File operation behavior monitoring method and device, equipment and storage medium

Abstract

The invention discloses a file operation behavior monitoring method and device, equipment and a storage medium, and relates to the technical field of computer software, and the method comprises the steps: determining a target file operation initiated by an application program for a target file, and determining a target process corresponding to the target file operation; generating a first target notification event corresponding to the target process through a virtual file system layer of a kernel space; generating target operation information corresponding to the target file operation based on the first target notification event, and generating a target virus analysis result of the target file operation based on the target operation information; and controlling the execution of the target file operation based on the target virus analysis result through the virtual file system layer of the kernel space. It can be seen from the above that management and control can be intervened in real time in the file operation process, execution and diffusion of virus files are effectively avoided, the timeliness of virus discovery and disposal is remarkably improved, and system resource occupation is reduced.

Description

Technical Field

[0001] This invention relates to the field of computer software technology, and in particular to a method, apparatus, device, and storage medium for monitoring file operation behavior. Background Technology

[0002] Virus scanning is a common application requirement for detecting computer viruses. Currently, it primarily involves scanning files to identify virus characteristics, employing techniques such as signature-based methods and heuristic scanning for virus identification. Signature-based methods achieve accurate detection by comparing signature strings in a virus database. Its core component, the scanning engine, includes automated malware handling mechanisms and localized virus signatures, requiring a balance between terminal resource consumption and detection capabilities. Early virus scanning technology focused primarily on signature-based detection, later developing spectral signature-based detection to address variant viruses, and gradually incorporating heuristic scanning commands to analyze behavior.

[0003] However, existing technologies still have significant shortcomings: virus identification relies on known virus characteristics, which is obviously reactive and lacks flexibility when facing new viruses or malicious risks, making dynamic identification difficult; during the scanning process, feature comparison of the entire directory or disk files is required, which consumes a lot of CPU resources, especially when processing large files, which can easily cause system lag and affect normal user use; and traditional scanning can only detect and deal with viruses during detection, by which time the virus has often already started spreading, making it impossible to stop the spread in time, resulting in a prominent problem of delayed execution.

[0004] In conclusion, improving the flexibility and timeliness of file virus scanning is a pressing technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for monitoring file operation behavior, which can improve the flexibility and timeliness of file virus scanning and optimize protection performance. The specific solution is as follows:

[0006] Firstly, this application provides a method for monitoring file operation behavior, including:

[0007] Determine the target file operation initiated by the application on the target file, and determine the target process corresponding to the target file operation;

[0008] The first target notification event corresponding to the target process is generated through the virtual file system layer in the kernel space;

[0009] Based on the first target notification event, target operation information corresponding to the target file operation is generated, and based on the target operation information, target virus analysis results of the target file operation are generated;

[0010] The execution of target file operations is controlled based on the target virus analysis results through the virtual file system layer in the kernel space.

[0011] Optionally, before generating the first target notification event corresponding to the target process through the virtual file system layer in kernel space, the method further includes:

[0012] A target notify is pre-configured in the virtual file system layer of the kernel space so as to generate the first target notification event corresponding to the target process through the target notify in the virtual file system layer of the kernel space;

[0013] The target notifier is a notifier determined based on the Fanotify mechanism.

[0014] Optionally, generating the first target notification event corresponding to the target process through the target notifier of the virtual file system layer in the kernel space includes:

[0015] The target process is obtained through the virtual file system layer in the kernel space, and the target file operation and the target file corresponding to the target file operation are determined based on the target process, as well as the change information of the target file system corresponding to the target file are determined.

[0016] Using the target notify, the first target notification event corresponding to the target process is generated based on the target file operations and the change information of the target file system.

[0017] Optionally, generating the target operation information corresponding to the target file operation based on the first target notification event includes:

[0018] The first target notification event is obtained through the file behavior monitoring engine of the target file system corresponding to the target file, and the operation time and operation behavior corresponding to the target file operation, as well as the file content corresponding to the target file, are determined by the file behavior monitoring engine based on the first target notification event.

[0019] The file behavior monitoring engine generates and records target operation information corresponding to the target file operation based on the operation time, the operation behavior, and the file content, and generates a virus analysis thread corresponding to the target operation information.

[0020] The target operation information is transmitted to the virus analysis engine through the virus analysis thread, so that the virus analysis engine can generate the target virus analysis result corresponding to the target file operation based on the target operation information.

