A method, system and medium for identifying the behavior of an application process operating multiple files with the same name

Abstract

The application discloses a behavior identification method and system for application process operation of multiple same-name files and a medium, mainly relates to the technical field of behavior identification, and is used to solve the problem that if two or more same-name files are opened by an application process at the same time, it is unable to distinguish which file is the real corresponding file of the window. It comprises the following steps: matching the window title with the file title in the file path of the file A being opened; when the matching is successful, determining whether the file A is the last opened file of the application process according to the last opening time of the file A; when the file A is the last opened file, binding the window handle information of the current tab window to the file cache of the file A; when switching the tab window between the same-name files, triggering the matching of the file with the window title and the window handle information of the tab window; when the matching is successful, determining that the file is the corresponding file of the current tab window; otherwise, the file is not the corresponding file.

Description

Technical Field

[0001] The present application relates to the field of behavior recognition technology, and in particular to a method, system, and medium for identifying the behavior of an application process operating multiple files with the same name. Background Art

[0002] According to project requirements, it is necessary to accurately identify the operating behavior of the application process after opening multiple files with the same name at the same time, and accurately identify the correspondence between the currently displayed window and the currently opened file.

[0003] Prior art uses the Windows window enumeration mechanism to enumerate the windows currently being operated by the user. The title feature value corresponding to the window is then matched with the file cache information tracked by the driver to identify the file being operated by the user. The main operation is to continuously search for windows and then match the file name with the window title. If a match is successful, the file being operated by the user is considered to have been identified.

[0004] Existing techniques for identifying file operations rely solely on matching the file name with the title to identify the file currently being operated on. While this approach works in some scenarios, it has certain limitations. For example, if an application simultaneously opens two or more files with the same name, matching only by title could result in all of them being matched to the currently active window, making it impossible to distinguish which file is the one that actually corresponds to that window. Summary of the Invention

[0005] The present application provides a method, system and medium for identifying the behavior of an application process operating multiple files with the same name, so as to solve the problem in existing solutions that if an application process opens two or more files with the same name at the same time, it is impossible to distinguish which file is the file that this window actually corresponds to.

[0006] In a first aspect, the present application provides a method for identifying the behavior of an application process operating multiple files with the same name, the method comprising:

[0007] S1. Configuring an XML configuration file for an application process, wherein the XML configuration file includes window class information for tracking window handles and matching rules for temporary files of the application process;

[0008] S2. When monitoring an application process to open file A, determine whether file A is a temporary file based on the temporary file matching rules in the XML configuration file; if file A is not a temporary file, record the last opening time and file path of file A;

[0009] S3. During the opening of file A, based on the window class information, track the tab window being opened and displayed by the application process, and record the window title and window handle information of the current tab window;

[0010] S4. Match the window title with the file title in the file path of the file A being opened; if the match is successful, determine whether file A is the last file opened by the application process based on the last open time of file A; if it is the last file opened, bind the window handle information of the current tab window to the file cache of file A;

[0011] S5. When the tab window of file A triggers recognition, the file A corresponding to the current tab window is determined from several cached files with the same name based on the binding relationship between the window handle information and file A.

[0012] S6. When opening file B with the same name as file A, bind file B to the window handle information of the corresponding tab window according to the method of S2-S4;

[0013] S7. When switching between tab windows of files with the same name, a match is triggered between the window title and window handle information of the file and the tab window; if the match succeeds, the file is determined to be the corresponding file of the current tab window; otherwise, the file is not the corresponding file;

[0014] S8. Track the closing action of the tab window, and when it is determined that the tab window is closed, unbind the closed tab window from the corresponding file.

[0015] In one implementation of the present application, monitoring that an application process opens file A specifically includes:

[0016] Track the opening behavior of file A through the file filter driver.

[0017] In one implementation of the present application, tracking the tab windows that are being opened and displayed by the application process specifically includes:

[0018] Track the tab windows that are being opened and displayed by the application process by enumerating windows or event hooks.

