Process management method and device, equipment and storage medium

Abstract

The invention discloses a process management method and device, equipment and a storage medium, and belongs to the technical field of computers. The method is executed by computer equipment, an application process in a user mode and a blocking process in a kernel mode run on the computer equipment, and the method comprises the steps that the blocking process obtains a security label of the application process, the security label is used for indicating whether the application process has a security threat of invading the computer equipment or not; the blocking process obtains processing request information of the application process for the kernel mode, wherein the processing request information is request information of the application process for system calling of the kernel mode; under the condition that the security label of the application process is a threat label, the blocking process responds to the processing request information, and calling error information corresponding to the system calling is indicated to the application process.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a process management method, device, equipment and storage medium. Background Art

[0002] Threat processes can invade computer devices, create backdoor processes in computer devices, or tamper with data files, causing security risks.

[0003] In the related art, when a computer device detects a threatening process, the attack behavior on the computer device blocks the process and kills the threatening process to prevent the threatening process from endangering the security of the computer device.

[0004] However, the attack behavior blocking process kills the threat process through a signal instruction, and the signal is easy to be captured, and the restriction effect on the threat process is not good. Summary of the invention

[0005] The present application provides a process management method, apparatus, device and storage medium, and the technical solution is as follows:

[0006] According to one aspect of the present application, a process management method is provided, the method being executed by a computer device, on which an application process in a user state and a blocking process in a kernel state are running, the method comprising:

[0007] The blocking process acquires a security label of the application process, where the security label is used to indicate whether the application process has a security threat of invading the computer device;

[0008] The blocking process obtains processing request information of the application process for the kernel state, where the processing request information is request information of the application process for a system call of the kernel state;

[0009] In a case where the security label of the application process is a threat label, the blocking process indicates, in response to the processing request information, call error information corresponding to the system call to the application process.

[0010] According to another aspect of the present application, a process management device is provided, the process management device comprising a kernel state module and a user state module, the user state module comprising an application process module, the kernel state module comprising a blocking process module;

[0011] The blocking process module is used to obtain a security label of the application process, wherein the security label is used to indicate whether the application process has a security threat of invading the computer device;

[0012] The blocking process module is further used to obtain processing request information of the application process for the kernel state, where the processing request information is request information of the application process for the system call of the kernel state;

[0013] The blocking process module is further configured to, when the security label of the application process is a threat label, respond to the processing request information and indicate to the application process call error information corresponding to the system call.

[0014] In an optional design of the present application, the processing request information is used to request the process in the kernel state to create a system call;

[0015] The blocking process module is also used for:

[0016] In a case where the security label of the application process is a threat label, in response to the processing request information, first call error information of the process creation system call is indicated to the application process, wherein the first call error information is used to indicate that the application process is denied from creating a new process in the kernel state.

[0017] In an optional design of the present application, a creation behavior detection driver is deployed on the blocking process module, and the creation behavior detection driver is used to provide feedback information of the processing request information to the application process;

[0018] The blocking process module is also used for:

[0019] In a case where the security label of the application process is a threat label, in response to the processing request information, the creation behavior detection driver skips executing the process creation system call and obtains the first call error information of the process creation system call;

[0020] The first call error information of the process creation system call is indicated to the application process.

[0021] In an optional design of the present application, the processing request information is used to request a file read and write system call in the kernel state;

[0022] The blocking process module is also used for:

[0023] In a case where the security label of the application process is a threat label, in response to the processing request information, a second call error message of the file read and write system call is indicated to the application process, wherein the second call error message is used to indicate that the application process is denied file access or file editing in the kernel state.

[0024] In an optional design of the present application, a read-write behavior detection driver is deployed on the blocking process module, and the read-write behavior detection driver is used to provide feedback information of the processing request information to the application process;

[0025] The blocking process module is also used for:

[0026] In a case where the security label of the application process is a threat label, in response to the processing request information, the read / write behavior detection driver skips executing the file read / write system call and obtains the second call error information of the file read / write system call;

[0027] The second call error information of the file read / write system call is indicated to the application process.

[0028] In an optional design of the present application, the kernel state module further includes a detection process module; and the blocking process module is further used to:

[0029] A security label provided by a detection process is obtained, where the security label is obtained by the detection process detecting the application process.

[0030] In an optional design of the present application, the detection process module is also used to:

[0031] Comparing the historical behavior of the application process with a malicious behavior feature library to obtain a security label of the application process;

[0032] The security label of the application process is a threat label for indicating that the historical behavior of the application process is the same as at least one known malicious feature in the malicious behavior feature library.

[0033] In an optional design of the present application, the blocking process module is further used to:

[0034] Acquire a correction tag of the application process, where the correction tag is used to indicate that the security tag of the application process is updated from the threat tag to a trust tag;

[0035] In response to the processing request information, the call execution information of the system call is indicated to the application process, and the call execution information carries the execution result of the system call for the kernel state.

[0036] In an optional design of the present application, the blocking process module is further used to:

[0037] In response to the processing request information, the detection driver deployed on the blocking process instructs to execute the system call, and obtains an execution result of the system call for the kernel state;

[0038] The call execution information carrying the execution result is sent to the application process.

[0039] In an optional design of the present application, the detection driver deployed on the blocking process is associated with the system call in a hook manner;

[0040] The blocking process module is also used for:

[0041] In response to the processing request information, the detection driver is associated with the system call in a hook manner;

[0042] Execute the system call corresponding to the processing request information to obtain the execution result of the system call.

[0043] In an optional design of the present application, a detection driver is deployed on the blocking process; and the blocking process module is further used to:

[0044] The detection driver is loaded on the blocking process, and the detection driver is used to provide feedback information of the processing request information to the application process.

[0045] According to another aspect of the present application, a computer device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the process management method as described above.

[0046] According to another aspect of the present application, a computer-readable storage medium is provided, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the process management method described above.

[0047] According to another aspect of the present application, a computer program product is provided, which includes computer instructions stored in a computer-readable storage medium, and a processor reads and executes the computer instructions from the computer-readable storage medium to implement the process management method described above.

