the art. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0038] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0039] 1) Client: An application running in the terminal that provides various services, such as a client that supports abnormal process detection and attack behavior blocking.

[0040] 2) In response to: used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed may be in real time or have a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations executed are executed.

[0041] 3) Endpoint Detection and Response (EDR), which has the security capability to respond to threats by collecting, recording and storing the behavior and status data of each endpoint in the digital environment, and performing correlation analysis on the data.

[0042] 4) Attack behavior blocking unit. When an attack behavior is discovered by EDR, EDR needs to inform the attack behavior blocking unit, which will promptly block the spread of the attack behavior.

[0043] 5) Brother processes: Processes with the same parent process are called brother processes.

[0044] 6) Parent process and child process. When process A creates process B, then process A is the parent process and process B is the child process of the parent process (i.e. process A).

[0045] 7) System call: a set of subroutines set in the Linux kernel to implement system functions. Each system call has a corresponding system call number as a unique identifier.

[0046] 8) System call table is a table consisting of function pointers to kernel functions that implement various system calls. The table can be indexed based on the system call number to locate the function address and complete the system call. The Linux driver can hook the system call function by modifying the function address of the system call table, thereby filtering and real-time detection of the corresponding system calls.

[0047] 9) Hook: After hooking a specific system event, once the hooked event occurs, the program that hooks the event will receive a notification from the system, and the program can respond to the event immediately. Hook is actually a program segment that processes messages, and it is hooked into the system through system calls. Whenever a specific message is sent, before it reaches the destination window, the hook program will capture the message first, that is, the hook function gets control first.

[0048] 10) A process is a program with certain independent functions that runs on a certain data set. It is the basic unit for resource allocation in the system and the basic unit for dynamic execution of the operating system. In the early computer structure designed for processes, the process is the basic execution entity of the program; in the contemporary computer structure designed for threads, the process is the container of threads.

[0049] 11) The process descriptor structure (task_struct) is a data structure used to represent a process. It stores various attributes and information of the process, such as the process identification (Identity Document, ID), process status, process flags, process address space, thread group, priority, etc.

[0050] Based on the above description of the nouns and terms involved in the embodiments of the present application, the embodiments of the present application are described in detail below. The embodiments of the present application provide a process processing method, device, electronic device, computer-readable storage medium and computer program product, which can improve the detection effect of the process under security attack and the blocking effect of security attack behavior while reducing the impact of security attack behavior blocking on the main process.

[0051] It should be noted that the collection and processing of relevant data in this application should be strictly in accordance with the requirements of relevant laws and regulations when applied in examples, and the informed consent or separate consent of the personal information subject should be obtained, and subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the personal information subject.

[0052] The following describes the process processing system provided by the embodiment of the present application. Figure 1 , Figure 1 1 is a schematic diagram of the architecture of the process processing system provided in the embodiment of the present application. To support an exemplary application, the process processing system 100 includes: a server 200, a network 300, and a terminal 400. The terminal 400 is connected to the server 200 via the network 300, and the network 300 can be a wide area network or a local area network, or a combination of the two, using a wireless or wired link to achieve data transmission.

[0053] Here, the terminal 400 responds to an abnormal process detection instruction for multiple processes running on the server (which can be manually triggered or automatically triggered when the current time reaches a preset time point), and sends an abnormal process detection request for multiple processes running on the server to the server; the server 200 receives the abnormal process detection request for multiple processes running on the server; in response to the abnormal process detection request, abnormal process detection is performed on the multiple running processes to obtain a detection result; when the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, an abnormal identifier is added to the abnormal process and the associated process associated with the abnormal process; wherein the abnormal state indicates that the process in the abnormal state is subject to a security attack, and the abnormal identifier indicates that the process with the abnormal identifier is in an abnormal state; based on the abnormal identifier, a target process is determined from the multiple processes, so that the determined target process and the parent process of the target process both have an abnormal identifier; a function restriction process is performed on the target process to block security attacks on the target process through the function restriction process; a notification message of the end of process processing is returned to the terminal; the terminal 400 receives and displays the notification message of the end of process processing.

[0054] In some embodiments, the process processing method provided in the embodiments of the present application is implemented by an electronic device, for example, it can be implemented by a terminal alone, it can also be implemented by a server alone, or it can be implemented by a terminal and a server in collaboration. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, audio and video, instant messaging, games, etc.

[0055] In some embodiments, the electronic device for implementing the process processing method provided in the embodiments of the present application may be various types of terminals or servers. Among them, the server (such as server 200) may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. The terminal (such as terminal 400) may be a laptop, a tablet computer, a desktop computer, a smart phone, an intelligent voice interaction device (such as a smart speaker), a smart home appliance (such as a smart TV), a smart watch, a vehicle-mounted terminal, a wearable device, a virtual reality (VR) device, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, and the embodiments of the present application do not limit this.

[0056] In some embodiments, the process processing method provided in the embodiment of the present application can be implemented with the aid of cloud technology (Cloud Technology). Cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or a local area network to realize the calculation, storage, processing, and sharing of data. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, and application technology based on the cloud computing business model application, which can form a resource pool, which is used on demand and is flexible and convenient. Cloud computing technology will become an important support. The background services of the technical network system require a large amount of computing resources and storage resources. As an example, a server (such as server 200) can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

[0057] In some embodiments, the terminal or server can implement the process processing method provided by the embodiment of the present application by running various computer executable instructions or computer programs. For example, computer executable instructions can be commands, machine instructions or software instructions at the microprogram level. The computer program can be a native program or software module in the operating system; it can be a local (Native) application (Application, APP), that is, a program that needs to be installed in the operating system to run, such as a client that supports abnormal process detection and attack behavior blocking; it can also be a small program that can be embedded in any APP, that is, a program that can be run only by downloading it to a browser environment. In short, the above-mentioned computer executable instructions can be instructions in any form, and the above-mentioned computer program can be an application, module or plug-in in any form.

[0058] The following describes an electronic device for implementing a process processing method provided by an embodiment of the present application. Figure 2 , Figure 2 Schematic diagram of the structure of the electronic device provided in the embodiment of the present application. The electronic device 500 provided in the embodiment of the present application can be a terminal or a server. Figure 2 As shown, the electronic device 500 includes: at least one processor 510, a memory 550, at least one network interface 520 and a user interface 530. The various components in the electronic device 500 are coupled together through a bus system 540. It can be understood that the bus system 540 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 540 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 540 is not used in the following examples. Figure 2 Various buses are labeled as bus system 540 .