[0021] Optionally, the step of using the virus analysis engine to generate the target virus analysis result corresponding to the target file operation based on the target operation information includes:

[0022] Using the virus analysis engine, the file type corresponding to the file content in the target operation information is identified, and the file content is fragmented to obtain several file content fragments;

[0023] Using the virus analysis engine, virus analysis is performed on each file content fragment based on the file type, and initial virus analysis results are generated for each file content fragment. The initial virus analysis results are then organized to generate the target virus analysis results corresponding to the target file operation.

[0024] Optionally, before controlling the execution of target file operations based on the target virus analysis results through the virtual file system layer in the kernel space, the method further includes:

[0025] The virus analysis engine sends the analysis results of the target virus to the file behavior monitoring engine, and the file behavior monitoring engine generates execution control instructions corresponding to the operation of the target file; the execution control instructions are to allow or block.

[0026] The file behavior monitoring engine is used to send the execution control instructions to the virtual file system layer in the kernel space, so that the execution of the target file operation can be controlled by the virtual file system layer in the kernel space based on the execution control instructions.

[0027] Optionally, controlling the execution of the target file operations based on the execution control instructions through the virtual file system layer in the kernel space includes:

[0028] The second target notification event corresponding to the execution control instruction is generated by the target notifier of the virtual file system layer in the kernel space, and the second target notification event is sent to the file access interface corresponding to the target file through the virtual file system layer in the kernel space.

[0029] Using the file access interface, the execution of the target file operation is controlled based on the second target notification event.

[0030] Secondly, this application provides a monitoring device for file operation behavior, comprising:

[0031] The target process determination module is used to determine the target file operation initiated by the application on the target file, and to determine the target process corresponding to the target file operation;

[0032] The first target notification event generation module is used to generate the first target notification event corresponding to the target process through the virtual file system layer in the kernel space;

[0033] The virus analysis result generation module is used to generate target operation information corresponding to the target file operation based on the first target notification event, and to generate the target virus analysis result of the target file operation based on the target operation information;

[0034] The file operation execution control module is used to control the execution of target file operations based on the target virus analysis results through the virtual file system layer in the kernel space.

[0035] Thirdly, this application provides an electronic device, comprising:

[0036] Memory, used to store computer programs;

[0037] A processor is used to execute the computer program to implement the aforementioned method for monitoring file operation behavior.

[0038] Fourthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for monitoring file operation behaviors.

[0039] In this application, the target file operation initiated by the application on the target file and the corresponding target process are first determined. Then, a first target notification event corresponding to the target process is generated through the virtual file system layer in the kernel space. Subsequently, target operation information corresponding to the target file operation is generated based on the first target notification event, and a target virus analysis result for the target file operation is generated based on the target operation information. Finally, the execution of the target file operation is controlled through the virtual file system layer in the kernel space based on the target virus analysis result. As can be seen, this application first determines the target file operation initiated by the application on the target file and the corresponding target process. Then, the first target notification event corresponding to the target process is generated by the virtual file system layer in the kernel space. Subsequently, relevant information about the target file operation is determined based on the first target notification event. Then, a target virus analysis result corresponding to the target file operation is generated based on the target operation information. Finally, the execution of the target file operation is precisely controlled through the virtual file system layer based on the target virus analysis result. In this way, this application achieves closed-loop management of the entire process of file operation from initiation to execution. By leveraging real-time behavior monitoring at the file system level, it overcomes the limitations of traditional technologies that rely on known virus characteristics, significantly improving the flexibility of virus identification. Meanwhile, this application can intervene and control the file operation process in real time, effectively preventing the execution and spread of virus files, significantly improving the timeliness of virus detection and handling, and eliminating the need for a full scan of the entire directory or disk, reducing system resource consumption and ensuring security protection effectiveness. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 A flowchart illustrating a method for monitoring file operation behavior provided in this application;

[0042] Figure 2 A flowchart illustrating a specific method for monitoring file operation behavior provided in this application;

[0043] Figure 3 A schematic diagram of a file operation monitoring device provided in this application;