[0048] The beneficial effects of the technical solution provided by this application include at least:

[0049] By indicating call error information to the application process when the application process poses a security threat of intruding into the computer device, the security risk of the computer device caused by the application process making a system call is avoided, and the security of the data storage space corresponding to the kernel state is guaranteed; by indicating the call error information to the application process, the ability of the application process to request system calls is directly limited in the kernel state, and there is no need to limit the application process by blocking the signal between the process and the application process, thus avoiding the problem of the application process bypassing process management by capturing signals, and improving the effect of managing application processes that pose a security threat.

[0050] By indicating the call error information to the application process, the application process is avoided from being directly killed, and the operation of the business process will not be affected when the application process is parasitic on the normal business process. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 is a schematic diagram of a computer system provided by an exemplary embodiment of the present application;

[0053] Figure 2 is a schematic diagram of a process management method provided by an exemplary embodiment of the present application;

[0054] Figure 3 is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0055] Figure 4 is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0056] Figure 5 is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0057] Figure 6 is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0058] Figure 7 is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0059] Figure 8 is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0060] Fig. 9is a flow chart of a process management method provided by an exemplary embodiment of the present application;

[0061] Fig.10 is a schematic diagram of a process management method provided by an exemplary embodiment of the present application;

[0062] Fig.11 is a structural block diagram of a process management device provided by an exemplary embodiment of the present application;

[0063] Fig.12 It is a structural block diagram of a server provided by an exemplary embodiment of the present application.

[0064] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application. DETAILED DESCRIPTION

[0065] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0066] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0067] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0068] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the security labels, historical behavior of the application process and other information involved in this application are all obtained with full authorization.

[0069] It should be understood that although the terms first, second, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first parameter may also be referred to as the second parameter, and similarly, the second parameter may also be referred to as the first parameter. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0070] Figure 1 A schematic diagram of a computer system provided by an embodiment of the present application is shown. The computer system can be implemented as a system architecture of a process management method. The computer system may include: a terminal 100 and a server 200.

[0071] The terminal 100 may be an electronic device such as a mobile phone, a tablet computer, a vehicle-mounted terminal (vehicle computer), a wearable device, a PC (Personal Computer), etc. The terminal 100 may be installed with a client that runs a target application, and the target application may be a process management application or other application that provides a process management function, which is not limited in this application. In addition, this application does not limit the form of the target application, including but not limited to App (Application) installed in the terminal 100, applets, etc., and may also be in the form of a web page.

[0072] The server 200 may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The server 200 may be a background server of the target application, used to provide background services for the client of the target application.

[0073] In the process management method provided in the embodiment of the present application, the execution subject of each step may be a computer device, which refers to an electronic device with data calculation, processing and storage capabilities. Figure 1 Taking the implementation environment of the scheme shown as an example, the process management method can be executed by the terminal 100 (such as the client of the target application installed and running in the terminal 100 executes the process management method), or the server 200 executes the process management method, or the terminal 100 and the server 200 interact and cooperate to execute it, and this application does not limit this.

[0074] In addition, the technical solution of the present application can be combined with blockchain technology. For example, in the process management method disclosed in the present application, some data involved (such as the direction information of the first road and the second road) can be stored on the blockchain. The terminal 100 and the server 200 can communicate through a network, such as a wired or wireless network.

[0075] Next, the process management method in this application is introduced:

[0076] Figure 2 A schematic diagram of a process management method provided by an exemplary embodiment of the present application is provided;

[0077] The operating system 300 of the computer device includes a user state 302 and a kernel state 304. The user state 302 is used to provide utility programs to implement functions such as compilation and assembly, and the user state 302 is also used to provide application programming interface (Application Programming Interface, API) functions to implement operations such as reading, writing, and opening. The kernel state 304 is used to provide an operating system core to implement functions such as process management and file management on the computer device.

[0078] Exemplarily, the computer device runs an application process 312 in user state 302 and a detection process 322 and a blocking process 324 in kernel state; Exemplarily, the application process 312 is used to perform at least one of the functions of file access, editing, hardware device call, data processing, etc. in the computer device. The detection process 322 and the blocking process 324 detect whether the application process 312 has a security threat of intruding into the computer device, and restrict the functions of the process with security threats.

[0079] Specifically, the detection process 322 compares the historical behavior of the application process 312 with the malicious behavior feature library 315 to obtain a security label for the application process 312. Since the historical behavior of the application process 312 is identical to at least one known malicious feature in the malicious behavior feature library 315, the security label for the application process 312 is a threat label 325, which is used to indicate that the application process 312 poses a security threat of invading a computer device.

[0080] The blocking process 324 obtains the threat tag 325 provided by the detection process 322; the blocking process 324 obtains the processing request information 316 of the application process 312 for the kernel state 304, and the processing request information 316 is the request information of the application process 312 for the system call of the kernel state 304;

[0081] Specifically, the processing request information 316 can be used to request the process creation system call 332 in the kernel state 304 to create a new process; the processing request information 316 can also be used to request the file read and write system call 334 in the kernel state 304 to access or edit files.

[0082] A creation behavior detection driver 324a is deployed on the blocking process 324, and the creation behavior detection driver 324a is used to provide feedback information of the processing request information 316 to the application process 312; when the security label of the application process 312 is a threat label 325, in response to the processing request information 316, the creation behavior detection driver 324a skips the execution of the process creation system call 332, and obtains the first call error information 332a, which is the call error information of the process creation system call 332; the blocking process 324 indicates the first call error information 332a to the application process 312. The process creation system call 332 is implemented by a kernel function, and specifically, the process creation system call 332 is implemented by a process creation kernel function 332b.

[0083] The blocking process 324 is deployed with a read / write behavior detection driver 324b, which is used to provide feedback information of the processing request information 316 to the application process 312; when the security label of the application process 312 is a threat label 325, in response to the processing request information 316, the read / write behavior detection driver 324b skips executing the file read / write system call 334 and obtains the second call error information 334a, which is the call error information of the file read / write system call 334; the blocking process 324 indicates the second call error information 334a to the application process 312. The file read / write system call 334 is implemented by a kernel function, and specifically, the file read / write system call 334 is implemented by a file read / write kernel function 334b.

