Malicious program detection method and computer equipment

Abstract

The invention provides a malicious program detection method and computer equipment, and relates to the field of computer security. Before the process runs, the computer equipment judges whether the process is triggered by the shortcut or not, and if the process is triggered by the shortcut, whether the process is a malicious process or not is judged according to the process information. The process information comprises dynamic behavior information, and the dynamic behavior information comprises information generated in a creating stage and / or a starting stage of the process. Malicious detection is carried out by using the information dynamically extracted in the creation stage and / or the starting stage of the process, so that an attacker has no opportunity to modify or mix the information, and bypassing of detection can be avoided. The dynamic behavior information is generated in the creating stage and / or the starting stage of the process, so that malicious detection on the process can be completed before the process runs, that is, malicious detection is performed on the shortcut before the shortcut really runs, and the malicious shortcut can be prevented from executing malicious behaviors in time.

Description

Technical Field

[0001] This application relates to the field of computer security, and in particular to a method and computer device for detecting malicious programs. Background Technology

[0002] With the rapid development of information technology, computers, smartphones, and other devices are installing more and more applications and storing more and more files and folders. To facilitate user operation of these devices, shortcuts have emerged. As a special type of command line, shortcuts are typically added to the terminal desktop. When a user clicks a shortcut, they can quickly launch the associated application or open the associated file or folder.

[0003] However, while shortcuts offer convenience to users, they also facilitate attacks on computer devices by hackers. Detecting malicious shortcuts on computer devices is crucial for ensuring their secure operation. Summary of the Invention

[0004] This application provides a method and computer device for detecting malicious programs.

[0005] Firstly, a method for detecting malicious programs is provided. This method includes: before a process runs on a computer device, the computer device determines whether the process was triggered by a shortcut. If the process was triggered by a shortcut, the computer device determines whether the process is malicious based on the process information. The process information includes dynamic behavior information, which includes information generated during the process creation and / or startup phases.

[0006] This application determines whether a process is triggered by a shortcut before it runs, and if so, determines whether the process is malicious based on dynamic behavior information generated during its creation and / or startup phases. Since the process is triggered by a shortcut, performing malicious detection on the process is equivalent to performing malicious detection on the shortcut itself. On one hand, because this application directly utilizes information dynamically extracted during the process's creation and / or startup phases for malicious detection, attackers have no opportunity to modify or obfuscate this information, thus preventing bypassing detection. On the other hand, since the dynamic behavior information used by this application for malicious detection is generated during the process's creation and / or startup phases, malicious detection can be completed before the process runs, which is equivalent to performing malicious detection on the shortcut before it actually runs. If the shortcut is malicious, since it has not yet actually run and malicious behavior has not yet occurred, it can promptly prevent the malicious shortcut from executing malicious behavior, thereby avoiding malicious impact and achieving real-time protection.

[0007] Optionally, the dynamic behavior information of a process includes, but is not limited to, one or more of the following: the path of the shortcut that triggered the process, the command line of the process, the trigger time of the process, the triggering user of the process, the process identifier of the process, the universally unique identifier (UUID) of the process, or the execution permissions of the process.

[0008] Optionally, process information also includes static file information. The static file information of a process includes the process file information corresponding to that process.

[0009] In this application, since process file information is available immediately after process creation, combining dynamic behavior information and static file information to comprehensively determine whether a process is malicious allows for malicious detection of the process before it runs. Furthermore, using more information for malicious process detection improves the reliability of the detection.

[0010] Optionally, the process file information includes, but is not limited to, one or more of the following: process file path, process file size, or process file content.

[0011] Optionally, one implementation of determining whether a process is triggered by a shortcut before it runs on a computer device includes: in response to the computer device creating or starting a process, the computer device obtains the process startup information of that process. The computer device then determines whether the process is triggered by a shortcut based on the process startup information.

[0012] In this application, the computer device obtains process startup information during the process creation stage or the process startup stage, thereby enabling it to determine whether the process was triggered by a shortcut before the process runs based on the process startup information.

[0013] Optionally, one implementation of the computer device obtaining process startup information in response to the computer device creating or starting a process includes: in response to the computer device starting a process, the computer device obtaining the process startup information of the process through the GetStartupInfo() function.

[0014] In this implementation, the computer device obtains process startup information during the process startup phase, enabling it to determine whether the process was triggered by a shortcut before it runs. Furthermore, the mechanism of obtaining process startup information through the GetStartupInfo() function can be used in conjunction with other synchronization blocking mechanisms. This ensures that the process is blocked during the process of the computer device injecting into the process, calling GetStartupInfo() to obtain process startup information, and determining whether the process was triggered by a shortcut. This prevents malicious processes from running and thus avoids malicious behavior if the process is malicious.

[0015] Alternatively, the computer device can hook a process creation function in its operating system via a hook function to monitor whether the computer device is creating a process. Correspondingly, another implementation of the computer device obtaining process startup parameters in response to process creation or startup includes: in response to monitoring process creation, the computer device obtains process startup information from the application programming interface (API) parameters corresponding to the process creation function via a hook function.

[0016] In this implementation, the computer device obtains process startup information during the process creation phase, enabling it to determine whether a process was triggered by a shortcut before it actually starts. Furthermore, this hook function-based mechanism allows for the synchronous blocking of the process, or it can be used in conjunction with other synchronization blocking mechanisms. This ensures that the process is blocked while the computer device is obtaining startup information and determining whether it was triggered by a shortcut. This prevents malicious processes from running and thus avoids malicious behavior if the process is malicious.

[0017] Optionally, if the process is triggered by a shortcut, the computer device obtains the path of the shortcut from the process startup information.

[0018] Alternatively, another implementation of determining whether a process is triggered by a shortcut before it runs on a computer device includes: in response to the computer device starting a process, the computer device obtains window title information based on a process environment block pointing to the process, and determines whether the process is started by a shortcut based on the window title information.

[0019] In this application, the computer device obtains window title information during the process startup phase, thereby enabling it to determine whether the process was triggered by a shortcut before it runs, based on this window title information. Furthermore, this mechanism can be used in conjunction with other synchronization blocking mechanisms, ensuring that the process is blocked during the acquisition of window title information and the determination of whether the process was triggered by a shortcut. This prevents malicious processes from running and thus avoids malicious behavior if the process is malicious.

[0020] Optionally, if the process is triggered by a shortcut, the computer device obtains the path of the shortcut from the window title information.

[0021] Optionally, one implementation of a computer device determining whether a process is malicious based on process information includes: the computer device inputting process information into a machine learning model to obtain the output of the machine learning model, and determining whether the process is malicious based on the output.

[0022] Alternatively, another implementation of the computer device determining whether a process is malicious based on the process information includes: the computer device matching the process information with rules in a signature database and determining whether the process is malicious based on the matching result.

[0023] Optionally, the computer device may terminate the process after determining that it is a malicious process.

[0024] This application, by preventing a malicious process from starting before it does, can avoid the malicious process from performing malicious actions during its execution, thereby preventing malicious impact. If a malicious process has already started running, by preventing it from continuing to run, it can prevent the malicious process from performing further malicious actions during its execution, thereby reducing malicious impact.