[0044] Figure 4 This application provides a structural diagram of an electronic device. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] Virus scanning is a common application requirement for detecting computer viruses. Currently, it primarily involves scanning files to identify virus characteristics, employing techniques such as signature-based methods and heuristic scanning for virus identification. Signature-based methods achieve accurate detection by comparing feature strings in a virus database. Its core component, the scanning engine, includes automated malware handling mechanisms and localized virus signatures, requiring a balance between terminal resource consumption and detection capabilities. Early virus scanning technology focused on signature-based detection, later developing spectral signature-based detection to combat variant viruses, and gradually introducing heuristic scanning to analyze command behavior. However, existing technologies still have significant shortcomings: virus identification relies on known virus characteristics, exhibiting a clear reactive nature, lacking flexibility when facing new viruses or malicious risks, and struggling to achieve dynamic identification; the scanning process requires feature comparison of the entire directory or disk files, consuming significant CPU resources, especially when processing large files, easily causing system lag and affecting normal user operation; and traditional scanning can only detect and handle viruses during the detection phase, by which time the virus has often already begun spreading, making it impossible to stop its spread in time, resulting in significant execution lag. Therefore, this application provides a file operation behavior monitoring scheme that can improve the flexibility and timeliness of file virus scanning and optimize protection performance.

[0047] See Figure 1 As shown in the figure, an embodiment of the present invention discloses a method for monitoring file operation behavior, which may include:

[0048] Step S11: Determine the target file operation initiated by the application on the target file, and determine the target process corresponding to the target file operation.

[0049] See Figure 2 Steps in As shown, when an application initiates a target file operation on a target file, the target process corresponding to the target file operation will enter the VFS (Virtual File Systems) layer in the kernel space.

[0050] It should be noted that, in order to improve the flexibility and stability of file monitoring, this embodiment pre-configures a target notifier in the VFS layer of the kernel space based on the Fanotify mechanism, so as to generate the first target notification event corresponding to the target process through the target notifier in the virtual file system layer of the kernel space.

[0051] Step S12: Generate the first target notification event corresponding to the target process through the virtual file system layer in the kernel space.

[0052] In this embodiment, the first target notification event corresponding to the target process is generated by the target notifier of the VFS layer in the kernel space. The specific process may include: firstly, obtaining the target process through the virtual file system layer of the kernel space, and determining the target file operation and the target file corresponding to the target file operation based on the target process, as well as determining the change information of the target file system corresponding to the target file; then, using the target notifier, generating the first target notification event corresponding to the target process based on the target file operation and the change information of the target file system.

[0053] For details, see Figure 2 Steps in As shown, when the target process corresponding to the target file operation enters the VFS layer in the kernel space, it will first determine the target file operation and the corresponding target file before the target process, and then determine the change information of the target file system corresponding to the target file. The target notifier will capture the change information of the target file system and generate the first target notification event corresponding to the target process.

[0054] Step S13: Generate target operation information corresponding to the target file operation based on the first target notification event, and generate target virus analysis results of the target file operation based on the target operation information.

[0055] In this embodiment, the process of generating target operation information corresponding to a target file operation based on a first target notification event can include: firstly, obtaining the first target notification event through a file behavior monitoring engine of the target file system corresponding to the target file, and determining the operation time and operation behavior corresponding to the target file operation, as well as the file content corresponding to the target file, based on the first target notification event; then, generating and recording the target operation information corresponding to the target file operation based on the operation time, operation behavior, and file content through the file behavior monitoring engine, and generating a virus analysis thread corresponding to the target operation information; finally, transmitting the target operation information to the virus analysis engine through the virus analysis thread, so that the virus analysis engine can generate the target virus analysis result corresponding to the target file operation based on the target operation information.

[0056] For details, see Figure 2 Steps in As shown, the file behavior monitoring engine of the file behavior monitoring module obtains the first target notification event generated by the target notifier, and based on the first target notification event, obtains the behavior event of the target file, then determines the operation time and behavior corresponding to the target file operation, as well as the file content corresponding to the target file, thereby obtaining the corresponding target operation information. Simultaneously, the file behavior monitoring engine records the target operation information in the file behavior monitoring module and generates a corresponding virus analysis thread. See below for further details. Figure 2 Steps in As shown, the target operation information is transmitted to the virus analysis module through the virus analysis thread, so that the virus analysis engine can perform a comprehensive analysis of the file content, operation behavior, etc., and generate the target virus analysis results corresponding to the target file operation.