[0059] The processor 510 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0060] The user interface 530 includes one or more output devices 531 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 530 also includes one or more input devices 532, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0061] The memory 550 may be removable, non-removable, or a combination thereof. The memory 550 may include one or more storage devices physically located away from the processor 510. The memory 550 includes a volatile memory or a non-volatile memory, and may also include both a volatile memory and a non-volatile memory. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 550 described in the embodiments of the present application is intended to include any suitable type of memory.

[0062] In some embodiments, the memory 550 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0063] Operating system 551, including system programs for processing various basic system services and performing hardware-related tasks, such as framework layer, core library layer, driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0064] A network communication module 552, used to reach other electronic devices via one or more (wired or wireless) network interfaces 520, exemplary network interfaces 520 include: Bluetooth, Wireless Compatibility Certification (WiFi), and Universal Serial Bus (USB), etc.;

[0065] a presentation module 553 for enabling presentation of information via one or more output devices 531 (e.g., display screen, speaker, etc.) associated with the user interface 530 (e.g., a user interface for operating peripherals and displaying content and information);

[0066] The input processing module 554 is used to detect one or more user inputs or interactions from one of the one or more input devices 532 and translate the detected inputs or interactions.

[0067] In some embodiments, the process processing device provided in the embodiments of the present application can be implemented in software. Figure 2 A process processing device 555 stored in the memory 550 is shown, which can be software in the form of programs and plug-ins, including the following software modules: a detection module 5551, an identification adding module 5552, a determination module 5553 and a function restriction module 5554. These modules are logical, and therefore can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be explained below.

[0068] The following describes the process processing method provided by the embodiment of the present application. As mentioned above, the process processing method provided by the embodiment of the present application can be implemented by various electronic devices, such as by a server or a terminal alone, or by a server and a terminal in collaboration. Therefore, the execution subject of each step will not be repeatedly described below. Figure 3 , Figure 3 : is a flowchart of a process processing method provided in an embodiment of the present application. The process processing method provided in an embodiment of the present application includes:

[0069] Step 101: Perform abnormal process detection on multiple running processes to obtain detection results.

[0070] In step 101, the electronic device runs multiple processes, and performs abnormal process detection on the multiple running processes to obtain a detection result, which indicates whether there is an abnormal process in an abnormal state among the multiple processes. It should be noted that when a process is in an abnormal state, it indicates that the process is subject to a security attack, such as the use of an unprotected network, illegal network software attacks, network virus attacks, system vulnerability attacks, and other network attack behaviors. In practical applications, the electronic device can be provided with a client that supports abnormal process detection and attack behavior blocking, and abnormal process detection is performed by running the client. For example, the client may include an abnormal detection and response unit and an attack behavior blocking unit, so that the electronic device can call the abnormal detection and response unit when running the client, perform abnormal process detection on the multiple running processes, and obtain a detection result.

[0071] In some embodiments, see Figure 4 , Figure 4 Shows Figure 3 Step 101 in the above method can be implemented by executing the following steps for each of the multiple running processes: Step 1011, obtaining process behavior data and process status data of the process; Step 1012, analyzing the process behavior data and process status data to obtain an analysis result; Step 1013, when the analysis result indicates that there is a security attack behavior against the process, determining that a detection result indicating that the process is in an abnormal state is obtained; Step 1014, when the analysis result indicates that there is no security attack behavior against the process, determining that a detection result indicating that the process is not in an abnormal state is obtained.

[0072] In step 1011, the process behavior data and process status data of the process may be obtained. The process behavior data records the process behavior of the process, such as account creation, network access, data transmission, file operation and other process behaviors, as well as the target file, action result, network data and the like associated with the process behavior; the process status data records the process status of the process, such as services, ports, threads, vulnerabilities and the like.

[0073] In step 1012, the acquired process behavior data and process status data may be analyzed to obtain an analysis result, which indicates whether there is a security attack behavior against the process. For example, the security attack behavior may include information collection, lateral movement attack, permission modification and maintenance, etc. In practical applications, the analysis process may be implemented using technologies such as big data security analysis, machine learning, sandbox analysis, behavior analysis, and machine learning. For example, taking machine learning technology as an example, in some embodiments, Figure 4 Step 1012 shown can be implemented through the following steps: calling a machine learning model to predict security attack behavior on process behavior data and process status data, and obtaining a prediction result, which indicates whether there is a security attack behavior against the process; and using the prediction result as an analysis result.

[0074] It should be noted that the machine learning model can be obtained by pre-training. For example, an initial machine learning model can be predicted and constructed, and the initial machine learning model has initial model parameters. The initial machine learning model can be constructed by networks such as convolutional neural networks, deep neural networks, and recurrent neural networks. When training the initial machine learning model, training samples (including process behavior data samples and process status data samples of process samples) can be obtained, and the training samples are annotated with corresponding sample labels, and the sample labels are used to indicate whether there is a security attack behavior against the process sample. Through the training samples and the corresponding sample labels, the initial machine learning model can be iteratively trained to update the model parameters of the initial machine learning model, thereby obtaining a trained machine learning model. Based on this, the trained machine learning model can be called to predict the security attack behavior of the process behavior data and process status data of the process, and obtain a prediction result indicating whether there is a security attack behavior against the process. Therefore, the prediction result is the analysis result obtained by analyzing the process behavior data and process status data.

[0075] In step 1012, data features of the process behavior data and the process status data may also be extracted and used as process running features of the corresponding process. The process running features are then matched with abnormal process running features of abnormal processes that have security attack behaviors. If the match is successful, an analysis result indicating the presence of security attack behaviors against the process is obtained. If the match fails, an analysis result indicating the absence of security attack behaviors against the process is obtained.

[0076] In step 10123, when the analysis result indicates that there is a security attack against the process, it is determined that a detection result indicating that the process is in an abnormal state is obtained. In step 1014, when the analysis result indicates that there is no security attack against the process, it is determined that a detection result indicating that the process is not in an abnormal state is obtained.

[0077] Step 102: When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, an abnormal identifier is added to the abnormal process and the associated processes associated with the abnormal process.