[0025] Optionally, after determining that a process is malicious, the computer device may delete or isolate the shortcut that triggered the process and / or the process file corresponding to the process.

[0026] This application identifies shortcuts that trigger malicious processes as malicious shortcuts. By deleting or isolating malicious shortcuts, it can prevent the malicious shortcuts from running again and thus attacking computer devices. And / or, this application identifies the process files corresponding to malicious processes as malicious process files. By deleting or isolating the processes in the malicious process files, it can prevent the malicious processes from being triggered and running again and thus attacking computer devices.

[0027] Optionally, if the process modified the registry during its execution before termination, the computer device restores the registry to its state before the process made the modification. And / or, if the process caused the computer device to communicate with other devices during its execution before termination, the computer device blocks the computer device's network behavior.

[0028] This application addresses the behavior of malicious processes during their execution, thereby reducing the malicious impact of malicious processes on computer devices and preventing them from causing further malicious damage.

[0029] Optionally, after determining that a process is malicious, the computer device outputs an alarm notification. This alarm notification indicates that the computer device has been attacked by a malicious process. The output of the alarm notification includes, but is not limited to, the computer device displaying the alarm notification for user viewing, and / or the computer device sending the alarm notification to a cloud security server for attribution tracing.

[0030] Optionally, the alert may include, but is not limited to, one or more of the following: the process identifier of the malicious process, the shortcut that triggered the malicious process, the target pointed to by the shortcut that triggered the malicious process, the triggering time of the malicious process, or the user who triggered the malicious process.

[0031] Secondly, a malicious program detection device is provided. The device is applied to a computer device. The device includes multiple functional modules that interact to implement the methods described in the first aspect and its various embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of both, and can be arbitrarily combined or divided based on specific implementations.

[0032] Thirdly, a computer device is provided, comprising: a memory, a network interface, and at least one processor. The memory stores program instructions, and the at least one processor, after reading the program instructions stored in the memory, causes the computer device to execute the methods described in the first aspect and its various embodiments.

[0033] For example, after the at least one processor reads the program instructions stored in the memory, it causes the computer device to perform the following operations: before a process on the computer device runs, it determines whether the process is triggered by a shortcut; if the process is triggered by a shortcut, it determines whether the process is a malicious process based on the process information of the process, the process information including dynamic behavior information, the dynamic behavior information including information generated during the creation and / or startup phase of the process.

[0034] Optionally, the dynamic behavior information includes one or more of the following: the shortcut path, the process command line, the process trigger time, the process triggering user, the process identifier, the process UUID, or the process execution permissions.

[0035] Optionally, the process information may further include static file information, which includes the process file information corresponding to the process.

[0036] Optionally, the process file information includes one or more of the following: process file path, process file size, or process file content.

[0037] Optionally, after the program instructions are read by the at least one processor, the computer device causes the following operations: in response to the computer device creating or starting a process, obtaining process startup information of the process; and determining, based on the process startup information, whether the process is triggered by a shortcut.

[0038] Optionally, after the program instructions are read by the at least one processor, the computer device causes the computer device to perform the following operation: in response to the computer device starting a process, obtain the process startup information of the process through the GetStartupInfo() function.

[0039] Optionally, after the program instructions are read by the at least one processor, the computer device causes the following operations: hooking a process creation function in the operating system of the computer device via a hook function to monitor whether the computer device creates a process, the process creation function being used to create a process; in response to monitoring that the computer device is creating a process, obtaining the process startup information from the API parameters corresponding to the process creation function via the hook function.

[0040] Optionally, after the program instructions are read by the at least one processor, the computer device further performs the following operations: if the process is triggered by a shortcut, obtain the path of the shortcut from the process startup information.

[0041] Optionally, after the program instructions are read by the at least one processor, the computer device causes the following operations: in response to the computer device starting a process, obtaining window title information based on a process environment block pointing to the process; and determining, based on the window title information, whether the process was started by a shortcut.

[0042] Optionally, after the program instructions are read by the at least one processor, the computer device further performs the following operations: if the process is triggered by a shortcut, obtain the path of the shortcut from the window title information.

[0043] Optionally, after the program instructions are read by the at least one processor, the computer device causes the following operations: inputting the process information into a machine learning model to obtain the output of the machine learning model, and determining whether the process is a malicious process based on the output.

[0044] Optionally, after the program instructions are read by the at least one processor, the computer device performs the following operations: matching the process information with rules in a feature library, and determining whether the process is a malicious process based on the matching result.

[0045] Optionally, after the program instructions are read by the at least one processor, the computer device further performs the following operation: after determining that the process is a malicious process, terminates the process.

[0046] Optionally, after the program instructions are read by the at least one processor, the computer device further performs the following operations: after determining that the process is a malicious process, deletes or isolates the shortcut and / or the process file corresponding to the process.

[0047] Optionally, after the program instructions are read by the at least one processor, the computer device further performs the following operations: if the process modifies the registry during its operation before termination, the registry is restored to its state before the process modification; and / or, if the process causes the computer device to communicate with other devices during its operation before termination, the network behavior of the computer device is prohibited.

[0048] Optionally, after the program instructions are read by the at least one processor, the computer device further performs the following operations: after determining that the process is a malicious process, outputs an alarm message, the alarm message indicating that the computer device is under attack by a malicious process.

[0049] Optionally, the alarm notification includes one or more of the following: the process identifier of the malicious process, the shortcut that triggered the malicious process, the target pointed to by the shortcut that triggered the malicious process, the triggering time of the malicious process, or the triggering user of the malicious process.

[0050] Fourthly, a computer-readable storage medium is provided, on which instructions are stored, which, when executed by a processor, implement the methods described in the first aspect and its various embodiments.

[0051] Fifthly, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the methods described in the first aspect and its various embodiments.

[0052] In a sixth aspect, a chip is provided, the chip including programmable logic circuitry and / or program instructions, which, when the chip is running, implement the methods described in the first aspect and its various embodiments. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of an implementation scenario provided in an embodiment of this application;

[0054] Figure 2 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application;

[0055] Figure 3 This is a flowchart illustrating a malicious program detection method provided in an embodiment of this application;

[0056] Figure 4 This is a schematic diagram of the structure of a malicious program detection device provided in an embodiment of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0058] To facilitate readers' understanding of the proposed solution, some terms used in this application will be explained below.

[0059] 1. Shortcuts and their paths

[0060] A shortcut is a executable file provided by the operating system for quickly launching applications, opening files, or folders. Shortcuts have some basic attributes, such as file type, starting location, size, and target. The target can point to an executable file; when a user double-clicks the shortcut, the executable file pointed to by the target is executed. Essentially, a shortcut is a link to a specific file, folder, or application, allowing the user to directly access the target file, folder, or application without knowing its full file path. When a user launches a program via a shortcut, the operating system recognizes the shortcut and loads the actual file or program it points to into memory to run, thus launching the program. This process involves the coordination of the operating system's file management system and process manager to ensure that the shortcut correctly triggers the program's launch.