[0084] Figure 3 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. The method includes:

[0085] Step 510: The blocking process obtains the security label of the application process;

[0086] An application process in user state and a blocking process in kernel state are running on a computer device; exemplarily, the application process in user state is used to perform at least one of the following operations in the operating system of the computer device, including providing services provided by the application, processing human-computer interaction operations, and processing inter-process communications.

[0087] The blocking process in the kernel state is used to block the process with security threats that invade the computer device in the kernel state. In one example, the blocking process sends a call error message to the process with security threats that invade the computer device, and refuses the process with security threats that invade the computer device to make a system call.

[0088] Exemplarily, a security label is used to indicate whether an application process poses a security threat to a computer device; the security label may be carried by the application process or obtained by detecting the application process. This application does not limit the method for obtaining the security label.

[0089] Step 520: The blocking process obtains the processing request information of the application process for the kernel state;

[0090] Exemplarily, the processing request information is request information of the application process for a system call in kernel mode; the system call is implemented by a kernel function, the system call corresponds to the kernel function, and the kernel function is also called a service routine of the system call.

[0091] Exemplarily, the processing request information is initiated by the application process, and is a request information for the system call in the kernel state, requesting to execute the system call in the kernel state. Exemplarily, the blocking process can directly receive the processing request information initiated by the application process, or can receive the processing request information forwarded by other processes; this application does not limit this.

[0092] The processing request information of the application process for the kernel state includes but is not limited to at least one of requesting to create a new thread, requesting to access a file, and requesting to edit a file, which will be respectively illustrated in the following embodiments.

[0093] Step 530: when the security label of the application process is a threat label, the blocking process responds to the processing request information and indicates to the application process the call error information corresponding to the system call;

[0094] Exemplarily, when the security label of an application process is a threat label, the application process has a security threat of intruding into a computer device; for example, the application process has a security threat of creating a backdoor process in a computer system and reading and writing untrusted files; exemplary, the security label is a threat label at least used to indicate that the application process has at least one of the above-mentioned security threats, but it does not exclude the situation where the threat label carries descriptive information to indicate the type of security threat of the application program.

[0095] Exemplarily, when the security label of the application process is a threat label, the processing request information initiated by the application process poses a security threat to the kernel state of the computer device, and the system call requested by the processing request information is untrustworthy; the blocking process responds to the processing request information, indicates the call error information corresponding to the system call to the application process, and avoids executing the system call in the kernel state.

[0096] Exemplarily, the call error information corresponding to the system call is used to indicate that a call error occurred in the system call in the kernel state, thereby preventing the application process from obtaining the execution result of the system call. Exemplarily, the call error information indicated by the blocking process to the application process can be generated by the blocking process, or obtained by the blocking process in the storage space in the kernel state, and this application does not limit this.

[0097] To summarize, the method provided in this embodiment avoids security risks to the computer device caused by the application process making system calls by indicating call error information to the application process when the application process poses a security threat of intruding into the computer device, thereby ensuring the security of the data storage space corresponding to the kernel state; by indicating the call error information by the application process, the ability of the application process to request system calls is directly limited in the kernel state, without the need to limit the application process by blocking the signal between the process and the application process, avoiding the problem of the application process bypassing process management by capturing signals, and improving the effect of managing application processes that pose a security threat.

[0098] Next, the system calls including the process creation system calls are introduced.

[0099] Figure 4 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. Figure 3 In the illustrated embodiment, step 530 may be implemented as step 532:

[0100] Step 532: when the security label of the application process is a threat label, the blocking process responds to the processing request information and indicates to the application process the first call error information of the process creation system call;

[0101] In this embodiment, the processing request information is used to request a process creation system call in the kernel state; the processing request information is used to instruct to create a new process in the kernel state.

[0102] Exemplarily, when the security label of the application process is a threat label, the application process initiating the creation of a new process in the kernel state poses a security threat. In one example, the application process exceeds the scope of consent of the authorized object and illegally creates a backdoor process, causing at least one of the risks of unauthorized access to the computer device (for example, unauthorized network services can be opened through the backdoor process), malicious operation risk (for example, changing the configuration of the computer device through the backdoor process, maliciously shutting down or restarting the computer device), etc.

[0103] In an optional implementation, the threat tag carries description information for indicating the type of security threat to the application; when the description information indicates that the type of security threat to the application process is the creation of a malicious process, the blocking process responds to the processing request information and indicates to the application process the first call error information of the process creation system call;

[0104] Exemplarily, the first call error information is a call error information for a process creation system call, and the first call error information is used to prevent the application process from obtaining the execution result of the process creation system call. The first call error information is used to indicate that the application process is denied from creating a new process in kernel mode.

[0105] Exemplarily, the first call error message may explicitly indicate that the application process is refused to create a new process by carrying at least one of the characteristic matrix, characteristic vector, and characteristic value, or may implicitly indicate that the application process is refused to create a new process by carrying empty information, or timing out without sending information to the application process.

[0106] In an optional implementation, step 532 in this embodiment may be implemented as the following sub-steps 32a and 32b:

[0107] Sub-step 32a: when the security label of the application process is a threat label, in response to the processing request information, creating a behavior detection driver to skip executing the process creation system call, and obtaining first call error information of the process creation system call;

[0108] In this embodiment, a creation behavior detection driver is deployed on the blocking process, and the creation behavior detection driver is used to provide feedback information of processing request information to the application process; when the security label of the application process is a threat label, the creation behavior detection driver is used to provide the feedback information provided to the application process as the first call error information.

[0109] Exemplarily, the creation behavior detection driver obtains the first call error information in the storage space of the memory state in a hook manner. Exemplarily, the kernel function corresponding to the process creation system call is at least one kernel function in the exec function family, and exemplary, the exec function family provides a way to start another new process in the application process.

[0110] In one implementation, a behavior detection driver is created in a hook manner to obtain the first call error information in the storage space in the memory state; the execution process creation system call is skipped to directly obtain the first call error information; it can also be called skipping the call to the kernel function belonging to the exec function family to obtain the first call error information.

[0111] Sub-step 32b: The blocking process indicates to the application process the first call error information of the process creation system call;

[0112] Exemplarily, the first call error information is obtained by a creation behavior detection driver deployed on the blocking process, and the blocking process is used to indicate the first call error information to the application process; it can be understood that the blocking process can send the first call error information directly to the application process, or instruct other processes in kernel state or user state to forward the first call error information to the application process.