[0078] The abnormal state indicates that the process in the abnormal state is under security attack, and the abnormal flag indicates that the process with the abnormal flag is in the abnormal state.

[0079] In step 102, when the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, an abnormal identification is added to the abnormal process and the associated process associated with the abnormal process. In practical applications, the electronic device can be provided with a client that supports abnormal process detection and attack behavior blocking, so that when the client is running, the attack behavior blocking unit can be called to add an abnormal identification to the abnormal process and the associated process associated with the abnormal process.

[0080] It should be noted that when a process is in an abnormal state, it indicates that the process is under security attack; when a process has an abnormal flag, it indicates that the process is also in an abnormal state. The associated processes associated with the abnormal process may include at least one of the following: the parent process of the abnormal process, the brother process of the abnormal process, and the child process of the abnormal process. In this way, when an abnormal process is detected, an abnormal flag is added to the abnormal process and the associated processes associated with the abnormal process, which not only reduces the missed detection of processes under security attack, but also improves the detection efficiency of processes under security attack.

[0081] In some embodiments, Figure 3 The illustrated step 102 can be implemented through the following steps: when the detection result indicates that there is an abnormal process in an abnormal state among multiple processes, determine a first process and a second process associated with the abnormal process from the multiple processes; wherein the first process is the parent process of the abnormal process among the multiple processes, and the second process is the process among the multiple processes that has the same parent process as the abnormal process; the first process and the second process are used as associated processes, and an abnormal identifier is added to the abnormal process and the associated process of the abnormal process.

[0082] Here, the second process is the sibling process of the abnormal process. In this way, for the segmented attack behavior "segmented attack on multiple sub-processes of a process, so that each sub-process has an independent attack task", when a sub-process is detected as an abnormal process, the sub-process, the sub-process's sibling processes and the parent process can be marked as abnormal processes at the same time, and subsequent attacks on the sub-process and the sub-process's sibling processes can be uniformly blocked in the function restriction stage, thereby effectively blocking the segmented attack behavior.

[0083] In some embodiments, see Figure 5 , Figure 5 It is shown that the first process and the second process associated with the abnormal process can be determined from multiple processes through the following steps 201-203: Step 201, obtain a target process tree constructed based on the generation relationship between multiple processes, the target process tree includes process nodes indicating each process, and there is a generation relationship between the processes indicated by two process nodes on the same edge in the target process tree; Step 202, from the target process tree, determine the second process node that shares an edge with the first process node indicating the abnormal process and generates the first process node, and use the process indicated by the second process node as the first process; Step 203, from the target process tree, determine at least one third process node that shares an edge with the second process node and is generated by the second process node, and use the process indicated by the at least one third process node as the second process, and the at least one third process node does not include the first process node.

[0084] In step 201, a target process tree is first constructed based on the generation relationship between multiple processes. Specifically, each process is indicated by a process node, and the process nodes of two processes with a generation relationship share the same edge. For example, see Figure 6 , Figure 6 The second layer of the target process tree shown includes process node 0, the second layer of the target process tree includes process node 1 and process node 2, and the third layer of the target process tree includes process nodes 3-process node 5. Process nodes 3-process node 5 have common edges with process node 2 respectively. Therefore, there is a generation relationship between process node 2 and process nodes 3-process node 5.

[0085] In step 202, a second process node that shares an edge with a first process node indicating an abnormal process and generates the first process node (i.e., the process indicated by the first process node is generated or created by the process indicated by the second process node) is determined from the target process tree. The process indicated by the second process node is the parent process of the abnormal process (i.e., the first process). Figure 6 As shown, when the abnormal process is the process indicated by process node 3, since process node 3 and process node 2 share an edge and process node 2 generates process node 3, the first process is the process indicated by process node 2.

[0086] In step 203, at least one third process node that shares an edge with the second process node and is generated by the second process node is determined from the target process tree (i.e., the process indicated by the second process node generates or creates the process indicated by the third process node). The process indicated by the third process node is the sibling process of the abnormal process (i.e., the second process). Figure 6As shown, when the abnormal process is the process indicated by process node 3, since process node 4-5 and process node 2 share an edge and process node 2 generates process node 4-5, the second process is the process indicated by process node 4-5. In this way, by constructing a target process tree and querying associated processes based on the target process tree, the query speed of the associated processes can be improved, thereby improving the marking speed of the abnormal identification.

[0087] In some embodiments, an abnormal identifier can be added to an abnormal process and an associated process associated with the abnormal process through the following steps: the abnormal process and the associated process associated with the abnormal process are taken as processes to be marked, and for each process to be marked, the following processing is performed respectively: a target process structure of the process to be marked is determined, and the target process structure is used to store process information of the process to be marked; a target field is defined in the target process structure, wherein when the process to be marked creates a new process, the target field can be inherited by the new process; and an abnormal identifier is added to the target field.

[0088] Here, the abnormal process and the associated processes associated with the abnormal process can all be recorded as processes to be marked, so that an abnormal identification is added to each process to be marked. Specifically, for each process to be marked, the following processing is performed respectively: first, the target process structure of the process to be marked is determined, and the process information of the process to be marked (such as process identification, process status, etc.) is stored in the target process structure; then the target field is defined in the target process structure, so that the abnormal identification is added to the target field. Since the target field can be inherited by the newly created process, the propagation of the abnormal identification can be realized, and the new processes subsequently created by the process to be marked can all be marked as abnormal processes, thereby realizing the persistent blocking of security attack behaviors. As an example, the target process structure can be a process descriptor structure, that is, the task_struct structure of the process to be marked in the operating system kernel; when the target field is defined in the process descriptor structure, the tsk->atomic_flags field can be defined in the task_struct structure, so that an exception flag is added to the target field, that is, a target value is assigned to tsk->atomic_flags, and the target value is used as an exception flag, for example, the target value can be 1.

[0089] Step 103: Based on the exception identifier, determine the target process from multiple processes.

[0090] Among them, the target process and the parent process of the target process both have abnormal identification.

[0091] In step 103, the target process can be determined from multiple processes based on the abnormal identification, so that the determined target process and the parent process of the target process both have abnormal identification. In this way, since the target process and the parent process of the target process both need to have abnormal identification, the function of the target process is restricted. Even if the abnormal process parasitizes the main process so that the main process has an abnormal identification, the function of the main process is not restricted. Therefore, in the case where the abnormal process parasitizes the main process, the impact of security attack behavior blocking on the main process can be reduced.