[0061] Taking the Windows operating system as an example, a shortcut can be referred to as an lnk file. In this application, the path of the shortcut refers to the storage path of the lnk file, hereinafter referred to as the lnk file path. For example, if a shortcut—aaa.docx.lnk—is created on the desktop for the Word document aaa.docx, then the path of this shortcut refers to the storage path of aaa.docx.lnk, such as C:\Users\Public\Desktop\aaa.docx.lnk.

[0062] 2. Process, process file, and process file path

[0063] Shortcuts launch programs by running processes. For example, double-clicking the shortcut aaa.docx.lnk on the desktop will launch the Office process to open the Word document aaa.docx. A process file is an executable file. Process files in computer devices are usually located on the hard drive. A process file contains an executable program; loading the executable program from the process file into memory and running it is called running the process. A process is the manifestation of the executable program in the process file after it has run. In this application, the process file path refers to the storage path of the process file. For example, the path of the Office process file used to open the Word document can be represented as C:\Program Files\Microsoft Office\OFFICE11\WinWord.exe.

[0064] 3. Process Management

[0065] Process management includes three stages: process creation, process startup, and process execution.

[0066] Process creation refers to allocating necessary resources, such as memory space, register state, and program counter, to a new process, and establishing the process's basic data structures and control information. When creating a process, the operating system assigns it a unique process identifier (PID) and sets its initial state and attributes. The process creation phase focuses more on preparing for the process's emergence, including loading program code and setting environment variables. In Windows operating systems, the most common way to create a process is using the `CreateProcess` function provided by the Windows API. The basic steps of using the `CreateProcess` function include initializing the `STARTUPINFO` and `PROCESS_INFORMATION` structures, calling the `CreateProcess` function, waiting for the process to terminate after creation, and finally closing the relevant handles.

[0067] Process startup occurs after a process is created. It transitions the process from its initial state to the ready state, making it eligible for scheduling and execution. During startup, the operating system performs preparatory tasks such as setting the process's context, including register values ​​and setting the program counter to point to the process's entry point. Startup also involves placing the process in the ready queue, waiting for the operating system's scheduler to allocate a time slice to it within the central processing unit (CPU).

[0068] Process execution occurs after a process starts. When the operating system's scheduler selects a ready process and allocates the CPU to it, the process enters the running state. In the running state, the process's instructions are executed by the CPU, and the process can perform calculations, access memory, perform input / output operations, etc. During execution, the process's state may change for various reasons, such as entering a waiting state while waiting for resources, or returning to the ready state after the CPU time slice has expired.

[0069] Besides having special attributes such as "target", "starting location", and "remarks", shortcuts also have the following obvious features: 1. Support for executing any target file with parameters; 2. Support for displaying the target file's icon; 3. Support for setting the file's startup method; 4. File names and extensions can be fully customized. These features are designed to help users better manage and use shortcuts, but hackers can also easily use these features to carry out phishing attacks. For example, Windows shortcuts (lnk files), as "Loader" files that can point to various executable files, often have the following functions in threat attack activities: (1) existing in the startup directory to establish persistent operations for malware; (2) used to directly deploy malware payloads. Since malware is often deployed / enabled using shortcuts through legitimate executable files, software attacks using shortcuts are constantly emerging.

[0070] For shortcuts on computer devices, the main technologies used for malicious detection are static detection and dynamic detection.

[0071] Static detection refers to malware detection based on the static attributes or file structure information of a shortcut without running it. Static attributes include, for example, the target object the shortcut points to. By performing security checks on the target object, malicious shortcuts can be identified. However, static detection is easily bypassed. Attackers can bypass detection by modifying and obfuscating the target object. For example, an attacker can exploit the 260-byte length limit of the target file and use PowerShell to construct a target longer than 260 bytes with the first 260 bytes empty. To the user, the target attributes appear empty, reducing suspicion. Furthermore, attackers can use obfuscated and encrypted commands or read commands from specific files in real-time within actual commands to bypass static detection.

[0072] Dynamic detection refers to a method of malicious detection that utilizes the behavioral information generated by a shortcut during or after its execution. This behavioral information includes, for example, execution flow, function calls, network connections, and registry modifications. Because this behavioral information is generated after the shortcut has fully started, if the target shortcut is malicious, the malicious behavior has already occurred, making real-time protection and interception difficult.

[0073] Based on this, this application provides a technical solution that utilizes the principle that shortcuts require running a process to launch a program, and that processes can only run after creation and startup. Before the process actually runs, it first determines whether the process was triggered by a shortcut. If it is determined that the process was triggered by a shortcut, it determines whether the process is malicious based on information generated during the process's creation and / or startup phases, thereby achieving malicious detection of shortcuts. The specific implementation of the technical solution provided by this application is as follows: Before a process runs on a computer device, the computer device determines whether the process was triggered by a shortcut. If the process was triggered by a shortcut, the computer device determines whether the process is malicious based on the process information. The process information includes dynamic behavior information, which includes information generated during the process's creation and / or startup phases. Optionally, in this application, all dynamic behavior information of the process is generated during the process's creation or startup phases. A process being triggered by a shortcut can be understood as the process being created by a shortcut or the process being started by a shortcut. This application determines whether a process is triggered by a shortcut before it runs, and if so, determines whether the process is malicious based on dynamic behavior information generated during the process's creation and / or startup phases. Since the process is triggered by a shortcut, performing malicious detection on the process is equivalent to performing malicious detection on the shortcut. The dynamic behavior information used in this application for malicious detection is generated during the process's creation and / or startup phases; that is, this dynamic behavior information is dynamically extracted before the process runs. On the one hand, compared with the static detection methods used in related technologies, because this application directly utilizes information dynamically extracted during the process's creation and / or startup phases for malicious detection, attackers have no opportunity to modify or obfuscate this information, thus avoiding bypassing the detection. On the other hand, compared with the dynamic detection methods used in related technologies, since the dynamic behavior information used by this application to detect malicious processes is generated during the creation and / or startup phases of the process, it is possible to complete the malicious detection of the process before the process runs. This is equivalent to performing malicious detection on the shortcut before it actually runs. In the case of a malicious shortcut, since the malicious shortcut has not yet actually run and the malicious behavior has not yet occurred, it is possible to prevent the malicious shortcut from executing malicious behavior in a timely manner, thereby avoiding malicious impact and achieving real-time protection.

[0074] Optionally, the dynamic behavior information of a process includes, but is not limited to, one or more of the following: the path of the shortcut that triggered the process (path to the lnk file), the command line of the process, the trigger time of the process, the triggering user of the process, the PID of the process, the UUID of the process, or the execution permissions of the process. This dynamic behavior information can be obtained during the process creation or startup phase.

[0075] In some implementations, the process information also includes static file information, which includes the process file information corresponding to the process. Optionally, the process file information includes, but is not limited to, one or more of the following: process file path, process file size, or process file content. In this implementation, the computer device determines whether a process is malicious based on the process's dynamic behavior information and static file information. Since the process file information is available after the process is created, combining the process's dynamic behavior information and static file information to comprehensively determine whether a process is malicious can also complete the malicious detection of the process before it runs. In addition, using more information to perform malicious detection on a process can improve the reliability of the detection.