[0019] In one implementation of the present application, based on the binding relationship between the window handle information and the file A, the file A corresponding to the current tab window is determined from a number of cached files with the same name, specifically including:

[0020] According to whether the window handle information of the current tab window exists in the file cache of each file with the same name, the file A corresponding to the current tab window is determined from the cached files with the same name.

[0021] In one implementation of the present application, the matching of the window title and window handle information of the file and the tab window specifically includes:

[0022] Read the file header.

[0023] When the file title is consistent with the window title, read the window handle information in the file cache corresponding to the file;

[0024] When the window handle information in the file cache is consistent with the window handle information of the tab window, it is determined that the window title and window handle information of the file and tab window match;

[0025] Otherwise, the window title and window handle information of the file and the tab window do not match.

[0026] In one implementation of the present application, tracking the closing action of a tab window specifically includes:

[0027] Use the message hook method to track and determine whether the tab window has exited based on the window message characteristics when the tab window exits.

[0028] In one implementation of the present application, after tracking the closing action of the tab window and, upon determining that the tab window is closed, unbinding the closed tab window from the corresponding file, the method further includes:

[0029] When a file with the same name is closed and then opened again, the window handle information is re-bound according to the method of S2-S4.

[0030] In a second aspect, the present application provides a behavior recognition system for an application process operating multiple files with the same name, the system comprising:

[0031] A configuration module, configured to configure an XML configuration file of an application process, wherein the XML configuration file includes window class information for tracking window handles and matching rules for temporary files of the application process;

[0032] The binding module is used to determine whether file A is a temporary file based on the temporary file matching rules in the XML configuration file when monitoring the application process to open file A; if file A is not a temporary file, record the last opening time and file path of file A; during the opening process of file A, track the tab window being opened and displayed by the application process based on the window class information, and record the window title and window handle information of the current tab window; match the window title with the file title in the file path of the file A being opened; if the match is successful, determine whether file A is the last file opened by the application process based on the last opening time of file A; if it is the last file opened, bind the window handle information of the current tab window to the file cache of file A;

[0033] The recognition module is used to determine the file A corresponding to the current tab window from several cached files with the same name based on the binding relationship between the window handle information and the file A when the tab window of the file A triggers recognition;

[0034] The binding module is also used to bind file B to the window handle information of the corresponding tab window according to the method of S2-S4 when opening file B with the same name as file A;

[0035] The switching module is used to trigger the matching of the window title and window handle information of the file and the tab window when switching between tab windows with the same name; when the match is successful, it is determined that the file is the corresponding file of the current tab window; otherwise, it is not the corresponding file;

[0036] The release module is used to track the closing action of the tab window, and when it is determined that the tab window is closed, release the binding between the closed tab window and the corresponding file.

[0037] In one implementation of the present application, the identification module includes an identification unit,

[0038] It is used to determine the file A corresponding to the current tab window from the cached files with the same name according to whether the window handle information of the current tab window exists in the file cache of each file with the same name.

[0039] In a third aspect, the present application provides a non-volatile computer storage medium having computer instructions stored thereon, which, when executed, implements a behavior recognition method for an application process operating multiple files with the same name as any of the above items.

[0040] It can be seen from the above technical solutions that this application has the following advantages:

[0041] 1. "Same-name file operation behavior recognition" behavior recognition technology. When the file cache information is not bound to the window handle, the current file being operated is identified by the last time the file was opened and bound to the window handle found. After the file cache information is bound to the window handle, the file currently being operated by the user is identified by accurately matching the window title and window handle.

[0042] 2. Recognition of tab window exit actions uses, but is not limited to, message hooking. This releases the bound window handle when a file is closed, allowing the identification of files with the same name to continue when the file is reopened. As long as the application process persists, identification of file operations with the same name is a continuous process, ensuring consistent accuracy.

[0043] Compared with existing systems, the advantage of this application is that it can identify the file that the user is currently operating through the precise matching of two elements: the window title and the window handle. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for the description. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 This is a flow chart of a behavior identification method for an application process operating multiple files with the same name provided in an embodiment of the present application.

[0046] Figure 2 This is a schematic diagram of the internal structure of a behavior recognition system for an application process operating multiple files with the same name, provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0048] It should be understood by those skilled in the art that the embodiments described below are merely preferred embodiments of the present disclosure and do not imply that the present disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely intended to explain the technical principles of the present disclosure and are not intended to limit the scope of protection of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of the present disclosure.