[0092] Step 104: Perform function restriction processing on the target process to block security attack behaviors against the target process through function restriction processing.

[0093] In actual applications, the electronic device may be provided with a client that supports abnormal process detection and attack behavior blocking, so that the electronic device may call the attack behavior blocking unit of the client to execute steps 103 and 104 when running the client.

[0094] In step 104, the target process may be subjected to the following functional restriction processing: the process creation function of the target process is subjected to functional restriction processing, and the file read and write function of the target process is subjected to functional restriction processing. In this way, the process creation function and the file read and write function are subjected to functional restriction, so that the process creation function and the file read and write function of the target process are both unusable, thereby blocking the security attack behavior against the target process.

[0095] In some embodiments, the process creation function of the target process can be restricted by the following steps: a first hook service is mounted for the process creation function, and through the first hook service, whether the target process executes a first call behavior for the process creation function; when it is detected that the target process executes the first call behavior, the execution of the first call behavior of the target process is restricted. Correspondingly, the file read and write function of the target process can also be restricted by the following steps: a second hook service is mounted for the file read and write function, and through the second hook service, whether the target process executes a second call behavior for the file read and write function; when it is detected that the target process executes the second call behavior, the execution of the second call behavior of the target process is restricted.

[0096] Here, when the function restriction processing of the process creation function is performed on the target process, the first hook service Hook can be mounted for the process creation function. For example, in the system call table, the call to the process creation function (i.e., the process creation system call) can be replaced with a call to the handler defined by the first hook service Hook. Therefore, through the first hook service Hook, it is possible to detect in real time whether the target process executes the first call behavior for the process creation function. When it is detected that the target process executes the first call behavior, the handler defined by the first hook service Hook can be called, that is, the execution of the first call behavior of the target process is restricted. In this way, the function restriction of the process creation function for the target process is realized.

[0097] Correspondingly, when the target process is subjected to functional restriction processing for the file read and write function, a second hook service Hook can be mounted for the file read and write function. For example, in the system call table, the call to the file read and write function (i.e., the file read and write system call) can be replaced with a call to the handler defined by the second hook service Hook. Thus, through the second hook service Hook, it is possible to detect in real time whether the target process executes the second call behavior for the file read and write function. When it is detected that the target process executes the second call behavior, the handler defined by the second hook service Hook can be called, that is, the execution of the second call behavior of the target process is restricted. In this way, functional restriction on the file read and write function of the target process is achieved.

[0098] In some embodiments, after the target process is functionally restricted, the following processing may also be performed: when a first target process that is mistakenly judged to be in an abnormal state is detected in the target process, the associated target process associated with the first target process is determined; the abnormal identification of the first target process and the associated target process is cleared, and the functional restriction processing for the first target process and the associated target process is canceled.

[0099] Here, for the first target process that is misjudged as being in an abnormal state, the function restriction processing for the first target process and the associated target process associated with the first target process can also be canceled. It should be noted that the associated target process associated with the first target process can be: the ancestor process of the first target process and the descendant process of the first target process. When the abnormal identification of the first target process and the associated target process is cleared, the first target process and the associated target process with the abnormal identification can be recorded as the marked process to be cleared, so that for each marked process to be cleared, the following processing is performed: first determine the target process structure of the marked process to be cleared (for example, the process descriptor structure, that is, the task_struct structure of the marked process to be cleared in the operating system kernel); then locate the target field for placing the abnormal identification in the target process structure (for example, the tsk->atomic_flags field defined when the abnormal identification was placed before); finally, the target field can be deleted, or the abnormal identification of the target field can be replaced with a normal identification, for example, when the abnormal identification is 1, the abnormal identification "1" can be replaced with the normal identification "0". In this way, when a false alarm of an abnormal process occurs, since the blocking method is functional restriction rather than terminating the process, the attack behavior blocking can be reversible, that is, the attack behavior blocking for the false alarm process is released, which can better deal with the occurrence of abnormal false alarms.

[0100] In some embodiments, after the target process is functionally restricted, the following processing may also be performed: detecting whether the security attack on the target process has ended; when it is detected that the security attack on the target process has ended, determining the associated target process associated with the target process; clearing the exception identifiers of the target process and the associated target process, and canceling the functional restriction processing on the target process and the associated target process.

[0101] Here, it is possible to detect in real time or periodically whether the security attack behavior against the target process has ended. When it is detected that the security attack behavior against the target process has ended, the associated target process associated with the target process is determined, thereby canceling the function restriction processing for the target process and the associated target process associated with the target process. It should be noted that the associated target process associated with the target process can be: the ancestor process of the target process and the descendant process of the target process. When the abnormal identification of the target process and the associated target process is cleared, the target process and the associated target process with the abnormal identification can be recorded as the marked process to be cleared, so that for each marked process to be cleared, the following processing is performed: first determine the target process structure of the marked process to be cleared (for example, the process descriptor structure, that is, the task_struct structure of the marked process to be cleared in the operating system kernel); then locate the target field for placing the abnormal identification in the target process structure (for example, the tsk->atomic_flags field defined when the abnormal identification was placed before); finally, the target field can be deleted, or the abnormal identification of the target field can be replaced with a normal identification, for example, when the abnormal identification is 1, the abnormal identification "1" can be replaced with the normal identification "0".

[0102] In some embodiments, after the function restriction processing is performed on the target process, the following processing may be performed: identifying the attack access traffic of the security attack behavior against the target process, and determining the traffic source address of the attack access traffic; determining the new access traffic from the traffic source address as the new attack access traffic, and shielding the new attack access traffic. Based on this, after the shielding processing is performed on the new attack access traffic, the following processing may be performed: determining the associated target process associated with the target process; clearing the abnormal identification of the target process and the associated target process, and canceling the function restriction processing for the target process and the associated target process.