[0076] In some implementations, the computer device determines whether a process is triggered by a shortcut based on the process startup information (STARTUPINFO). This process startup information is obtained by the computer device during the process creation or process startup phase. In this application, the computer device obtains the process startup information during the process creation or process startup phase, thereby enabling it to determine whether a process is triggered by a shortcut before the process runs, based on this process startup information.

[0077] In other implementations, the computer device determines whether a process is triggered by a shortcut based on the process's window title information. This window title information is obtained by the computer device during the process startup phase. In this application, the computer device obtains the window title information during the process startup phase, thereby enabling it to determine whether a process is triggered by a shortcut before the process runs, based on this window title information.

[0078] In some implementations, the computer device terminates a process after determining it to be malicious. This application, by preventing a malicious process from starting before it has even begun running, can prevent the malicious process from performing malicious actions during its execution, thereby avoiding malicious impact. If a malicious process has already started running, by preventing it from continuing to run, it can prevent the malicious process from further performing malicious actions during its execution, thereby reducing malicious impact.

[0079] In some implementations, after determining that a process is malicious, the computer device deletes or isolates the shortcut that triggered the process and / or the process file corresponding to the process. This application identifies shortcuts that trigger malicious processes as malicious shortcuts. By deleting or isolating these malicious shortcuts, it can prevent them from running again and thus attacking the computer device. And / or, this application identifies process files corresponding to malicious processes as malicious process files. By deleting or isolating these malicious process files, it can prevent the malicious process from being triggered again and thus attacking the computer device.

[0080] In some implementations, after a computer device determines that a process is malicious, if the process modified the registry during its operation before termination, the registry is restored to its state before the process made the modification. And / or, if the process caused the computer device to communicate with other devices during its operation before termination, the computer device's network behavior is prohibited. This application, by handling the behavior generated by malicious processes during their operation, can reduce the malicious impact of malicious processes on computer devices and prevent further malicious impacts from occurring.

[0081] In some implementations, after determining that a process is malicious, the computer device outputs an alarm notification. This alarm notification indicates that the computer device is under attack by a malicious process. Optionally, the computer device outputs the alarm notification, including but not limited to displaying the alarm notification for user viewing, and / or sending the alarm notification to a cloud security server for source tracing. For example, the cloud security server collects and aggregates alarm notifications from multiple computer devices to determine the attacker's location and attack methods.

[0082] The technical solution of this application will be described in detail below from multiple perspectives, including implementation scenarios, hardware devices, methods and processes, software devices, and systems.

[0083] The following are examples illustrating implementation scenarios of the embodiments of this application.

[0084] The malicious program detection method provided in this application can be applied to various computer devices that may be subject to software attacks using shortcuts. It supports threat detection, real-time protection, and source tracing, and has good detection and real-time protection effects for network security and phishing scenarios. The computer devices in this application are, for example, terminal devices with a Windows operating system installed. These computer devices include, but are not limited to, servers, hosts, personal computers, mobile phones, or workstations. Optionally, the Windows operating system includes, but is not limited to, Windows XP, Windows Server 2003, Windows 7, Windows 8, or Windows 10.

[0085] Optionally, the computer device in this embodiment is located within a protected network protected by the protective device, i.e., the computer device is a protected device. For example, Figure 1 This is a schematic diagram of an implementation scenario provided in an embodiment of this application. For example... Figure 1 As shown, this implementation scenario mainly involves three types of equipment: computer equipment, security equipment, and remote servers. Examples of each type of equipment are given below.

[0086] (1) Computer equipment

[0087] The computer device is a protected device located within a protected network. From the perspective of the computer device, the protected network where the computer device resides is an internal network, and the Internet is an external network. Optionally, the computer device is a protected server used to provide services to normal clients (not shown in the figure) in the protected network and the Internet. For example, the computer device includes, but is not limited to, application servers or web servers. Among them, application servers include, but are not limited to, game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. Web servers are also called World Wide Web (WWW) servers or website servers. Alternatively, the computer device can be a protected host, personal computer, mobile phone, workstation, etc. The embodiments of this application do not limit the type of computer device. In this application, the computer device is equipped with security software, such as endpoint detection and response (EDR) software, extended detection and response (XDR) software, intranet protection software, or email security detection software, etc.

[0088] (2) Protective equipment

[0089] Protective devices are deployed between an external network (such as the Internet) and the protected network. For example, they are typically deployed at the boundary of the protected network to protect computer devices within it from attacks from external networks. These devices filter traffic entering and leaving the protected network, blocking attack traffic to ensure the security of computer devices within the network, while allowing normal traffic to ensure normal communication between the protected network and the external network. Protective devices include, but are not limited to, firewalls, security gateways (such as routers or switches), intrusion detection systems (IDS), intrusion prevention systems (IPS), unified threat management (UTM), anti-distributed denial-of-service (anti-DDoS) devices, and next-generation firewalls (NGFW), or a combination thereof. Protective devices can work in conjunction with security software on computer devices to provide multiple layers of protection. For example, a protective device might identify emails with phishing attachments as legitimate traffic, allowing the security software on the computer device to further detect and identify the phishing attachments.

[0090] (3) Remote server

[0091] A remote server is a control facility used by attackers to launch remote attacks. Optionally, the remote server is located on an external network (such as the Internet), meaning that attackers use the remote server to launch remote attacks from the external network to computer devices on a protected network. A remote server, for example, is a command and control (CC) server, which provides support for network attacks, hacking activities, or other illegal activities. CC servers are characterized by high controllability and configurability, and can communicate with malicious programs to remotely control and operate infected computer devices. For example, a CC server may compromise computer devices by sending emails with phishing attachments.

[0092] Optionally, please continue to see Figure 1 This implementation scenario also involves a cloud security server. The cloud security server communicates with computer devices to receive alarm notifications sent by the computer devices. Optionally, the cloud security server is used to collect and aggregate alarm notifications from multiple computer devices to determine the attacker's location, attack methods, etc.

[0093] The following provides examples illustrating the basic hardware structures involved in the embodiments of this application.

[0094] For example, Figure 2 This is a schematic diagram of the hardware structure of a computer device provided in an embodiment of this application. For example... Figure 2 As shown, the computer device 200 includes a processor 201 and a memory 202, with the memory 201 and memory 202 connected via a bus 203. Figure 2 The processor 201 and memory 202 are described independently. Alternatively, the processor 201 and memory 202 are integrated together. Alternatively, they are combined... Figure 1 Let's take a look. Figure 2 The computer device 200 shown is Figure 1 Any computer device in the implementation scenario shown.

[0095] The memory 202 is used to store computer programs, including an operating system and program code. Optionally, the operating system is a Windows operating system. The memory 202 can be various types of storage media, such as read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), flash memory, optical storage, registers, optical disc storage, disk storage, or other magnetic storage devices.

[0096] The processor 201 is a general-purpose processor or a special-purpose processor. The processor 201 may be a single-core processor or a multi-core processor. The processor 201 includes at least one circuit to execute the malicious program detection method provided in the embodiments of this application.