[0049] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0050] The present application proposes a method, system and medium for identifying the behavior of an application process operating multiple files with the same name. It is able to identify which file the current user is operating (currently displayed), that is, accurately identify the correspondence between the currently displayed tab window and the file cache information. Even if there are multiple files with the same name opened by the same application process at the same time, the file currently being operated (currently displayed) by the current user can be accurately identified in the application process. The present application focuses on the following contents: when the file cache information is not bound to the window handle, the file currently being operated is identified by the last opening time of the file and bound to the currently operated window handle found; after the file cache information is bound to the window handle, the file currently being operated by the user is identified by the precise matching of the two elements, the window title and the window handle.

[0051] The technical solutions proposed in the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0052] The embodiment provides a method for identifying the behavior of an application process operating multiple files with the same name. Figure 1 As shown, the method provided in the embodiment of the present application mainly includes the following steps:

[0053] Step S1: Configure the XML configuration file of the application process.

[0054] The XML configuration file includes window class information for tracking window handles and matching rules for temporary files of application processes.

[0055] It's important to note that the XML configuration file primarily includes process characteristic information corresponding to various application processes. This includes regular expression matching rules for the application process's process path, window class regular expression matching rules for key characteristics such as the main window class and the window class of tab windows, and matching rules for the title bar information corresponding to these window classes. It also includes regular expression matching rules for temporary files used by application processes during file operations. The purpose of the XML configuration file is to match the characteristics of various application processes, facilitate locating their window information, assist in identifying application process behavior, and filter out unnecessary files. The XML configuration file includes matching rules for temporary files specific to each application process, as well as general rules for temporary files used by various application processes; this facilitates identifying application process behavior. While window class information corresponds to tab windows, window handle information is unique when creating a tab window.

[0056] Step S2: When monitoring an application process to open file A, determine whether file A is a temporary file through the temporary file matching rules in the XML configuration file; if file A is not a temporary file, record the last opening time and file path of file A.

[0057] It should be noted that the monitoring of the application process opening file A includes:

[0058] Track the opening behavior of file A through the file filter driver.

[0059] The purpose of this application recording the last opening time of file A is to determine which file is the valid file last opened by the process.

[0060] Step S3: During the opening process of file A, the tab window being opened and displayed by the application process is tracked according to the window class information, and the window title and window handle information of the current tab window are recorded.

[0061] Among them, tracking the tab windows that are being opened and displayed by the application process includes:

[0062] Track the tab windows that are being opened and displayed by the application process by enumerating windows or event hooks.

[0063] It should be noted that the tracking method includes but is not limited to enumerating windows and event hooks.

[0064] Step S4: Match the window title with the file title in the file path of the file A being opened; if the match is successful, determine whether file A is the last file opened by the application process based on the last opening time of file A; if it is the last file opened, bind the window handle information of the current tab window to the file cache of file A.

[0065] Based on the above description, this step establishes a reliable mapping relationship between file system operations and user interfaces. By intelligently matching the window title with the file title, the system can accurately identify the corresponding file for the current operation, effectively avoiding the risk of misoperation due to duplicate file names. The introduction of the timestamp verification mechanism further enhances the accuracy of recognition, ensuring that the system can determine the latest status of the file based on the time dimension. The design of the window handle binding mechanism implements lightweight resource association, which not only meets the needs of fast switching, but also does not affect system performance. The entire solution improves work efficiency and accuracy in multi-file operation scenarios while maintaining a low implementation complexity.

[0066] Step S5: When the tab window of file A triggers recognition, the file A corresponding to the current tab window is determined from several cached files with the same name according to the binding relationship between the window handle information and file A.

[0067] Here, according to the binding relationship between the window handle information and the file A, the file A corresponding to the current tab window is determined from several cached files with the same name, specifically including:

[0068] According to whether the window handle information of the current tab window exists in the file cache of each file with the same name, the file A corresponding to the current tab window is determined from the cached files with the same name.