[0103] Here, the attack access traffic of the security attack behavior against the target process can be identified. For example, a pre-trained traffic identification model can be called to identify the access traffic process against the target process to obtain an identification result, and the identification result indicates whether the access traffic is an attack access traffic. In practical applications, the traffic identification model can be obtained by pre-training. For example, an initial traffic identification model can be predicted and constructed, and the initial traffic identification model has initial model parameters. The initial traffic identification model can be constructed by networks such as convolutional neural networks, deep neural networks, and recurrent neural networks. When training the initial traffic identification model, a training sample (including an access traffic sample of a process sample) can be obtained, and the training sample is annotated with a corresponding sample label, and the sample label is used to indicate whether the access traffic sample is an attack access traffic. Through the training samples and the corresponding sample labels, the initial traffic identification model can be iteratively trained to update the model parameters of the initial traffic identification model, thereby obtaining a trained traffic identification model. After identifying the attack access traffic of the security attack behavior against the target process, the traffic source address of the attack access traffic is determined, and the traffic source address can be an Internet Protocol Address (IP).

[0104] Continuing, after the flow source address of the attack access flow is determined, the new access flow from the flow source address is determined as the new attack access flow, so that the new attack access flow is shielded. Based on this, after the new attack access flow is shielded, the function restriction processing for the target process and the associated target process associated with the target process can also be cancelled. It should be noted that the associated target process associated with the target process can be: the ancestor process of the target process and the descendant process of the target process. When clearing the exception flags of the target process and the associated target process, the target process with the exception flag and the associated target process can be recorded as processes to be cleared, so that the following processing is performed for each process to be cleared: first, the target process structure of the process to be cleared (for example, the process descriptor structure, that is, the task_struct structure of the process to be marked in the operating system kernel) is determined; then, the target field for placing the exception flag is located in the target process structure (for example, the tsk->atomic_flags field defined when the exception flag was placed previously); finally, the target field can be deleted, or the exception flag of the target field can be replaced with a normal flag. For example, when the exception flag is 1, the exception flag "1" can be replaced with a normal flag "0".

[0105] By applying the above-mentioned embodiments of the present application, abnormal process detection is performed on multiple running processes. When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, an abnormal identifier is added to the abnormal process and the associated processes associated with the abnormal process; based on the abnormal identifier, a target process is determined from multiple processes so that the target process and the parent process of the target process both have an abnormal identifier, thereby performing functional restriction processing on the target process to block security attacks against the target process through functional restriction processing.

[0106] Here, a process with an abnormal flag is in an abnormal state, and a process in an abnormal state is under security attack. In this way, 1) when an abnormal process is detected, an abnormal flag is added to the abnormal process and the associated processes associated with the abnormal process, which not only reduces the missed detection of processes under security attack, but also improves the detection efficiency of processes under security attack; 2) Because the target process and the parent process of the target process must both have an abnormal flag, the function of the target process is restricted. Even when the abnormal process parasitizes the main process so that the main process has an abnormal flag, the main process is not terminated. Therefore, for the case where the abnormal process parasitizes the main process, the impact of security attack behavior blocking on the main process can be reduced. In summary, through the present application, the detection effect of the process under security attack and the blocking effect of security attack behavior can be improved while reducing the impact of security attack behavior blocking on the main process.

[0107] The following describes an exemplary application of an embodiment of the present application in an actual application scenario. In the related art, when the EDR detects a threat process (i.e., the abnormal process mentioned above), the attack behavior blocking unit is informed, and the threat process is directly terminated by the attack behavior blocking unit. However, the related art has the following disadvantages: 1) It is easy to mistakenly terminate the business process (i.e., the main process mentioned above). When the threat process is parasitic on the business process, if the threat process is terminated, the business process will also be terminated. b) It is not possible to effectively block segmented attack behaviors. The essence of segmented attack behavior is to divide the attack into multiple stages, such as dividing the attack into segment a attack and segment b attack. Since segment a attack and segment b attack are independent of each other, when segment a attack behavior is detected, the attack behavior blocking unit can only prevent segment a attack, so it is also possible that even if segment a attack is successfully blocked, segment b attack will not be effectively blocked because it is not detected.

[0108] Based on this, the embodiment of the present application provides a process processing method to at least solve the above-mentioned problems. In the embodiment of the present application, the attack behavior blocking is implemented by combining the process marking and the kernel (hook) function restriction, and the attack behavior of the detected threat process can be blocked in real time. Among them, 1) Process marking: When the EDR detects a threat process, it informs the Linux driver, and the Linux driver marks the threat process, the brother process of the threat process, and the parent process of the threat process as a threat. 2) Kernel function restriction: When it is detected that the current process, the brother process of the current process, and the parent process of the current process are all marked as threat processes, the process creation function (i.e., the process creation system call) and the file read and write function (i.e., the file read and write system call) of the current process and the brother process of the current process are blocked, the function restriction of the threat process is completed, and the threat spread is blocked.

[0109] In this way, a segmented attack is carried out against a threat process that is parasitic on a business process. When an attack behavior against the current process is detected, the current process, the sibling processes of the current process, and the parent process of the current process (i.e., the business process) are marked as threats, and then functional restrictions are imposed on the current process and the sibling processes of the current process (including restrictions on process creation functions and file reading and writing functions), thereby effectively blocking the segmented attack behavior. Since targeted functional restrictions are only imposed on the child processes of the business process (including the current process and the sibling processes of the current process), the smooth operation of the business process can be guaranteed.

[0110] Based on this, the embodiments of the present application can solve the following problems: (1) When combining process tags to make function restrictions, the selection requirement of the restricted target process is: both the process and the parent process of the process have threat tags. Therefore, there are the following two situations: a) the business process has a threat tag, but the parent process of the business process does not have a threat tag. In this case, the business process is not affected; b) the business process and the parent process of the business process both have threat tags (rarely occurs). In this case, although the business process function is limited, the impact of blocking the attack behavior on the business process is controllable. (2) Effectively block segmented attack behavior. For the common segmented attack behavior "a main process creates multiple sub-processes, each sub-process has an independent attack task", when the attack behavior of a sub-process is detected, the sub-process, the sub-process's sibling processes and the main process are marked as threat processes at the same time, and subsequent attacks on the sub-process and the sub-process's sibling processes can be uniformly blocked during the function restriction stage.