[0097] Optionally, the computer device 200 also includes a network interface 204, which is connected to the processor 201 and the memory 202 via a bus 203. The network interface 204 enables the computer device 200 to communicate with other devices.

[0098] Optionally, the computer device 200 also includes an input / output (I / O) interface 205, which is connected to the processor 201 and memory 202 via a bus 203. The processor 201 can receive input commands or data through the I / O interface 205. The I / O interface 205 is used to connect input devices to the computer device 200, such as a keyboard and mouse. Optionally, in some possible scenarios, the network interface 204 and the I / O interface 205 are collectively referred to as a communication interface.

[0099] Optionally, the computer device 200 further includes a display 206, which is connected to the processor 201 and the memory 202 via a bus 203. The display 206 can be used to display intermediate and / or final results generated by the processor 201 executing the malicious program detection method provided in this application embodiment, such as alarm prompts. In one possible implementation, the display 206 is a touch screen to provide a human-computer interaction interface.

[0100] Wherein, bus 203 can be any type of communication bus used to interconnect internal devices of computer device 200. For example, a system bus. This embodiment of the application illustrates the interconnection of the aforementioned devices inside computer device 200 via bus 203 as an example. Optionally, the aforementioned devices inside computer device 200 may communicate with each other using connection methods other than bus 203, such as interconnecting the aforementioned devices inside computer device 200 via internal logical interfaces of computer device 200.

[0101] The aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether to dispose of the devices independently on different chips or integrate them on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices.

[0102] Figure 2 The computer device 200 shown is merely exemplary. In its implementation, the computer device 200 may include other components, which will not be listed hereafter. Figure 2 The computer device 200 shown can detect malicious programs by executing all or part of the steps of the malicious program detection method provided in the embodiments of this application.

[0103] The method flow of the embodiments of this application is illustrated below.

[0104] For example, Figure 3 This is a flowchart illustrating a malicious program detection method 300 provided in an embodiment of this application. Figure 3 As shown, method 300 includes, but is not limited to, steps 301 to 302. Optionally, method 300 further includes step 303. Method 300 is applied to a computer device. Optionally, method 300 is executed by security software running on the computer device. Optionally, in combination with... Figure 1 In the illustrated implementation scenario, the computer device in method 300 is... Figure 1 Any computer device in the method 300. Optionally, the computer device in the method 300 has Figure 2 The hardware structure shown.

[0105] Step 301: Before a process runs on a computer device, determine whether the process is triggered by a shortcut.

[0106] The process management process executed by the operating system of a computer device includes three stages: process creation, process startup, and process execution. Optionally, determining whether a process was triggered by a shortcut before it runs on the computer device can be implemented in the following ways: During the process creation stage, it can be determined whether the process was created by a shortcut, for example, in response to the computer device creating a process, it can be determined whether the process was created by a shortcut. Alternatively, during the process startup stage, it can be determined whether the process was started by a shortcut, for example, in response to the computer device starting a process, it can be determined whether the process was started by a shortcut.

[0107] Optionally, the first possible implementation of step 301 above is based on process startup information. Specifically, in response to a computer device creating or starting a process, the computer device obtains the process startup information of that process and determines whether the process was triggered by a shortcut based on this information. Optionally, the process startup information includes the contents of the STARTUPINFO structure specified when the process starts. The STARTUPINFO structure includes one or more flag bits (dwFlags). If the dwFlags of the STARTUPINFO structure contains STARTF_TITLEISLINKNAME (with a corresponding value of 0x00000800), then it is determined that the process was started by a shortcut.

[0108] In this implementation, the computer device obtains process startup information during the process creation or process startup phase, thereby enabling it to determine whether the process was triggered by a shortcut before the process runs based on the process startup information.

[0109] Optionally, one way for a computer device to obtain process startup information of a process includes: in response to the computer device starting a process, obtaining the process startup information of the process through the GetStartupInfo() function.

[0110] For example, upon detecting the start of a process, a computer device immediately injects itself into that process to call the GetStartupInfo() function to obtain the process's startup information. This application does not limit the process injection method. For example, a dynamic link library (DLL) injection method can be used, by writing a DLL containing the GetStartupInfo() function and injecting it into the process's address space. Alternatively, a code injection method can be used, by writing code that can be directly executed in memory, such as shellcode, and injecting this code into the process's address space, where the code contains the logic to call the GetStartupInfo() function. Then, by running the injected DLL or code in the process's address space, the GetStartupInfo() function is called to obtain the STARTUPINFO structure.

[0111] In this implementation, the computer device obtains process startup information during the process startup phase, enabling it to determine whether the process was triggered by a shortcut before it runs. Furthermore, the mechanism of obtaining process startup information through the GetStartupInfo() function can be used in conjunction with other synchronization blocking mechanisms. This ensures that the process is blocked during the process of the computer device injecting into the process, calling GetStartupInfo() to obtain process startup information, and determining whether the process was triggered by a shortcut. This prevents malicious processes from running and thus avoids malicious behavior if the process is malicious.

[0112] Alternatively, a computer device can hook a process creation function in its operating system using a hook function to monitor whether the device is creating a process. Another way for a computer device to obtain process startup information is to retrieve this information from the API parameters of the process creation function via a hook function, in response to detecting process creation.

[0113] The hook function hooks the process creation function in the computer device's operating system. In other words, the hook function hooks the API calls to the process creation function, allowing it to monitor applications' behavior of calling this function to create processes. Optionally, before the application calls the process creation function API, the computer device retrieves the contents (i.e., process startup information) of the specified STARTUPINFO structure from the API parameters. Optionally, the process creation function is the CreateProcess function provided by the Windows API, including but not limited to createprocessa, createprocessw, or createprocessinternelw.

[0114] Optionally, the computer device employs user-mode hooking technology to monitor whether it creates processes. This involves the computer device hooking process creation functions in its operating system using user-mode hook functions. User-mode hooking is a technique for intercepting and modifying function calls within an application. For example, after a suspicious application (such as email, browser, office software, or game software) is launched, security software injects user-mode hook functions into that application to monitor whether it creates a new process. Optionally, the computer device injects user-mode hook functions into the application by injecting a DLL.

[0115] User-mode hook functions refer to hook functions that run in user mode. User mode means that the application runs in a non-privileged mode, where it can only access restricted resources and cannot directly manipulate hardware or execute privileged instructions. The application enters kernel mode through system call interfaces to request privileged operations from the operating system. Optionally, user-mode hooking techniques include, but are not limited to, inline hooking or import address table (IAT) hooking (IAThooking).

[0116] Alternatively, computer devices may employ kernel-mode hooking technology to monitor whether they are creating processes. This involves the computer device using kernel-mode hook functions to intercept and modify process creation functions within its operating system. Kernel-mode hooking is a technique that intercepts and modifies function calls within the operating system kernel. For example, after security software on a computer device starts, it injects kernel-mode hook functions into the device's kernel. Injecting kernel-mode hook functions into the kernel can be understood as implementing the functionality of hook functions within the operating system's kernel-mode driver.