[0113] To summarize, the method provided in this embodiment, by indicating the first call error information to the application process when the application process poses a security threat of intruding into the computer device, avoids the application process from making a process creation system call and maliciously creating a new process that poses a security risk to the computer device, thereby ensuring the security of the data storage space corresponding to the kernel state; by indicating the first call error information to the application process, the ability of the application process to request a process creation system call is directly restricted in the kernel state, avoiding the problem of the application process bypassing process management by capturing signals, thereby improving the effect of managing application processes that pose a security threat.

[0114] Next, the system calls including file reading and writing system calls are introduced.

[0115] Figure 5 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. Figure 3 In the illustrated embodiment, step 530 may be implemented as step 534:

[0116] Step 534: when the security label of the application process is a threat label, the blocking process indicates the second call error information of the file read / write system call to the application process in response to the processing request information;

[0117] In this embodiment, the processing request information is used to request a file read / write system call in the kernel state; the processing request information is used to instruct to perform file access or file editing in the kernel state.

[0118] Exemplarily, when the security label of the application process is a threat label, the file access or file editing initiated by the application process in the kernel state poses a security threat.

[0119] In one example, an application process exceeds the scope of consent of the authorized object and illegally accesses or edits files, causing at least one of the risks of information theft of computer devices (such as the application process maliciously stealing, deleting or tampering with login credentials, personal privacy and other information), and the risk of malicious file propagation (such as writing malicious code or malicious application software).

[0120] In an optional implementation, the threat tag carries description information for indicating the type of security threat to the application; when the description information indicates that the type of security threat to the application process is malicious reading and writing of files, the blocking process responds to the processing request information and indicates to the application process the second call error information of the file reading and writing system call;

[0121] Exemplarily, the second call error information is a call error information for a file read / write system call, and the second call error information is used to prevent the application process from obtaining the execution result of the file read / write system call, and the second call error information is used to indicate that the application process is denied file access or file editing in kernel mode. Exemplarily, the second call error information is similar to the first call error information, and can indicate in an explicit or implicit manner that the application process is denied file access or file editing.

[0122] In an optional implementation, step 534 in this embodiment may be implemented as the following sub-steps 34a and 34b:

[0123] Sub-step 34a: when the security label of the application process is a threat label, in response to the processing request information, the read / write behavior detection driver skips executing the file read / write system call and obtains second call error information of the file read / write system call;

[0124] In this embodiment, a read-write behavior detection driver is deployed on the blocking process, and the read-write behavior detection driver is used to provide feedback information of processing request information to the application process; when the security label of the application process is a threat label, the feedback information provided by the read-write behavior detection driver to the application process is the second call error information.

[0125] Exemplarily, the read-write behavior detection driver obtains the second call error information in the storage space in the memory state in a hook manner. Exemplarily, the file read-write system call includes an open system call, and the open system call is used to establish an access path to the file. In the case of a successful call, a file descriptor is returned. When the open system call fails, a value of -1 is returned, and a global variable named errno is set to indicate the reason for the failure of the open system call. In this embodiment, only the open system call is used for explanation, and it does not exclude the case where the file read-write system call is other system calls with file read-write functions, such as a read system call or a write system call.

[0126] In one implementation, the read / write behavior detection driver obtains the second call error information in the storage space in the memory state in a hook manner; skips the execution file read / write system call, and directly obtains the second call error information.

[0127] Sub-step 34b: The blocking process indicates to the application process the second call error information of the file read / write system call;

[0128] Exemplarily, the second call error information is obtained by a read-write behavior detection driver deployed on the blocking process, and the blocking process is used to indicate the second call error information to the application process; it can be understood that the blocking process can send the second call error information directly to the application process, or instruct other processes in kernel state or user state to forward the second call error information to the application process.

[0129] To summarize, the method provided in this embodiment, by indicating the second call error information to the application process when the application process poses a security threat of intruding into the computer device, avoids the application process from making file read and write system calls, maliciously tampering with or accessing files, causing security risks to the computer device, and ensures the security of the data storage space corresponding to the kernel state; by indicating the second call error information to the application process, the ability of the application process to request file read and write system calls is directly restricted in the kernel state, avoiding the problem of the application process bypassing process management by capturing signals, and improving the effect of managing application processes that pose security threats.

[0130] Figure 6 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. Figure 3 In the illustrated embodiment, step 510 may be implemented as step 512:

[0131] Step 512: The blocking process obtains the security label provided by the detection process;

[0132] A detection process in kernel state is running on the computer device; the security label is obtained by the detection process detecting the application process, and the detection process is also called an Endpoint Detection and Response (EDR) device.

[0133] Exemplarily, the detection process determines the security label through the process characteristics of the application process, where the process characteristics of the application process include but are not limited to at least one of the historical behavior information of the application process, the establishment time of the application process, the interface information of the application process, etc.

[0134] In an optional implementation, the following steps are also included before step 512 in this implementation:

[0135] The detection process compares the historical behavior of the application process with the malicious behavior feature library to obtain the security label of the application process;

[0136] Exemplarily, the malicious behavior feature library is used to store at least one process feature that poses a security threat, and the malicious behavior feature library stores at least one of the process features of malware, the process features of fileless attack processes, and the process features of abusing legitimate permissions.

[0137] Exemplarily, the security label of the application process is a threat label used to indicate that the historical behavior of the application process is the same as at least one known malicious feature in the malicious behavior feature library.

[0138] To summarize, the method provided in this embodiment provides a security label by detecting the process, thereby determining whether the application process poses a security threat to the computer device based on the process characteristics of the application process; by indicating call error information to the application process when the application process poses a security threat to the computer device, it avoids the application process making system calls that pose a security risk to the computer device, thereby ensuring the security of the data storage space corresponding to the kernel state; and improving the effect of managing application processes that pose a security threat.