[0111] See next Figure 7 , the process processing method provided in the embodiment of the present application is described. Figure 7As shown, the attack behavior blocking unit can be deployed in Android operating system, Ubuntu operating system, Community Enterprise Operating System (centOS), etc. When the attack behavior blocking unit is started, it will detect the process creation function and file reading and writing function in real time through the kernel hook mechanism. When EDR detects a threat process, it will pass the threat process descriptor to the attack behavior blocking unit. After receiving the threat process descriptor, the attack behavior blocking unit uses the Linux driver to mark the threat process indicated by the threat process descriptor, the sibling process of the threat process, and the parent process of the threat process as a threat, and restrict the process creation function and file reading and writing function of the target process (the target process and the parent process of the target process must have threat marks at the same time). When EDR needs to lift the function restrictions on a target process, the Linux driver can traverse the descendant processes and ancestor processes of the target process and cancel all threat marks.

[0112] For example, an actual scenario includes a normal user A, an attacker B, a device P, and an attack behavior blocking unit deployed on the device P. The attack behavior blocking process of the scenario may include:

[0113] Step 1: Normal user A logs in to device P (such as a Linux server, Linux desktop distribution, Android phone, etc.) and loads the EDR and attack behavior blocking unit.

[0114] Step 2: The attack behavior blocking unit completes the hook of the process creation function and the file reading and writing function.

[0115] Step 3: Normal user A executes the command normally, and no process is marked as a threat.

[0116] Step 4: After attacker B compromises the business process, he parasitizes the business process and divides the attack into two intervals, including: the first process attack (targeting the sub-process C of the business process) and the second process attack (targeting the sub-process D of the business process).

[0117] Step 5: EDR detects the threat of the first process attack and marks the child process C, the sibling process of child process C, and the parent process of child process C (i.e., the business process) as threats.

[0118] Step 6: For the target process (the target process and its parent process must both have threat tags), restrict the process creation function and file read and write function. In this way, the child processes C and D are restricted, which can block the attack behavior against the child processes C and D, but has no impact on the business process.

[0119] Step 7: EDR applies to remove the threat mark for a target process (such as child process C). The Linux driver can traverse the descendant processes and ancestor processes of the target process and cancel all threat marks. There will be no functional restrictions on the target process in the future.

[0120] See next Figure 8 and Fig. 9 , the process processing method provided by the embodiment of the present application is described. The processing flow of the embodiment of the present application includes: deployment of the attack behavior blocking unit, and implementation / restoration of the function restriction on the target process by the attack behavior blocking unit.

[0121] First, as Figure 8 As shown in the figure, the deployment process of the attack behavior blocking unit includes:

[0122] (1) The administrator logs in to the device used to deploy the attack behavior blocking unit.

[0123] (2) The administrator deploys an attack behavior blocking unit. When the system is subsequently started, the kernel hook-based process creation function detection mechanism and file read and write function detection mechanism will be loaded.

[0124] (3) The process of loading the kernel hook-based process creation function detection mechanism includes:

[0125] a) Load the Linux driver and use the system call table replacement technology to complete the hook of the exec system call (the function of implementing process creation). Here, the hook target is the exec series system call. When the user uses the exec system call to create a process, the hook function will be triggered, which serves as the technical support for the attack blocking function.

[0126] b) Restrict the execution of the exec system call of the target process that meets the requirements (the target process and the parent process of the target process must both have the threat mark) and return an error message.

[0127] (4) The process of loading the file read and write function detection mechanism based on kernel hook includes:

[0128] a) Load the Linux driver and use the system call table replacement technology to complete the hook for the open system call (which implements the file reading and writing function). Here, the hook target is the open series system call. When the user uses the open system call to try to read and write files, the hook function will be triggered, which serves as the technical support for the attack blocking function.

[0129] b) Restrict the execution of the open system call of the target process that meets the requirements (the target process and the parent process of the target process must both have the threat mark) and return an error message.

[0130] Second, if Fig. 9 As shown in the figure, the process of implementing / restoring functional restrictions on the target process by the attack behavior blocking unit includes:

[0131] (1) EDR sends a threat process blocking instruction for the current process to the attack behavior blocking unit.

[0132] (2) The attack behavior blocking unit calls the process marking module to add threat marks to the current process, its sibling processes, and its parent process.

[0133] In actual applications, the task_struct structure of the current process is located in the kernel, and tsk->atomic_flags|=VUL_FLAG is used to assign a value to tsk->atomic_flags to serve as the threat mark of the current process. Since the value of tsk->atomic_flags can be inherited by the new process when a new process is created, the threat mark can be inherited by the new process, thereby realizing the propagation of the threat mark and achieving persistent blocking of the threat.

[0134] (3) The attack behavior blocking unit calls the function restriction module to enable function restriction for the target process that meets the requirements (the target process and the parent process of the target process both have threat tags). At this time, the process creation function and file reading and writing function of the target process will be restricted.

[0135] (4) EDR sends a function restriction release instruction for the target process (the target process and the parent process of the target process must both have threat tags) to the attack behavior blocking unit.

[0136] (5) The attack behavior blocking unit calls the process marking module to clear the threat marks of the descendant processes and ancestor processes of the target process.

[0137] Based on this, in the embodiment of the present application, 1) for normal processes, when the process is not marked as a threat, the process is a normal process, and the function restriction module of the attack behavior blocking unit does not process the normal process. 2) For threat processes, a) the process marking module of the attack behavior blocking unit marks the threat process, the sibling process of the threat process, and the parent process as a threat; b) the function restriction module of the attack behavior blocking unit restricts the process creation function and file reading and writing function of the target process that meets the requirements. 3) For false positive processes, a) the process marking module of the attack behavior blocking unit marks the threat process, the sibling process of the threat process, and the parent process as a threat; b) the function restriction module of the attack behavior blocking unit restricts the process creation function and file reading and writing function of the target process that meets the requirements; c) when the target process is subsequently detected as a false positive, the EDR applies to lift the function restriction of the target process; d) the process marking module of the attack behavior blocking unit clears the threat mark of the descendant process and the ancestor process of the target process; e) when the function restriction module of the attack behavior blocking unit detects that the target process does not have a threat mark, the function restriction on the target process is lifted.

[0138] By applying the above embodiments of the present application, 1) attack behavior is blocked by process marking, and process marking can propagate threat marking during the process creation phase, thereby achieving persistent blocking defense for threat processes; 2) it is implemented through kernel hook technology and can be enabled in any kernel version; 3) the blocking method is functional restriction rather than forced process termination. When the threat process parasitizes on the business process, the impact of attack behavior blocking on the business process is controllable, and the performance is good for the situation where the threat process parasitizes on the business process; 4) when a false alarm of a threat process occurs, since the blocking method is functional restriction rather than process termination, the reversibility of attack behavior blocking can be achieved, that is, the attack behavior blocking for the false alarm process is released, and the performance is good for the occurrence of threat false alarm situations.