[0117] Kernel-mode hook functions refer to hook functions that run in kernel mode. Kernel mode refers to the kernel running in privileged mode, possessing the authority to access all resources and execute privileged instructions. The operating system executes system calls and handles interrupts in kernel mode. Optionally, kernel-mode hook functions can be registered using the Microsoft-provided process startup callback routine PsCreateProcessNotifyRoutine. Alternatively, kernel-mode hook functions can also be implemented through System Services Descriptor Table (SSDT) ​​hooking. Furthermore, in environments supporting CPU virtualization, kernel-mode hook functions can also be implemented through the hypervisor, employing kernel-mode hooking techniques including, but not limited to, model-specific register hook (MSR hook) or extended page table hook (EPT hook) techniques.

[0118] In this implementation, the computer device obtains process startup information during the process creation phase, enabling it to determine whether a process was triggered by a shortcut before it actually starts. Furthermore, this hook function-based mechanism allows for the synchronous blocking of the process, or it can be used in conjunction with other synchronization blocking mechanisms. This ensures that the process is blocked while the computer device is obtaining startup information and determining whether it was triggered by a shortcut. This prevents malicious processes from running and thus avoids malicious behavior if the process is malicious.

[0119] Optionally, in either of the two implementations of the first possible embodiment described above, after obtaining the contents of the STARTUPINFO structure, the computer device determines whether the process was triggered by a shortcut based on the contents of the STARTUPINFO structure. Optionally, the computer device sends the obtained contents of the STARTUPINFO structure back to the detection process, which then determines whether the process was triggered by a shortcut. Alternatively, the computer device determines whether the process was triggered by a shortcut based on the obtained contents of the STARTUPINFO structure and then directly sends the determination result back to the detection process. The detection process is a process running on the computer device used to detect malicious programs, such as a process started by security software running on the computer device.

[0120] Optionally, if the process is triggered by a shortcut, the computer device further obtains the path of the shortcut from the process startup information. In the Windows operating system, the shortcut path is the .lnk file path, which serves as dynamic behavior information for the process triggered by the shortcut. The STARTUPINFO structure specified at process startup includes an lpTitle member. If the dwFlags of the STARTUPINFO structure contains a STARTF_TITLEISLINKNAME with a value of 0x00000800, this indicates that the lpTitle member contains the path to the shortcut file (.lnk) that the user invoked to start this process. Furthermore, the computer device can obtain the .lnk file path from the lpTitle member.

[0121] Optionally, the second possible implementation of step 301 above is based on window title information. Specifically, in response to the computer device starting a process, the computer device obtains the window title information according to the process environment block (PEB) pointing to the process, and determines whether the process is started by a shortcut based on the window title information.

[0122] For example, after detecting the start of a process, the computer device first obtains the handle of that process, and then uses the NtQueryInformationProcess() function to retrieve a pointer to the process's PEB structure based on the process handle. The PEB structure includes a ProcessParameters field, which contains a pointer to an RTL_USER_PROCESS_PARAMETERS1 structure. The RTL_USER_PROCESS_PARAMETERS1 structure contains a WindowTitle field. Finally, the ReadProcessMemory() function is used to read the contents of the PEB and RTL_USER_PROCESS_PARAMETERS1 structures to obtain the WindowTitle information.

[0123] Optionally, in the second possible implementation described above, after obtaining the WindowTitle information, the computer device determines whether the process was triggered by a shortcut based on the WindowTitle information. Optionally, the computer device sends the obtained WindowTitle information back to the detection process, which then determines whether the process was triggered by a shortcut. Alternatively, the computer device determines whether the process was triggered by a shortcut based on the obtained WindowTitle information and then directly sends the determination result back to the detection process. The detection process is a process running on the computer device used to detect malicious programs, such as a process started by security software running on the computer device.

[0124] In this implementation, the computer device obtains window title information during the process startup phase, enabling it to determine whether the process was triggered by a shortcut before it runs. Furthermore, this mechanism can be used in conjunction with other synchronization blocking mechanisms, ensuring that the process is blocked while the computer device is obtaining window title information and determining whether it was triggered by a shortcut. This prevents malicious processes from running and thus avoids malicious behavior if the process is malicious.

[0125] Optionally, if the process is triggered by a shortcut, the computer device further obtains the path of the shortcut from the window title information. In the Windows operating system, the shortcut path is the same as the .lnk file path, which can serve as dynamic behavior information for the process triggered by the shortcut.

[0126] Step 302: If the process is triggered by a shortcut, the computer device determines whether the process is malicious based on the process information, which includes dynamic behavior information.

[0127] The dynamic behavior information of a process includes information generated during the process's creation and / or startup phases. Optionally, in this embodiment, all dynamic behavior information of a process is generated during the process's creation or startup phase. For example, dynamic behavior information includes, but is not limited to, one or more of the following: the path of the shortcut that triggers the process (lnk file path), the process's command line, the process's trigger time, the triggering user, the process's PID, the process's UUID, or the process's execution permissions. The shortcut path can be obtained from process startup information or window title information, while other dynamic behavior information can be obtained from the process environment block (PEB).

[0128] In this embodiment, it is determined whether a process is triggered by a shortcut before it runs. If the process is triggered by a shortcut, it is determined whether the process is malicious based on the dynamic behavior information generated during the process's creation and / or startup phases. Since the process is triggered by a shortcut, performing malicious detection on the process is equivalent to performing malicious detection on the shortcut. In this embodiment, the dynamic behavior information used for malicious detection of the process is generated during the process's creation and / or startup phases; that is, the dynamic behavior information is dynamically extracted before the process runs. On the one hand, since this embodiment directly uses information dynamically extracted during the process's creation and / or startup phases for malicious detection, attackers have no opportunity to modify or obfuscate this information, thus avoiding bypassing the detection. On the other hand, since the dynamic behavior information used by the embodiments of this application to perform malicious detection on the process is generated during the creation and / or startup phase of the process, malicious detection of the process can be completed before the process runs. This is equivalent to performing malicious detection on the shortcut before it actually runs. In the case of a malicious shortcut, since the malicious shortcut has not actually run yet and the malicious behavior has not actually occurred, it can prevent the malicious shortcut from performing malicious behavior in a timely manner, thereby avoiding malicious impact and achieving real-time protection.

[0129] Optionally, the process information also includes static file information, which includes the process file information corresponding to the process. Optionally, the process file information includes, but is not limited to, one or more of the following: process file path, process file size, or process file content. That is, step 302 above can be implemented such that if a process is triggered by a shortcut, the computer device determines whether the process is malicious based on the process's dynamic behavior information and static file information. Since process file information is available after the process is created, combining the process's dynamic behavior information and static file information to comprehensively determine whether the process is malicious can also complete the malicious detection of the process before it runs. Furthermore, using more information to perform malicious detection on processes can improve the reliability of the detection.

[0130] Optionally, the methods used by computer devices to determine whether a process is a malicious process include, but are not limited to, signature-based rule matching or artificial intelligence (AI) algorithms.