[0057] It should be noted that the specific process of generating target virus analysis results corresponding to target file operations based on target operation information using a virus analysis engine may include: firstly, using the virus analysis engine to identify the file type corresponding to the file content in the target operation information, and segmenting the file content to obtain several file content segments; then, using the virus analysis engine to perform virus analysis on each of the file content segments based on the file type, generating initial virus analysis results corresponding to each of the file content segments, and organizing the initial virus analysis results to generate the target virus analysis results corresponding to the target file operation.

[0058] Specifically, the virus analysis engine first identifies the file type of the file content in the target operation information, then segments the file content, and finally checks whether each file content segment has virus characteristics, thus obtaining the target virus analysis results corresponding to the target file operation.

[0059] Step S14: Control the execution of target file operations based on the target virus analysis results through the virtual file system layer in the kernel space.

[0060] It should be noted that before controlling the execution of target file operations based on the target virus analysis results through the virtual file system layer in the kernel space, the process may further include: firstly, using the virus analysis engine to send the target virus analysis results to the file behavior monitoring engine, and generating execution control instructions corresponding to the target file operations based on the file behavior monitoring engine; the execution control instructions are either allow or block; then, using the file behavior monitoring engine to send the execution control instructions to the virtual file system layer in the kernel space, so that the execution of the target file operations can be controlled through the virtual file system layer in the kernel space based on the execution control instructions.

[0061] For details, see Figure 2 Steps in As shown, the target virus analysis results generated by the virus analysis module are sent to the file behavior monitoring engine of the file behavior monitoring module. Based on the target virus analysis results, the file behavior monitoring engine determines whether to allow or block the target file operation and generates corresponding execution control commands. See also... Figure 2 Steps in As shown, the file behavior monitoring module sends execution control instructions to the target notifier in the VFS layer of the kernel space, so as to control the execution of target file operations based on the execution control instructions.

[0062] In this embodiment, the execution of target file operations is controlled based on execution control instructions through the virtual file system layer in the kernel space. The specific process may include: first, generating a second target notification event corresponding to the execution control instruction through the target notifier in the virtual file system layer in the kernel space, and sending the second target notification event to the file access interface corresponding to the target file through the virtual file system layer in the kernel space; then, using the file access interface, controlling the execution of the target file operations based on the second target notification event.

[0063] Specifically, the target notifier in the VFS layer of kernel space generates a corresponding second target notification event based on the execution control instructions issued by the file behavior monitoring module. See also... Figure 2 Steps in As shown, the second target notification event is then sent via the VFS layer to the return status of the file access interface corresponding to the target file called by the application. Using the file access interface, the execution of target file operations is controlled based on the second target notification event, achieving the effect of file behavior monitoring, virus analysis, and behavior control. In this way, this embodiment employs file system-level behavior detection and analysis capabilities, enabling real-time monitoring of any file access behavior. File analysis scenarios can be categorized as needed, and real-time file scanning and protection capabilities can be achieved through file system event monitoring. Simultaneously, based on file system event behavior capture, different file access behaviors can be controlled, promptly preventing the spread of virus files.

[0064] As can be seen from the above, this embodiment first determines the target file operation initiated by the application on the target file and the target process corresponding to the target file operation; then, it generates a first target notification event corresponding to the target process through the virtual file system layer in the kernel space; subsequently, it generates target operation information corresponding to the target file operation based on the first target notification event, and generates a target virus analysis result for the target file operation based on the target operation information; finally, it controls the execution of the target file operation based on the target virus analysis result through the virtual file system layer in the kernel space. In this way, this embodiment first determines the target file operation initiated by the application on the target file and the corresponding target process, then generates a first target notification event corresponding to the target process through the virtual file system layer in the kernel space, then determines the relevant information of the target file operation based on the first target notification event, then generates a target virus analysis result corresponding to the target file operation based on the target operation information, and finally achieves precise control over the execution of the target file operation based on the target virus analysis result through the virtual file system layer. Thus, this embodiment achieves closed-loop management of the entire process of file operation from initiation to execution, and by relying on real-time behavior monitoring at the file system level, it overcomes the limitations of traditional technologies that rely on known virus characteristics, greatly improving the flexibility of virus identification. Meanwhile, this application can intervene and control the file operation process in real time, effectively preventing the execution and spread of virus files, significantly improving the timeliness of virus detection and handling, and eliminating the need for a full scan of the entire directory or disk, reducing system resource consumption and ensuring security protection effectiveness.