[0139] The following is a description of an exemplary structure of the process processing device 555 provided in the embodiment of the present application being implemented as a software module. In some embodiments, for example, Figure 2As shown, the software modules stored in the process processing device 555 of the memory 550 may include: a detection module 5551, which is used to perform abnormal process detection on multiple running processes to obtain a detection result; an identification adding module 5552, which is used to add an abnormal identification to the abnormal process and the associated processes associated with the abnormal process when the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes; wherein the abnormal state indicates that the process in the abnormal state is subject to a security attack, and the abnormal identification indicates that the process with the abnormal identification is in the abnormal state; a determination module 5553, which is used to determine a target process from the multiple processes based on the abnormal identification, and the target process and the parent process of the target process both have the abnormal identification; a function restriction module 5554, which is used to perform function restriction processing on the target process to block security attacks against the target process through the function restriction processing.

[0140] In some embodiments, the detection module 5551 is also used to perform the following processing for each of the multiple running processes: obtaining process behavior data and process status data of the process; analyzing the process behavior data and the process status data to obtain an analysis result; when the analysis result indicates that there is a security attack behavior against the process, determining that a detection result indicating that the process is in the abnormal state is obtained; when the analysis result indicates that there is no security attack behavior against the process, determining that a detection result indicating that the process is not in the abnormal state is obtained.

[0141] In some embodiments, the detection module 5551 is also used to call a machine learning model to predict security attack behavior on the process behavior data and the process status data to obtain a prediction result, wherein the prediction result indicates whether there is a security attack behavior against the process; and the prediction result is used as the analysis result.

[0142] In some embodiments, the identification adding module 5552 is also used to determine, from the multiple processes, a first process and a second process associated with the abnormal process when the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes; wherein the first process is the parent process of the abnormal process among the multiple processes, and the second process is the process among the multiple processes that has the same parent process as the abnormal process; the first process and the second process are used as the associated processes, and abnormal identification is added to the abnormal process and the associated process of the abnormal process.

[0143] In some embodiments, the identification adding module 5552 is also used to obtain a target process tree constructed based on the generation relationship between the multiple processes, the target process tree includes process nodes indicating each of the processes, and there is a generation relationship between the processes indicated by two process nodes on the same edge in the target process tree; from the target process tree, determine the second process node that shares an edge with the first process node indicating the abnormal process and generates the first process node, and use the process indicated by the second process node as the first process; from the target process tree, determine at least one third process node that shares an edge with the second process node and is generated by the second process node, and use the process indicated by the at least one third process node as the second process, and the at least one third process node does not include the first process node.

[0144] In some embodiments, the identification adding module 5552 is also used to treat the abnormal process and the associated processes associated with the abnormal process as processes to be marked, and perform the following processing for each process to be marked: determine the target process structure of the process to be marked, and the target process structure is used to store the process information of the process to be marked; define a target field in the target process structure, wherein when the process to be marked creates a new process, the target field can be inherited by the new process; and add the abnormal identification to the target field.

[0145] In some embodiments, the function restriction module 5554 is further used to perform function restriction processing on the process creation function of the target process, and to perform function restriction processing on the file reading and writing function of the target process.

[0146] In some embodiments, the function restriction module 5554 is also used to mount a first hook service for the process creation function, and through the first hook service, detect whether the target process executes a first calling behavior for the process creation function; when it is detected that the target process executes the first calling behavior, the execution of the first calling behavior of the target process is restricted; the function restriction module 5554 is also used to mount a second hook service for the file read and write function, and through the second hook service, detect whether the target process executes a second calling behavior for the file read and write function; when it is detected that the target process executes the second calling behavior, the execution of the second calling behavior of the target process is restricted.

[0147] In some embodiments, the function restriction module 5554 is also used to, after the function restriction processing is performed on the target process, when it is detected that there is a first target process in the target process that is mistakenly judged to be in the abnormal state, determine the associated target process associated with the first target process; clear the abnormal identification of the first target process and the associated target process, and cancel the function restriction processing on the first target process and the associated target process.

[0148] In some embodiments, the function restriction module 5554 is also used to detect whether the security attack behavior against the target process has ended after the function restriction processing is performed on the target process; when it is detected that the security attack behavior against the target process has ended, determine the associated target process associated with the target process; clear the exception identifiers of the target process and the associated target process, and cancel the function restriction processing on the target process and the associated target process.

[0149] In some embodiments, the function restriction module 5554 is also used to identify the attack access traffic of the security attack behavior against the target process and determine the traffic source address of the attack access traffic after the function restriction processing is performed on the target process; determine the new access traffic from the traffic source address as new attack access traffic, and shield the new attack access traffic; the function restriction module 5554 is also used to determine the associated target process associated with the target process after the shielding processing is performed on the new attack access traffic; clear the abnormal identification of the target process and the associated target process, and cancel the function restriction processing on the target process and the associated target process.

[0150] It should be noted that the description of the device embodiment in this application is similar to the description of the method embodiment above, and has similar beneficial effects as the method embodiment, which will not be described in detail here. The unfinished technical details in the process processing device provided in the embodiment of this application can be understood based on the description of the technical details in the method embodiment above.

[0151] The embodiment of the present application also provides a computer program product, which includes computer executable instructions or computer programs, and the computer executable instructions or computer programs are stored in a computer-readable storage medium. The processor of the electronic device reads the computer executable instructions or computer programs from the computer-readable storage medium, and the processor executes the computer executable instructions or computer programs, so that the electronic device executes the process processing method provided in the embodiment of the present application.

[0152] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the processor will execute the process processing method provided in the embodiment of the present application.

[0153] In some embodiments, the computer-readable storage medium may be a memory such as RAM, ROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or may be various devices including one or any combination of the above memories.

[0154] In some embodiments, computer executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0155] As an example, computer-executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0156] As an example, computer executable instructions may be deployed to be executed on one electronic device, or on multiple electronic devices located at one site, or on multiple electronic devices distributed at multiple sites and interconnected by a communication network.