[0139] Figure 7 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. Figure 3 Based on the embodiment shown, step 545 and step 546 are also included:

[0140] Step 545: The blocking process obtains the correction tag of the application process;

[0141] Exemplarily, the correction tag is a type of security tag, and the correction tag is used to indicate that the security tag of the application process is updated from a threat tag to a trust tag; the correction tag is used to indicate that the application process no longer poses a security threat to intrusion into the computer device. Exemplarily, the security tag of the application process can be obtained according to a preset time period, or can be updated and obtained when the security tag changes. Exemplarily, when the security tag of the application process is a trust tag, the application process does not pose a security threat to intrusion into the computer device.

[0142] Exemplarily, the acquisition of the correction tag is similar to that of the security tag, which can be carried by the application process or obtained by detecting the application process. Exemplarily, the correction tag carries a check character to verify the authenticity of the correction tag to prevent the correction tag from being tampered with. Or the correction tag is obtained from a trusted source, which is a tag obtained by a trusted source process detecting the application process, or a tag obtained by a trusted source process after verification; similarly, the security tag mentioned above can also carry a check character or have a trusted source.

[0143] Step 546: the blocking process indicates the call execution information of the system call to the application process in response to the processing request information;

[0144] Exemplarily, the call execution information carries the execution result of the system call in kernel mode. The correction tag is used to indicate that the application process no longer poses a security threat to intrusion into the computer device; if the application process does not pose a security threat to intrusion into the computer device, the system call in kernel mode initiated by the application process does not pose a security threat, and the application process is allowed to obtain the execution result of the system call.

[0145] In this embodiment, the system call in kernel mode initiated by the application process includes but is not limited to at least one of requesting to create a new thread, requesting to access a file, and requesting to edit a file. Correspondingly, the system call includes a process creation system call or a file read and write system call; for an introduction to the above system calls, please refer to Figure 4 , Figure 5 The corresponding embodiments.

[0146] Exemplarily, the call execution information carries the execution result of the system call for the kernel state, also called the execution result of the kernel function corresponding to the system call in the kernel state. The call execution information is obtained by executing the kernel function corresponding to the system call.

[0147] In an optional implementation, step 546 in this embodiment may be implemented as the following sub-steps 46a and 46b:

[0148] Sub-step 46a: in response to the processing request information, blocking the detection driver deployed on the process to instruct the execution of the system call, and obtaining the execution result of the system call for the kernel state;

[0149] Exemplarily, a detection driver is deployed on the blocking process, and the detection driver is used to provide feedback information of processing request information to the application process; when the security label of the application process is a correction label, the feedback information provided by the detection driver to the application process is the execution result of the system call.

[0150] Exemplarily, the system calls introduced above include but are not limited to at least one of requesting to create a new thread, requesting to access a file, and requesting to edit a file. Accordingly, the detection driver includes a creation behavior detection driver, which is used to provide the application process with the execution result of the process creation system call; or the detection driver includes a read-write behavior detection driver, which is used to provide the application process with the execution result of the file read-write system call.

[0151] In a specific implementation, the detection driver deployed on the blocking process is associated with the system call in a hook manner;

[0152] In response to the processing request information, the detection driver is associated with the system call in a hook manner;

[0153] Execute the system call corresponding to the processing request information and obtain the execution result of the system call.

[0154] For example, when the system call in kernel state initiated by the application process does not pose a security threat, the detection driver deployed on the blocking process is associated with the system call in a hooking manner, indicating the execution of the system call, specifically, the execution of the kernel function corresponding to the system call. By executing the system call, the execution result of the system call is obtained.

[0155] In one implementation, the system call includes a process creation system call, and the execution result is used to indicate the creation of a new process. In one implementation, the system call includes a file read / write system call, and the execution result is used to indicate the access or editing of a file.

[0156] Sub-step 46b: The blocking process sends a call execution message carrying the execution result to the application process.

[0157] Exemplarily, the execution result is obtained by the detection driver instructing the execution system to mobilize, and the blocking process deployed with the detection driver sends call execution information to the application process, and the call execution information carries the execution result of the system call.

[0158] To summarize, the method provided in this embodiment indicates the call execution information of the system call to the application process when the security label of the application process is changed from a threat label to a trust label; updates the management policy for the application process, and executes the system call requested by the application process when the application process does not pose a security threat of intruding into the computer device; avoids the continuous restriction of the application process caused by the security label error, and realizes the dynamic update of the management policy of the application process.

[0159] Figure 8 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. The method includes:

[0160] Step 702: The detection process detects the application process and obtains a security label of the application process;

[0161] Exemplarily, the detection process is also referred to as an Endpoint Detection and Response (EDR) device.

[0162] Exemplarily, the detection process determines a security tag through process characteristics of the application process, where the security tag is used to indicate whether the application process poses a security threat of intruding into a computer device.

[0163] In one example, the security label is a threat label, which indicates that the application process has a security threat of intruding into the computer device; the process management process corresponding to the threat label will be introduced through the following steps 712 to 716. In another example, the security label is a trust label, which indicates that the application process does not have a security threat of intruding into the computer device; the process management process corresponding to the threat label will be introduced through the following steps 722 to 726.

[0164] Step 712: The detection process sends a threat tag to the blocking process;

[0165] Exemplarily, the detection process indicates to the blocking process that the application process poses a security threat of intruding into the computer device.

[0166] Step 714: The creation behavior detection driver and / or the read-write behavior detection driver deployed in the blocking process obtains the threat tag;

[0167] Exemplarily, a detection driver is deployed on the blocking process to provide feedback information of the processing request information to the application process. Specifically, the detection driver includes a creation behavior detection driver and / or a read-write behavior detection driver; wherein the creation behavior detection driver is used to provide feedback information of creating a new process to the application process; and the read-write behavior detection driver is used to provide feedback information of file access or file editing to the application process.

[0168] Step 716: Sending system call error information to the application based on the threat tag;

[0169] Exemplarily, in the case where an application process poses a security threat of intruding into a computer device, the blocking process indicates to the application program a call error message of a system call, where the call error message is used to indicate that an error has occurred in a process creation system call requested by the application process, and the application process is denied from creating a new process in the kernel state; and / or an error has occurred in a file read / write system call requested by the application process, and the application process is denied from accessing or editing the file in the kernel state.

[0170] Exemplarily, based on the threat label, the relevant kernel function corresponding to the system call is skipped, and the call error information is directly returned.