[0069] Based on the above description, the window handle in this step serves as a unique identifier assigned by the operating system, ensuring the reliability of the binding relationship. Even when the file names are exactly the same, the file instance corresponding to a specific window can be accurately tracked. Secondly, the design of the cache mechanism optimizes query efficiency. The system only needs to check whether the current window handle information is contained in each file cache to quickly locate the target file, avoiding the performance loss caused by a full scan. Furthermore, this binding relationship is dynamically maintained and can reflect the latest association status between the window and the file in real time, ensuring continuous accuracy in multiple rounds of editing operations.

[0070] Step S6: When opening file B with the same name as file A, bind file B to the window handle information of the corresponding tab window according to the method of S2-S4.

[0071] Step S7: When switching tab windows between files with the same name, a match is triggered between the window title and window handle information of the file and the tab window; when the match is successful, the file is determined to be the corresponding file of the current tab window; otherwise, it is not a corresponding file.

[0072] The matching of the window title and window handle information between the file and the tab window includes:

[0073] Read the file header.

[0074] When the file title is consistent with the window title, read the window handle information in the file cache corresponding to the file;

[0075] When the window handle information in the file cache is consistent with the window handle information of the tab window, it is determined that the window title and window handle information of the file and tab window match;

[0076] Otherwise, the window title and window handle information of the file and the tab window do not match.

[0077] It's important to note that files A and B with the same name are both open at this point. Switching tabs also triggers a match between the file and window information (window handle information). Because the file is bound to the window handle from S2 to S4, the uniqueness of the file to the tab window is confirmed. At this point, a match is made based on the window title and window handle information: the window title is matched against the file name, and the window handle information is matched against the handle information bound to the file name. If both match successfully, the file is confirmed to be the file currently being operated on (currently displayed).

[0078] Based on the above description, this step establishes a reliable mapping relationship between files and windows. When the user switches tab windows between files with the same name, the system triggers a matching process: first, the window title is compared with the file title for consistency, which is the first level of screening; then the window handle information is verified to see if it matches the record in the file cache, which is the second level of confirmation. This layered verification design ensures both the accuracy of identification and system performance. From a technical implementation perspective, this solution has three advantages: first, the window handle natively assigned by the operating system is used as the unique identifier to ensure the reliability of binding; second, the query efficiency is optimized through a caching mechanism to avoid frequent access to the file system; and third, the matching process is entirely based on existing system information and does not require additional storage overhead or complex calculation logic.

[0079] Step S8: Track the closing action of the tab window, and when it is determined that the tab window is closed, unbind the closed tab window from the corresponding file.

[0080] Track the closing action of the tab window, including:

[0081] Use the message hook method to track and determine whether the tab window has exited based on the window message characteristics when the tab window exits.

[0082] It should be noted that this includes but is not limited to using a message hook to track the closing (exit) action of the tab window.

[0083] After tracking the closing action of the tab window and unbinding the closed tab window from the corresponding file when determining that the tab window is closed, the method further includes:

[0084] When a file with the same name is closed and then opened again, the window handle information is re-bound according to the method of S2-S4.

[0085] It should be noted that after receiving the notification when the tab window is closed, the window handle of the tab window and the file are unbound, and the file cache originally bound to the handle becomes file cache information without a corresponding handle; when the file with the same name is opened again after being closed, because the window handle binding information of the file has been unbound, it is now necessary to rebind the window handle according to steps 2 to 4; because other opened files with the same name are bound to the window handle information, the window handle corresponding to the newly opened file will not be the same as these window handle information, thereby realizing the distinction between tab windows after the files with the same name are opened.

[0086] Based on the above description, this embodiment uses an XML configuration file to configure the window feature information, temporary file information, etc. of various application processes; the file filter driver tracks the file opening action and records the corresponding cache information; and uses the window enumeration or event hook method to find the currently operating window. The window title and window handle information are matched with the file name, the last opening time, and the handle to which the file has been bound in the file cache information. The key to this method is to use the window handle information to uniquely determine the correspondence between the file currently operated by the user and the currently operated window, eliminating the interference caused by files with the same file name, thereby determining and identifying the user's operation behavior on the current file.