[0131] One implementation of step 302 above is as follows: the computer device inputs process information into a machine learning model to obtain the output of the machine learning model, and determines whether the process is malicious based on the output. The output of the machine learning model includes the determination result of whether the process is malicious.

[0132] Optionally, the output of the machine learning model may also include the confidence level of the determination result. If the determination result output by the machine learning model indicates a malicious process, and the confidence level is higher than or equal to a certain threshold, the computer device may further perform the following step 303. If the determination result output by the machine learning model indicates a malicious process, and the confidence level is lower than a certain threshold, the computer device may further perform correlation analysis on the process in conjunction with other information. For example, the computer device may perform correlation analysis on the process in conjunction with the scan results of antivirus software on the process file content. If the scan results indicate that the process file content is highly risky, the computer device determines that the process is a malicious process. Alternatively, the computer device may perform correlation analysis on the process in conjunction with the behavior executed after the process runs, to further determine whether the process is a malicious process.

[0133] Alternatively, step 302 above can be implemented by the computer device matching process information with rules in a signature database and determining whether the process is malicious based on the matching results. The rules in the signature database can be set based on expert experience. For example, a set of suspicious .lnk file paths can be pre-defined, with the following rule: if the .lnk file path corresponding to a process belongs to this set of suspicious .lnk file paths, then the process is determined to be malicious.

[0134] Optionally, the rules in the signature database include high-confidence rules and low-confidence rules. A high-confidence rule, for example, determines that a process triggered by an lnk file (such as the system process cmd.exe or powershell.exe) is a malicious process when it is detected that the lnk file is launching a suspicious process. The process information needed to determine whether this high-confidence rule is matched includes the process file path (static file information) and the process's command line (dynamic behavior information). A low-confidence rule, for example, determines that a process triggered by an lnk file with a suspicious path (such as c:\users\admin\desktop\invoice.pdf.lnk) is likely a malicious process when it is detected that the lnk file is running. The process information needed to determine whether this low-confidence rule is matched includes the lnk file path (dynamic behavior information). If the process information matches a high-confidence rule in the signature database, the computer device can further perform the following step 303. If the process information matches a low-confidence rule in the signature database, the computer device can further perform correlation analysis on the process in conjunction with other information. For example, a computer device might perform correlation analysis on a process based on scan results from antivirus software, examining the process file content. If the scan results indicate a high risk level in the process file content, the computer device would determine that the process is malicious. Alternatively, the computer device could perform correlation analysis on the process's subsequent behavior to further determine if it is malicious. Or, if the process information matches a certain number of low-confidence rules in a signature database, the computer device would determine that the process is malicious.

[0135] In this embodiment, the computer device determines whether to handle a process based on the confidence level of the malicious process. If the confidence level of the malicious process is high, the process is directly handled (e.g., by executing step 303) to prevent the process from attacking the computer device. If the confidence level of the malicious process is low, the process is analyzed in conjunction with other information to further determine whether the process is malicious, thereby reducing the false positives for normal processes and balancing the operational reliability and security of the computer device.

[0136] Step 303: After determining that the process is a malicious process, the computer device terminates the process.

[0137] In this embodiment, if a malicious process has not yet started running, the computer device can prevent it from executing malicious behavior during its operation by blocking its start, thereby avoiding malicious impact. If a malicious process has already started running, the computer device can prevent it from further executing malicious behavior during its operation by blocking its continued operation, thereby reducing malicious impact.

[0138] Optionally, after determining that a process is malicious, the computer device, in addition to terminating the process, may also delete or isolate the shortcut that triggered the process and / or the process file corresponding to the process.

[0139] In this embodiment, shortcuts that trigger malicious processes are identified as malicious shortcuts. By deleting or isolating these malicious shortcuts, it is possible to prevent them from running again and thus attacking the computer device. And / or, in this embodiment, process files corresponding to malicious processes are identified as malicious process files. By deleting or isolating these malicious process files, it is possible to prevent the malicious process from being triggered again and thus attacking the computer device.

[0140] Optionally, if the malicious process has already started running before the computer device terminates it, and if the malicious process modified the registry during its operation, the registry will be restored to its state before the process made the modifications. This could involve deleting entries added by the malicious process, restoring entries deleted during its operation, or restoring values ​​modified during its operation. And / or, if the malicious process causes the computer device to communicate with other devices during its operation, the computer device's network behavior will be prohibited. For example, the computer device's Internet Protocol (IP) address will be blocked to prevent it from communicating with other devices on the Internet and / or the internal network based on their IP addresses.

[0141] In this embodiment of the application, by handling the behavior generated by the malicious process during its operation, the malicious impact of the malicious process on the computer device can be reduced, and the malicious process can be prevented from causing further malicious impact.

[0142] Optionally, after determining that a process is malicious, the computer device may further output an alarm notification. This alarm notification indicates that the computer device is under attack by a malicious process. Optionally, the computer device outputting the alarm notification may include, but is not limited to, displaying the alarm notification for the user to view, thereby alerting the user that the computer device may be under attack; and / or, the computer device sending an alarm notification to a cloud security server for attribution tracing and detection.

[0143] Optionally, the alert may include, but is not limited to, one or more of the following: the process identifier of the malicious process, the shortcut that triggered the malicious process, the target pointed to by the shortcut that triggered the malicious process, the triggering time of the malicious process, or the user who triggered the malicious process.

[0144] The order of steps in the malicious program detection method provided in this application can be adjusted appropriately, and steps can be added or removed as needed. Any variations that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application.

[0145] The following describes an example of a virtual device in an embodiment of this application.

[0146] For example, Figure 4 This is a schematic diagram of the structure of a malicious program detection device provided in an embodiment of this application. It has... Figure 4 The malicious program detection device with the structure shown is used to implement the method 300 described in the above embodiments. Optionally, Figure 4 The malware detection device shown is Figure 1 or Figure 2 The computer equipment shown, or, Figure 4 The malware detection device shown is Figure 1 or Figure 2 The security software in the computer device shown. For example... Figure 4 As shown, the malicious program detection device 400 includes, but is not limited to, a first judgment module 401 and a second judgment module 402. Optionally, please continue to see Figure 4 The malicious program detection device 400 also includes one or more of a monitoring module 403, an acquisition module 404, a processing module 405, or an output module 406.

[0147] The first judgment module 401 is used to determine whether a process is triggered by a shortcut before it runs on a computer device. The second judgment module 402 is used to determine whether a process is malicious based on its process information if the process is triggered by a shortcut. The process information includes dynamic behavior information, which includes information generated during the process creation and / or startup phases.

[0148] Optionally, dynamic behavior information includes one or more of the following: shortcut path, process command line, process trigger time, process triggering user, process identifier, process UUID, or process execution permissions.

[0149] Optionally, the process information also includes static file information, which includes the process file information corresponding to the process.

[0150] Optionally, the process file information includes one or more of the following: process file path, process file size, or process file content.

[0151] Optionally, the first judgment module 401 is used to obtain the process startup information of the process in response to the computer device creating or starting the process; and to determine whether the process is triggered by a shortcut based on the process startup information.