[0171] Step 722: The detection process sends a trust tag to the blocking process;

[0172] Exemplarily, the detection process indicates to the blocking process that the application process does not pose a security threat to intrusion into the computer device.

[0173] Step 724: Deploy a creation behavior detection driver and / or a read-write behavior detection driver in the blocking process to obtain a trust tag;

[0174] Exemplarily, a detection driver is deployed on the blocking process to provide feedback information of the processing request information to the application process. Specifically, the detection driver includes a creation behavior detection driver and / or a read-write behavior detection driver.

[0175] Step 726: Sending call execution information of the system call to the application based on the trust tag;

[0176] Exemplarily, when the application process does not pose a security threat of intruding into the computer device, the blocking process indicates the call execution information of the system call to the application program, and the call execution information is the execution result of the process creation system call requested by the application process, and a new process is created in the kernel state; and / or, the execution result of the file read and write system call requested by the application process, and the file is accessed or edited in the kernel state.

[0177] Exemplarily, based on the trust tag, the relevant kernel function corresponding to the system call is executed normally, and the execution result of the relevant kernel function corresponding to the system call is returned.

[0178] To summarize, the method provided in this embodiment avoids security risks to the computer device caused by the application process making system calls by indicating call error information to the application process when the application process poses a security threat of intruding into the computer device, thereby ensuring the security of the data storage space corresponding to the kernel state; by indicating the call error information by the application process, the ability of the application process to request system calls is directly limited in the kernel state, without the need to limit the application process by blocking the signal between the process and the application process, avoiding the problem of the application process bypassing process management by capturing signals, and improving the effect of managing application processes that pose a security threat.

[0179] Fig. 9 A flowchart of a process management method provided by an exemplary embodiment of the present application is shown. The method can be executed by a computer device. Figure 3 Based on the illustrated embodiment, step 502 is also included:

[0180] Step 502: Loading a detection driver on the blocking process;

[0181] Exemplarily, a detection driver is deployed on the blocking process, and the detection driver is used to provide feedback information of the processing request information to the application process.

[0182] In one example, the detection driver includes creating a behavior detection driver for providing feedback information of processing request information to the application process, wherein the processing request information is used to request a process creation system call in the kernel state. The execution of the process creation system call is used to create a new process in the kernel state.

[0183] In another example, the detection driver includes a read / write behavior detection driver for providing feedback information of processing request information to the application process, the processing request information is used to request a file read / write system call in the kernel state. The file read / write system call is used to access or edit a file in the kernel state.

[0184] For a detailed introduction to creating behavior detection drivers and reading and writing behavior detection drivers, please refer to the above Figure 4 , Figure 5 The corresponding embodiments.

[0185] Exemplarily, the detection driver is loaded in the blocking process, and the detection driver is deployed on the blocking process, so that the detection driver provides feedback information of the processing request information to the application process. Specifically, the detection driver is hooked to the system call in a hooking manner to realize the loading of the detection driver, and the detection driver obtains the feedback information of the processing request information in the hooking manner.

[0186] It can be understood that the feedback information obtained by the detection driver is related to the security label of the application process. As described in step 530, when the security label of the application process is a threat label, the blocking process indicates to the application process the call error information corresponding to the system call; that is, when the security label of the application process is a threat label, the feedback information obtained by the detection driver is the call error information. In another example, when the security label of the application process is a trust label, the feedback information obtained by the detection driver is the call execution information of the system call, and the call execution information carries the execution result of the system call for the kernel state.

[0187] It should be noted that step 502 in this embodiment is usually performed before step 510 or step 520, but it does not exclude the case where it is performed after step 510 or step 520, or performed simultaneously. The execution sequence of step 510 in each embodiment of the present application can be performed before, after or simultaneously with step 520, and the present application does not impose any restrictive provisions on this.

[0188] To summarize, the method provided in this embodiment completes hooking to the system call in a hooking manner by loading the detection driver on the blocking process, thereby ensuring that the detection driver can obtain feedback information of the processing request information; by indicating the call error information to the application process when the application process poses a security threat of invading the computer device, it avoids the security risks of the application process making system calls to the computer device, thereby ensuring the security of the data storage space corresponding to the kernel state; and improving the effect of managing application processes that pose a security threat.

[0189] In one example, Fig.10A schematic diagram of a process management method provided by an exemplary embodiment of the present application is shown.

[0190] Exemplarily, the blocking process 750 is also referred to as an attack behavior blocking process or an attack behavior blocking device; at least one of a creation behavior detection driver 752 and a read-write behavior detection driver 754 is deployed on the blocking process 750 .

[0191] The behavior detection driver 752 is created to perform at least one of the following steps.

[0192] Step 762: Hooking to the exec system call by replacing the system call table;

[0193] Exemplarily, by hooking to the exec system call, the creation behavior detection driver 752 is loaded and deployed on the blocking process 750 .

[0194] Step 764: restrict the execution of the exec system call and return the first call error information;

[0195] Exemplarily, when the application process has a threat label, the execution of the exec system call requested by the application process is restricted, and the first call error information is returned; and the application process is denied from creating a new process in the kernel state.

[0196] Step 766: Unrestrict the execution of the exec system call and return the execution result of the exec system call;

[0197] Exemplarily, when the application process has a trust label, the restriction on the execution of the exec system call requested by the application process is lifted, the kernel function corresponding to the exec system is executed, and the execution result of the exec system call is returned; and a new process is created in the kernel state as requested by the application process.

[0198] The read-write behavior detection driver 754 is used to perform at least one of the following steps.

[0199] Step 772: Hooking to the open system call by replacing the system call table;

[0200] Exemplarily, by hooking to the open system call, the loading of the read-write behavior detection driver 754 is realized, and the read-write behavior detection driver 754 is deployed on the blocking process 750.

[0201] Step 774: restrict the execution of the open system call and return the second call error information;

[0202] Exemplarily, when the application process has a threat label, the execution of the open system call requested by the application process is restricted, and a second call error message is returned; and the application process is denied file access or file editing in the kernel state.

[0203] Step 776: Unrestrict the execution of the open system call and return the execution result of the open system call;

[0204] Exemplarily, when the application process has a trust label, the restriction on the execution of the open system call requested by the application process is lifted, the kernel function corresponding to the open system is executed, and the execution result of the open system call is returned; the file access or file editing requested by the application process is executed in the kernel state.