[0087] In addition, this application Figure 2 The embodiment of the present application provides a behavior recognition system for an application process operating multiple files with the same name. Figure 2 As shown, the system provided in the embodiment of the present application mainly includes:

[0088] Configuration module 210, configured to configure an XML configuration file of the application process, wherein the XML configuration file includes window class information for tracking window handles and matching rules for temporary files of the application process;

[0089] Binding module 220 is used to, when monitoring an application process opening file A, determine whether file A is a temporary file based on the temporary file matching rules in the XML configuration file; if file A is not a temporary file, record the last opening time and file path of file A; during the opening of file A, track the tab window being opened and displayed by the application process based on the window class information, record the window title and window handle information of the current tab window; match the window title with the file title in the file path of the file A being opened; if the match is successful, determine whether file A is the last file opened by the application process based on the last opening time of file A; if it is the last file opened, bind the window handle information of the current tab window to the file cache of file A;

[0090] Those skilled in the art will understand that, firstly, at the technical implementation level, using a file filter driver for monitoring ensures that actual file opening behavior is captured, avoiding the problem that traditional API monitoring may miss underlying operations. At the same time, the temporary file matching rules configured in XML enable the system to distinguish between actual working files and temporary exchange files, reducing misjudgments. Secondly, at the functional design level, the mechanism for recording the last open time provides a reliable timestamp basis for identifying files with the same name. This time series-based judgment logic is more consistent with the user's actual operation sequence than methods that simply rely on file paths or content hashes. In particular, when processing frequently modified configuration files with the same name, it can accurately track the latest valid file version. Finally, in terms of system performance, pre-filtering temporary files reduces the processing overhead of invalid records, and accurate timestamp records only require minimal storage resources. The entire judgment process does not involve file content scanning, and has minimal impact on system I / O load. This design is particularly suitable for development environments or security audit scenarios that require long-term monitoring of file operations. Its technical advantages are mainly reflected in the balance between monitoring accuracy, system overhead, and practicality.

[0091] Identification module 230, for determining the file A corresponding to the current tab window from a plurality of cached files with the same name based on the binding relationship between the window handle information and the file A when the tab window of the file A triggers identification;

[0092] The identification module 230 includes an identification unit,

[0093] It is used to determine the file A corresponding to the current tab window from the cached files with the same name according to whether the window handle information of the current tab window exists in the file cache of each file with the same name.

[0094] The binding module 220 is further configured to bind the file B to the window handle information of the corresponding tab window according to the method of S2-S4 when opening the file B having the same name as the file A;

[0095] The switching module 240 is used to trigger the matching of the window title and window handle information of the file and the tab window when switching between tab windows with the same name; if the match is successful, the file is determined to be the corresponding file of the current tab window; otherwise, it is not the corresponding file;

[0096] The release module 250 is used to track the closing action of the tab window, and when it is determined that the tab window is closed, release the binding between the closed tab window and the corresponding file.

[0097] In addition, an embodiment of the present application further provides a non-volatile computer storage medium on which executable instructions are stored. When the executable instructions are executed, the above-mentioned behavior identification method of an application process operating multiple files with the same name is implemented.

[0098] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying the behavior of an application process operating multiple files with the same name, characterized in that: The method comprises: S1. Configuring an XML configuration file for an application process, wherein the XML configuration file includes window class information for tracking window handles and matching rules for temporary files of the application process; S2. When monitoring an application process to open file A, determine whether file A is a temporary file based on the temporary file matching rules in the XML configuration file; if file A is not a temporary file, record the last opening time and file path of file A; S3. During the opening of file A, based on the window class information, track the tab window being opened and displayed by the application process, and record the window title and window handle information of the current tab window; S4. Match the window title with the file title in the file path of the file A being opened; if the match is successful, determine whether file A is the last file opened by the application process based on the last open time of file A; if it is the last file opened, bind the window handle information of the current tab window to the file cache of file A; S5. When the tab window of file A triggers recognition, the file A corresponding to the current tab window is determined from several cached files with the same name based on the binding relationship between the window handle information and file A. S6. When opening file B with the same name as file A, bind file B to the window handle information of the corresponding tab window according to the method of S2-S4; S7. When switching between tab windows of files with the same name, a match is triggered between the window title and window handle information of the file and the tab window; if the match succeeds, the file is determined to be the corresponding file of the current tab window; otherwise, the file is not the corresponding file; S8. Track the closing action of the tab window, and when it is determined that the tab window is closed, unbind the closed tab window from the corresponding file.