[0065] Accordingly, see Figure 3 As shown in the illustration, this application also provides a file operation behavior monitoring device, which may include:

[0066] The target process determination module 11 is used to determine the target file operation initiated by the application on the target file, and to determine the target process corresponding to the target file operation;

[0067] The first target notification event generation module 12 is used to generate the first target notification event corresponding to the target process through the virtual file system layer in the kernel space;

[0068] The virus analysis result generation module 13 is used to generate target operation information corresponding to the target file operation based on the first target notification event, and generate the target virus analysis result of the target file operation based on the target operation information;

[0069] The file operation execution control module 14 is used to control the execution of the target file operation based on the target virus analysis results through the virtual file system layer in the kernel space.

[0070] In some specific embodiments, the monitoring device for file operation behavior may further include:

[0071] A target notifier configuration module is used to pre-configure a target notifier in the virtual file system layer in the kernel space so as to generate the first target notification event corresponding to the target process through the target notifier in the virtual file system layer in the kernel space; wherein, the target notifier is a notifier determined based on the Fanotify mechanism.

[0072] In some specific embodiments, the target notification configuration module may include:

[0073] The change information determination unit is used to obtain the target process through the virtual file system layer of the kernel space, and determine the target file operation and the target file corresponding to the target file operation based on the target process, and determine the change information of the target file system corresponding to the target file.

[0074] The first target notification event generation unit is used to generate the first target notification event corresponding to the target process based on the target file operation and the change information of the target file system using the target notifier.

[0075] In some specific embodiments, the virus analysis result generation module 13 may include:

[0076] The file content determination submodule is used to obtain the first target notification event through the file behavior monitoring engine of the target file system corresponding to the target file, and to determine the operation time and operation behavior corresponding to the target file operation, as well as the file content corresponding to the target file based on the first target notification event through the file behavior monitoring engine.

[0077] The target operation information generation submodule is used to generate and record the target operation information corresponding to the target file operation based on the operation time, the operation behavior and the file content through the file behavior monitoring engine, and generate the virus analysis thread corresponding to the target operation information;

[0078] The target operation information transmission submodule is used to transmit the target operation information to the virus analysis engine through the virus analysis thread, so that the virus analysis engine can generate the target virus analysis result corresponding to the target file operation based on the target operation information.

[0079] In some specific embodiments, the target operation information transmission submodule may include:

[0080] The file content fragmentation unit is used to use the virus analysis engine to identify the file type corresponding to the file content in the target operation information, and to fragment the file content to obtain several file content fragments.

[0081] The virus analysis result generation unit is used to use the virus analysis engine to perform virus analysis on each file content fragment based on the file type, generate initial virus analysis results corresponding to each file content fragment, and organize each initial virus analysis result to generate the target virus analysis result corresponding to the target file operation.

[0082] In some specific embodiments, the monitoring device for file operation behavior may further include:

[0083] An execution control instruction generation module is used to send the target virus analysis results to the file behavior monitoring engine using the virus analysis engine, and generate execution control instructions corresponding to the target file operation based on the file behavior monitoring engine; the execution control instructions are to allow or block.

[0084] The execution control instruction sending module is used to send the execution control instructions to the virtual file system layer in the kernel space using the file behavior monitoring engine, so as to control the execution of the target file operation based on the execution control instructions through the virtual file system layer in the kernel space.

[0085] In some specific embodiments, the execution control command sending module may include:

[0086] The second target notification event generation unit is used to generate a second target notification event corresponding to the execution control instruction through the target notifier of the virtual file system layer in the kernel space, and send the second target notification event to the file access interface corresponding to the target file through the virtual file system layer in the kernel space.

[0087] The file operation execution control unit is used to control the execution of the target file operation based on the second target notification event using the file access interface.

[0088] Furthermore, embodiments of this application also disclose an electronic device, Figure 4This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the file operation behavior monitoring method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0089] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0090] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0091] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the file operation monitoring method disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0092] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for monitoring file operation behaviors. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0093] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0094] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0095] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0096] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0097] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method of monitoring file operation behavior, the method comprising: The method comprises the following steps: determining a target file operation initiated by an application on a target file, and determining a target process corresponding to the target file operation; generating a first target notification event corresponding to the target process through a virtual file system layer in a kernel space; generating target operation information corresponding to the target file operation based on the first target notification event, and generating a target virus analysis result of the target file operation based on the target operation information; controlling execution of the target file operation based on the target virus analysis result through the virtual file system layer in the kernel space.