[0157] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. A process processing method, characterized in that: The method comprises: Perform abnormal process detection on multiple running processes and obtain detection results; When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, adding an abnormal identifier to the abnormal process and an associated process associated with the abnormal process; The abnormal state indicates that the process in the abnormal state is under security attack, and the abnormal flag indicates that the process with the abnormal flag is in the abnormal state; Based on the exception identifier, determining a target process from the multiple processes, wherein both the target process and a parent process of the target process have the exception identifier; Function restriction processing is performed on the target process to block security attack behaviors against the target process through the function restriction processing.

2. The method according to claim 1, characterized in that The abnormal process detection is performed on the running multiple processes to obtain the detection results, including: For each of the multiple running processes, the following processing is performed respectively: Obtaining process behavior data and process status data of the process; Analyzing the process behavior data and the process status data to obtain analysis results; When the analysis result indicates that there is a security attack behavior against the process, determining that a detection result indicating that the process is in the abnormal state is obtained; When the analysis result indicates that there is no security attack behavior against the process, it is determined that a detection result indicating that the process is not in the abnormal state is obtained.

3. The method according to claim 2, characterized in that The analyzing the process behavior data and the process status data to obtain analysis results includes: Calling a machine learning model to predict security attack behaviors on the process behavior data and the process status data to obtain a prediction result, wherein the prediction result indicates whether there is a security attack behavior against the process; The prediction result is used as the analysis result.

4. The method according to claim 1, characterized in that When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, adding an abnormal identifier to the abnormal process and an associated process associated with the abnormal process includes: When the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes, determining a first process and a second process associated with the abnormal process from the multiple processes; The first process is a parent process of the abnormal process among the multiple processes, and the second process is a process among the multiple processes that has the same parent process as the abnormal process; The first process and the second process are used as the associated processes, and an abnormal identifier is added to the abnormal process and the associated process of the abnormal process.

5. The method according to claim 4, characterized in that The step of determining, from the plurality of processes, a first process and a second process associated with the abnormal process comprises: Acquire a target process tree constructed based on the generation relationship between the multiple processes, wherein the target process tree includes process nodes indicating each of the processes, and there is a generation relationship between processes indicated by two process nodes on the same edge of the target process tree; Determine, from the target process tree, a second process node that shares an edge with the first process node indicating the abnormal process and generates the first process node, and use the process indicated by the second process node as the first process; At least one third process node that shares an edge with the second process node and is generated by the second process node is determined from the target process tree, and a process indicated by the at least one third process node is used as the second process, wherein the at least one third process node does not include the first process node.

6. The method according to claim 1, characterized in that The adding an abnormal identifier to the abnormal process and an associated process associated with the abnormal process includes: The abnormal process and the associated processes associated with the abnormal process are taken as processes to be marked, and the following processing is performed for each of the processes to be marked: Determine a target process structure of the process to be marked, wherein the target process structure is used to store process information of the process to be marked; defining a target field in the target process structure, wherein when the process to be marked creates a new process, the target field can be inherited by the new process; The exception identifier is added to the target field.

7. The method according to claim 1, characterized in that The performing function restriction processing on the target process includes: The target process is subjected to a function restriction process of a process creation function, and the target process is subjected to a function restriction process of a file reading and writing function.

8. The method according to claim 7, characterized in that The function restriction processing of the process creation function of the target process includes: Mounting a first hook service for the process creation function, and detecting, through the first hook service, whether the target process executes a first calling behavior for the process creation function; When it is detected that the target process executes the first calling behavior, restricting the execution of the first calling behavior of the target process; The function restriction processing of the file reading and writing function of the target process includes: Mounting a second hook service for the file read and write function, and detecting, through the second hook service, whether the target process executes a second calling behavior for the file read and write function; When it is detected that the target process executes the second calling behavior, the execution of the second calling behavior of the target process is restricted.

9. The method according to claim 1, characterized in that After performing function restriction processing on the target process, the method further includes: When it is detected that there is a first target process in the target process that is mistakenly judged to be in the abnormal state, determining an associated target process associated with the first target process; The abnormal flags of the first target process and the associated target process are cleared, and the function restriction processing for the first target process and the associated target process is canceled.

10. The method according to claim 1, characterized in that After performing function restriction processing on the target process, the method further includes: Detecting whether the security attack on the target process is completed; When it is detected that the security attack behavior against the target process ends, determining an associated target process associated with the target process; The abnormal identifications of the target process and the associated target process are cleared, and the function restriction processing for the target process and the associated target process is cancelled.

11. The method according to claim 1, characterized in that After performing function restriction processing on the target process, the method further includes: Identify attack access traffic of security attack behavior against the target process, and determine the traffic source address of the attack access traffic; Determine the new access traffic from the traffic source address as new attack access traffic, and shield the new attack access traffic; After shielding the new attack access traffic, the method further includes: determining an associated target process associated with the target process; The abnormal identifications of the target process and the associated target process are cleared, and the function restriction processing for the target process and the associated target process is cancelled.

12. A process processing device, characterized in that: The device comprises: A detection module is used to detect abnormal processes in multiple running processes and obtain detection results; an identification adding module, configured to add an abnormal identification to the abnormal process and the associated processes associated with the abnormal process when the detection result indicates that there is an abnormal process in an abnormal state among the multiple processes; The abnormal state indicates that the process in the abnormal state is under security attack, and the abnormal flag indicates that the process with the abnormal flag is in the abnormal state; A determination module, configured to determine a target process from the multiple processes based on the abnormality identifier, wherein both the target process and a parent process of the target process have the abnormality identifier; The function restriction module is used to perform function restriction processing on the target process so as to block security attack behaviors against the target process through the function restriction processing.

13. An electronic device, characterized in that: The electronic device comprises: A memory for storing computer executable instructions; A processor, configured to implement the process processing method according to any one of claims 1 to 11 when executing the computer executable instructions stored in the memory.

14. A computer-readable storage medium storing computer-executable instructions or a computer program, characterized in that: When the computer executable instructions or computer programs are executed by a processor, the process processing method described in any one of claims 1 to 11 is implemented.

15. A computer program product comprising computer executable instructions or a computer program, characterized in that When the computer executable instructions or computer programs are executed by a processor, the process processing method described in any one of claims 1 to 11 is implemented.

Images