2. The method for identifying the behavior of an application process operating multiple files with the same name according to claim 1, characterized in that: Monitor the application process opening file A, including: Track the opening behavior of file A through the file filter driver.

3. The method for identifying the behavior of an application process operating multiple files with the same name according to claim 1, characterized in that: Tracks the tabs that are open and displayed by the application process, including: Track the tab windows that are being opened and displayed by the application process by enumerating windows or event hooks.

4. The method for identifying the behavior of an application process operating multiple files with the same name according to claim 1, characterized in that: According to the binding relationship between the window handle information and file A, the file A corresponding to the current tab window is determined from several cached files with the same name, specifically including: According to whether the window handle information of the current tab window exists in the file cache of each file with the same name, the file A corresponding to the current tab window is determined from the cached files with the same name.

5. The method for identifying the behavior of an application process operating multiple files with the same name according to claim 1, characterized in that: Matching of the window title and window handle information between the file and the tab window, including: Read the file header. When the file title is consistent with the window title, read the window handle information in the file cache corresponding to the file; When the window handle information in the file cache is consistent with the window handle information of the tab window, it is determined that the window title and window handle information of the file and tab window match; Otherwise, the window title and window handle information of the file and the tab window do not match.

6. The method for identifying the behavior of an application process operating multiple files with the same name according to claim 1, characterized in that: Track the closing action of the tab window, including: Use the message hook method to track and determine whether the tab window has exited based on the window message characteristics when the tab window exits.

7. The method for identifying the behavior of an application process operating multiple files with the same name according to claim 1, characterized in that: After tracking the closing action of the tab window and unbinding the closed tab window from the corresponding file when determining that the tab window is closed, the method further includes: When a file with the same name is closed and then opened again, the window handle information is re-bound according to the method of S2-S4.

8. A behavior recognition system for an application process operating multiple files with the same name, characterized in that: The system comprises: A configuration module, configured to configure an XML configuration file of an application process, wherein the XML configuration file includes window class information for tracking window handles and matching rules for temporary files of the application process; The binding module is used to determine whether file A is a temporary file based on the temporary file matching rules in the XML configuration file when monitoring the application process to open file A; if file A is not a temporary file, record the last opening time and file path of file A; during the opening process of file A, track the tab window being opened and displayed by the application process based on the window class information, and record the window title and window handle information of the current tab window; match the window title with the file title in the file path of the file A being opened; if the match is successful, determine whether file A is the last file opened by the application process based on the last opening time of file A; if it is the last file opened, bind the window handle information of the current tab window to the file cache of file A; The recognition module is used to determine the file A corresponding to the current tab window from several cached files with the same name based on the binding relationship between the window handle information and the file A when the tab window of the file A triggers recognition; The binding module is also used to bind file B to the window handle information of the corresponding tab window according to the method of S2-S4 when opening file B with the same name as file A; The switching module is used to trigger the matching of the window title and window handle information of the file and the tab window when switching between tab windows with the same name; when the match is successful, it is determined that the file is the corresponding file of the current tab window; otherwise, it is not the corresponding file; The release module is used to track the closing action of the tab window, and when it is determined that the tab window is closed, release the binding between the closed tab window and the corresponding file.

9. The behavior recognition system for an application process operating multiple files with the same name according to claim 8, characterized in that: The recognition module includes a recognition unit, It is used to determine the file A corresponding to the current tab window from the cached files with the same name according to whether the window handle information of the current tab window exists in the file cache of each file with the same name.

10. A non-volatile computer storage medium, characterized in that Computer instructions are stored thereon, and when the computer instructions are executed, the method for identifying the behavior of an application process operating multiple files with the same name as described in any one of claims 1 to 7 is implemented.

Images