2. The method of claim 1, wherein Before the step of generating the first target notification event corresponding to the target process through the virtual file system layer in the kernel space, the method further comprises the following steps: pre-configuring a target notifier in the virtual file system layer in the kernel space, so as to generate the first target notification event corresponding to the target process through the target notifier in the virtual file system layer in the kernel space; wherein the target notifier is a notifier determined based on a Fanotify mechanism.

3. The method of claim 2, wherein the file operation behavior is monitored by: The step of generating the first target notification event corresponding to the target process through the target notifier in the virtual file system layer in the kernel space comprises the following steps: acquiring the target process through the virtual file system layer in the kernel space, and determining the target file operation and the target file corresponding to the target file operation based on the target process, as well as determining change information of a target file system corresponding to the target file; generating the first target notification event corresponding to the target process based on the target file operation and the change information of the target file system by using the target notifier.

4. The method of claim 3, wherein the file operation behavior is monitored by: The step of generating the target operation information corresponding to the target file operation based on the first target notification event comprises the following steps: acquiring the first target notification event through a file behavior monitoring engine of the target file system corresponding to the target file, and determining operation time and operation behavior corresponding to the target file operation, as well as file content corresponding to the target file based on the first target notification event through the file behavior monitoring engine; generating and recording the target operation information corresponding to the target file operation based on the operation time, the operation behavior and the file content through the file behavior monitoring engine, and generating a virus analysis thread corresponding to the target operation information; transmitting the target operation information to a virus analysis engine through the virus analysis thread, so as to generate the target virus analysis result corresponding to the target file operation based on the target operation information by using the virus analysis engine.

5. The method of claim 4, wherein the file operation behavior is monitored by: The step of generating the target virus analysis result corresponding to the target file operation based on the target operation information by using the virus analysis engine comprises the following steps: identifying a file type corresponding to the file content in the target operation information by using the virus analysis engine, and obtaining a plurality of file content fragments by fragmenting the file content; The virus analysis engine is used to perform virus analysis on each file content slice based on the file type, and generate an initial virus analysis result corresponding to each file content slice, and the initial virus analysis results are arranged to generate the target virus analysis result corresponding to the target file operation.

6. The method of claim 4 or 5, wherein, Before the target file operation is controlled to be executed based on the target virus analysis result by the virtual file system layer in the kernel space, the method further includes: The target virus analysis result is sent to the file behavior monitoring engine by the virus analysis engine, and an execution control instruction corresponding to the target file operation is generated based on the file behavior monitoring engine; the execution control instruction is permission or prevention; The execution control instruction is sent to the virtual file system layer in the kernel space by the file behavior monitoring engine, so that the execution of the target file operation is controlled based on the execution control instruction by the virtual file system layer in the kernel space.

7. The method of claim 6, wherein the file operation behavior is monitored by: The execution of the target file operation is controlled based on the execution control instruction by the virtual file system layer in the kernel space, including: A second target notification event corresponding to the execution control instruction is generated by the target notifier of the virtual file system layer in the kernel space, and the second target notification event is sent to a file access interface corresponding to the target file by the virtual file system layer in the kernel space; The execution of the target file operation is controlled based on the second target notification event by the file access interface.

8. A monitoring apparatus of a file operation behavior, characterized by, Including: A target process determination module is configured to determine a target file operation initiated by an application program on a target file, and determine a target process corresponding to the target file operation; A first target notification event generation module is configured to generate a first target notification event corresponding to the target process by a virtual file system layer in a kernel space; A virus analysis result generation module is configured to generate target operation information corresponding to the target file operation based on the first target notification event, and generate a target virus analysis result of the target file operation based on the target operation information; A file operation execution control module is configured to control the execution of the target file operation based on the target virus analysis result by the virtual file system layer in the kernel space.

9. An electronic device, comprising: The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, the computer program is loaded and executed by the processor to realize the file operation behavior monitoring method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is used to save, and the computer program is executed by a processor to realize the file operation behavior monitoring method of any one of claims 1 to 7.

Images