[0205] To summarize, the method provided in this embodiment completes hooking to the system call in a hooking manner by loading the detection driver on the blocking process, thereby ensuring that the detection driver can obtain feedback information of the processing request information; by indicating the call error information to the application process when the application process poses a security threat of invading the computer device, it avoids the security risks of the application process making system calls to the computer device, thereby ensuring the security of the data storage space corresponding to the kernel state; and improving the effect of managing application processes that pose a security threat.

[0206] Those skilled in the art can understand that the above embodiments can be implemented independently, or the above embodiments can be freely combined to form new embodiments to implement the process management method of the present application.

[0207] Fig.11 The structural block diagram of a process management device provided by an exemplary embodiment of the present application is shown. The process management device includes a kernel state module 810 and a user state module 820, the user state module 820 includes an application process module 822, and the kernel state module 810 includes a blocking process module 812;

[0208] The blocking process module 812 is used to obtain a security label of the application process, where the security label is used to indicate whether the application process has a security threat of invading the computer device;

[0209] The blocking process module 812 is further used to obtain the processing request information of the application process for the kernel state, where the processing request information is the request information of the application process for the system call of the kernel state;

[0210] The blocking process module 812 is further configured to indicate, when the security label of the application process is a threat label, in response to the processing request information, call error information corresponding to the system call to the application process.

[0211] In an optional design of the present application, the processing request information is used to request the process in the kernel state to create a system call;

[0212] The blocking process module 812 is also used for:

[0213] In a case where the security label of the application process is a threat label, in response to the processing request information, first call error information of the process creation system call is indicated to the application process, wherein the first call error information is used to indicate that the application process is denied from creating a new process in the kernel state.

[0214] In an optional design of the present application, a creation behavior detection driver is deployed on the blocking process module 812, and the creation behavior detection driver is used to provide feedback information of the processing request information to the application process;

[0215] The blocking process module 812 is also used for:

[0216] In a case where the security label of the application process is a threat label, in response to the processing request information, the creation behavior detection driver skips executing the process creation system call and obtains the first call error information of the process creation system call;

[0217] The first call error information of the process creation system call is indicated to the application process.

[0218] In an optional design of the present application, the processing request information is used to request a file read and write system call in the kernel state;

[0219] The blocking process module 812 is also used for:

[0220] In a case where the security label of the application process is a threat label, in response to the processing request information, a second call error message of the file read and write system call is indicated to the application process, wherein the second call error message is used to indicate that the application process is denied file access or file editing in the kernel state.

[0221] In an optional design of the present application, a read-write behavior detection driver is deployed on the blocking process module 812, and the read-write behavior detection driver is used to provide feedback information of the processing request information to the application process;

[0222] The blocking process module 812 is also used for:

[0223] In a case where the security label of the application process is a threat label, in response to the processing request information, the read / write behavior detection driver skips executing the file read / write system call and obtains the second call error information of the file read / write system call;

[0224] The second call error information of the file read / write system call is indicated to the application process.

[0225] In an optional design of the present application, the kernel state module 810 further includes a detection process module 814; the blocking process module 812 is further used to:

[0226] A security label provided by a detection process is obtained, where the security label is obtained by the detection process detecting the application process.

[0227] In an optional design of the present application, the detection process module 814 is further used to:

[0228] Comparing the historical behavior of the application process with a malicious behavior feature library to obtain a security label of the application process;

[0229] The security label of the application process is a threat label for indicating that the historical behavior of the application process is the same as at least one known malicious feature in the malicious behavior feature library.

[0230] In an optional design of the present application, the blocking process module 812 is further used to:

[0231] Acquire a correction tag of the application process, where the correction tag is used to indicate that the security tag of the application process is updated from the threat tag to a trust tag;

[0232] In response to the processing request information, the call execution information of the system call is indicated to the application process, and the call execution information carries the execution result of the system call for the kernel state.

[0233] In an optional design of the present application, the blocking process module 812 is further used to:

[0234] In response to the processing request information, the detection driver deployed on the blocking process instructs to execute the system call, and obtains an execution result of the system call for the kernel state;

[0235] The call execution information carrying the execution result is sent to the application process.

[0236] In an optional design of the present application, the detection driver deployed on the blocking process is associated with the system call in a hook manner;

[0237] The blocking process module 812 is also used for:

[0238] In response to the processing request information, the detection driver is associated with the system call in a hook manner;

[0239] Execute the system call corresponding to the processing request information to obtain the execution result of the system call.

[0240] In an optional design of the present application, a detection driver is deployed on the blocking process; the blocking process module 812 is further used to:

[0241] The detection driver is loaded on the blocking process, and the detection driver is used to provide feedback information of the processing request information to the application process.

[0242] One point that needs to be explained is that the device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example to implement its functions. In actual applications, the above-mentioned functions can be assigned to different functional modules according to actual needs, that is, the content structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0243] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method; the technical effects achieved by each module performing operations are the same as those in the embodiment of the method, and will not be elaborated here.

[0244] An embodiment of the present application also provides a computer device, which includes: a processor and a memory, wherein a computer program is stored in the memory; the processor is used to execute the computer program in the memory to implement the process management method provided by the above-mentioned method embodiments.

[0245] Optionally, the computer device is a server. Fig.12 It is a structural block diagram of a server provided by an exemplary embodiment of the present application.

[0246] Typically, the server 2300 includes: a processor 2301 and a memory 2302 .

[0247] The processor 2301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 2301 may be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 2301 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 2301 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 2301 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0248] The memory 2302 may include one or more computer-readable storage media, which may be non-transitory. The memory 2302 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 2302 is used to store at least one instruction, which is used to be executed by the processor 2301 to implement the process management method provided in the method embodiment of the present application.

[0249] In some embodiments, the server 2300 may also optionally include: an input interface 2303 and an output interface 2304. The processor 2301, the memory 2302, the input interface 2303, and the output interface 2304 may be connected via a bus or a signal line. Each peripheral device may be connected to the input interface 2303 and the output interface 2304 via a bus, a signal line, or a circuit board. The input interface 2303 and the output interface 2304 may be used to connect at least one peripheral device related to input / output (I / O) to the processor 2301 and the memory 2302. In some embodiments, the processor 2301, the memory 2302, the input interface 2303, and the output interface 2304 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 2301, the memory 2302, the input interface 2303, and the output interface 2304 may be implemented on a separate chip or circuit board, which is not limited in the embodiments of the present application.

[0250] Those skilled in the art will appreciate that the structure shown above does not constitute a limitation on the server 2300 , and may include more or fewer components than shown in the figure, or combine certain components, or adopt a different component arrangement.

[0251] In an exemplary embodiment, a chip is also provided, which includes a programmable logic circuit and / or program instructions. When the chip runs on a computer device, it is used to implement the process management method described in the above aspects.

[0252] In an exemplary embodiment, a computer program product is also provided, the computer program product includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor reads and executes the computer instructions from the computer-readable storage medium to implement the process management method provided by the above-mentioned method embodiments.

[0253] In an exemplary embodiment, a computer-readable storage medium is further provided, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the process management method provided by the above-mentioned method embodiments.

[0254] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0255] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented with hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0256] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A process management method, characterized in that: The method is executed by a computer device, on which an application process in a user state and a blocking process in a kernel state are running, and the method includes: The blocking process acquires a security label of the application process, where the security label is used to indicate whether the application process has a security threat of invading the computer device; The blocking process obtains processing request information of the application process for the kernel state, where the processing request information is request information of the application process for a system call of the kernel state; In a case where the security label of the application process is a threat label, the blocking process indicates, in response to the processing request information, call error information corresponding to the system call to the application process.

2. The method according to claim 1, characterized in that The processing request information is used to request the process in the kernel state to create a system call; When the security label of the application process is a threat label, the blocking process indicates the call error information corresponding to the system call to the application process in response to the processing request information, including: In the case where the security label of the application process is a threat label, the blocking process responds to the processing request information and indicates to the application process a first call error message of the process creation system call, wherein the first call error message is used to indicate that the application process is denied from creating a new process in the kernel state.

3. The method according to claim 2, characterized in that A creation behavior detection driver is deployed on the blocking process, and the creation behavior detection driver is used to provide feedback information of the processing request information to the application process; In the case where the security label of the application process is a threat label, the blocking process, in response to the processing request information, indicates to the application process first call error information of the process creating a system call, including: In a case where the security label of the application process is a threat label, in response to the processing request information, the creation behavior detection driver skips executing the process creation system call and obtains the first call error information of the process creation system call; The blocking process indicates to the application process the first call error information of the process creation system call.

4. The method according to claim 1, characterized in that The processing request information is used to request a file read and write system call in the kernel state; When the security label of the application process is a threat label, the blocking process indicates the call error information corresponding to the system call to the application process in response to the processing request information, including: In the case where the security label of the application process is a threat label, the blocking process responds to the processing request information and indicates to the application process a second call error message of the file read and write system call, wherein the second call error message is used to indicate that the application process is denied file access or file editing in the kernel state.

5. The method according to claim 4, characterized in that A read / write behavior detection driver is deployed on the blocking process, and the read / write behavior detection driver is used to provide feedback information of the processing request information to the application process; When the security label of the application process is a threat label, the blocking process indicates the second call error information of the file read / write system call to the application process in response to the processing request information, including: In a case where the security label of the application process is a threat label, in response to the processing request information, the read / write behavior detection driver skips executing the file read / write system call and obtains the second call error information of the file read / write system call; The blocking process indicates the second call error information of the file read and write system call to the application process.

6. The method according to any one of claims 1 to 5, characterized in that: The computer device runs a detection process in the kernel state; the blocking process obtains the security label of the application process, including: The blocking process obtains a security label provided by the detection process, where the security label is obtained by the detection process through detection of the application process.

7. The method according to claim 6, characterized in that The method further comprises: The detection process compares the historical behavior of the application process with a malicious behavior feature library to obtain a security label of the application process; The security label of the application process is a threat label for indicating that the historical behavior of the application process is the same as at least one known malicious feature in the malicious behavior feature library.

8. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: The blocking process obtains a correction label of the application process, where the correction label is used to indicate that the security label of the application process is updated from the threat label to a trust label; The blocking process indicates, in response to the processing request information, call execution information of the system call to the application process, where the call execution information carries an execution result of the system call in the kernel state.

9. The method according to claim 8, characterized in that The blocking process indicates, in response to the processing request information, the call execution information of the system call to the application process, including: In response to the processing request information, the detection driver deployed on the blocking process instructs execution of the system call to obtain an execution result of the system call for the kernel state; The blocking process sends the call execution information carrying the execution result to the application process.

10. The method according to claim 9, characterized in that The detection driver deployed on the blocking process is associated with the system call in a hook manner; In response to the processing request information, the detection driver deployed on the blocking process instructs execution of the system call, and obtains the execution result of the system call for the kernel state, including: In response to the processing request information, the detection driver is associated with the system call in a hook manner; Execute the system call corresponding to the processing request information to obtain the execution result of the system call.

11. The method according to any one of claims 1 to 5, characterized in that: A detection driver is deployed on the blocking process; the method further includes: The detection driver is loaded on the blocking process, and the detection driver is used to provide feedback information of the processing request information to the application process.

12. A process management device, characterized in that: The process management device includes a kernel state module and a user state module, the user state module includes an application process module, and the kernel state module includes a blocking process module; The blocking process module is used to obtain a security label of the application process, where the security label is used to indicate whether the application process has a security threat of invading the computer device; The blocking process module is further used to obtain processing request information of the application process for the kernel state, wherein the processing request information is request information of the application process for the system call of the kernel state; The blocking process module is further configured to, when the security label of the application process is a threat label, respond to the processing request information and indicate to the application process call error information corresponding to the system call.

13. A computer device, characterized in that: The computer device includes: a processor and a memory, wherein the memory stores at least one program; the processor is used to execute the at least one program in the memory to implement the process management method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The readable storage medium stores executable instructions, and the executable instructions are loaded and executed by a processor to implement the process management method as described in any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium. The processor reads and executes the computer instructions from the computer-readable storage medium to implement the process management method as described in any one of claims 1 to 11.

Images