[0152] Optionally, the first judgment module 401 is used to obtain the process startup information of the process through the GetStartupInfo() function in response to the computer device starting the process.

[0153] Optionally, the monitoring module 403 is used to hook the process creation function in the operating system of the computer device through a hook function to monitor whether the computer device creates a process. The process creation function is used to create a process. The first judgment module 401 is used to obtain process startup information from the API parameters corresponding to the process creation function through a hook function in response to the monitoring of the computer device creating a process.

[0154] Optionally, module 404 is used to obtain the path of the shortcut from the process startup information if the process is triggered by a shortcut.

[0155] Optionally, the first judgment module 401 is used to respond to the computer device starting a process, obtain window title information based on the process environment block pointing to the process, and determine whether the process is started by a shortcut based on the window title information.

[0156] Optionally, module 404 is used to retrieve the path of the shortcut from the window title information if the process is triggered by a shortcut.

[0157] Optionally, the second judgment module 402 is used to input process information into the machine learning model to obtain the output result of the machine learning model, and determine whether the process is a malicious process based on the output result.

[0158] Optionally, the second judgment module 402 is used to match the process information with the rules in the feature library, and determine whether the process is a malicious process based on the matching result.

[0159] Optionally, the handling module 405 is used to terminate the process after determining that the process is a malicious process.

[0160] Optionally, the handling module 405 is also used to delete or isolate the shortcut and / or the process file corresponding to the process after determining that the process is a malicious process.

[0161] Optionally, the processing module 405 is further configured to: restore the registry to its state before the process modification if the process modifies the registry during its operation before termination; and / or, prohibit the computer device's network behavior if the process causes the computer device to communicate with other devices during its operation before termination.

[0162] Optionally, the output module 406 is used to output an alarm message after determining that the process is a malicious process. The alarm message is used to indicate that the computer device has been attacked by a malicious process.

[0163] Optionally, the alert may include one or more of the following: the process identifier of the malicious process, the shortcut that triggered the malicious process, the target pointed to by the shortcut that triggered the malicious process, the triggering time of the malicious process, or the user who triggered the malicious process.

[0164] Appendix Figure 4 The described device embodiments are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional modules in the various embodiments of this application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. Appendix Figure 4 The above modules can be implemented either in hardware or as software functional units. For example, when implemented in software, the first judgment module 401 and the second judgment module 402 can be implemented by an attached... Figure 2 The processor 201 reads the program code stored in the memory 202 and generates software function modules to implement it. Figure 4 The aforementioned modules can also be implemented separately by different hardware components of a computer device. For example, the first judgment module 401 and the second judgment module 402 mentioned above are implemented by an attached... Figure 2 A portion of the processing resources in the processor 201 (e.g., one core in a multi-core processor) are used for implementation, while the monitoring module 403, acquisition module 404, processing module 405, and output module 406 are provided by an auxiliary component. Figure 2 The network interface 204 and the remaining processing resources in the processor 201 (such as other cores in a multi-core processor) are used to complete the task. Obviously, the above functional modules can also be implemented by a combination of software and hardware. For example, the output module 406 is implemented by a hardware programmable device, while the first judgment module 401, the second judgment module 402, the monitoring module 403, the acquisition module 404, and the processing module 405 are software functional modules generated by the processor after reading the program instructions stored in the memory.

[0165] This application also provides a computer device, including: a memory, a network interface, and at least one processor. The memory stores program instructions, and the at least one processor reads the program instructions stored in the memory, causing the computer device to execute the method 300 described above. Optionally, the hardware structure of the computer device is as follows: Figure 2As shown.

[0166] This application also provides a computer-readable storage medium storing instructions that, when executed by a processor of a computer device, implement the steps performed by the computer device in the above method embodiments.

[0167] This application also provides a computer program product, including a computer program, which, when executed by the processor of a computer device, implements the steps executed by the computer device in the above method embodiments.

[0168] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0169] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance.

[0170] In the description of the embodiments in this application, unless otherwise stated, "at least one" means one or more. "More than one" means two or more.

[0171] A references B, which means that A is the same as B or A is a simple variation of B.

[0172] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that there are three possible relationships. For example, A and / or B means: A exists alone, A and B exist simultaneously, or B exists alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0173] Optionally, in the above embodiments, all or part of the implementation is carried out by software, hardware, firmware, or any combination thereof. Optionally, when implemented using software, it is implemented in the form of a computer program product, which is implemented in whole or in part. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. Optionally, the computer is a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Optionally, the computer instructions are stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. Optionally, the computer-readable storage medium is any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. Alternatively, the available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video disks (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0174] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A malicious program detection method characterized by comprising: The method comprises: Before a process runs on a computer device, it is determined whether the process is triggered by a shortcut; If the process is triggered by a shortcut, it is determined whether the process is a malicious process according to process information of the process, the process information comprising dynamic behavior information, the dynamic behavior information comprising information generated in a creation stage and / or a startup stage of the process.

2. The method of claim 1, wherein, The dynamic behavior information comprises one or more of a path of the shortcut, a command line of the process, a triggering time of the process, a triggering user of the process, a process identifier of the process, a universally unique identifier, UUID, of the process, or an execution permission of the process.

3. The method according to claim 1 or 2, characterized in that, The process information further comprises static file information, the static file information comprising process file information corresponding to the process.

4. The method of claim 3, wherein, The process file information comprises one or more of a process file path, a process file size, or process file content.

5. The method according to any one of claims 1 to 4, characterized in that, The process runs on a computer device, it is determined whether the process is triggered by a shortcut, comprising: In response to the computer device creating a process or starting a process, process startup information of the process is obtained; According to the process startup information, it is determined whether the process is triggered by a shortcut.

6. The method of claim 5, wherein, In response to the computer device starting a process, the process startup information of the process is obtained through a GetStartupInfo() function. The method further comprises:

7. The method of claim 5, wherein, Hooking a process creation function in an operating system of the computer device through a hook function to monitor whether the computer device creates a process, the process creation function being used to create a process; In response to monitoring that the computer device creates a process, the process startup information is obtained from application programming interface, API, parameters corresponding to the process creation function through the hook function. The method further comprises: If the process is triggered by a shortcut, the path of the shortcut is obtained from the process startup information.

8. The method according to any one of claims 5 to 7, characterized in that, The process runs on a computer device, it is determined whether the process is triggered by a shortcut, comprising: In response to the computer device starting a process, window title information is obtained according to a process environment block pointing to the process; 9. The method according to any one of claims 1 to 4, characterized in that, According to the window title information, it is determined whether the process is started by a shortcut. The method further comprises: If the process is triggered by a shortcut, the path of the shortcut is obtained from the window title information.

10. The method of claim 9, wherein, The process runs on a computer device, it is determined whether the process is triggered by a shortcut, comprising: The process information is input into a machine learning model to obtain an output result of the machine learning model, and it is determined whether the process is a malicious process according to the output result.

11. The method according to any one of claims 1 to 10, characterized in that, The process runs on a computer device, it is determined whether the process is triggered by a shortcut, comprising: The process information is matched with rules in a feature library, and it is determined whether the process is a malicious process according to a matching result.

12. The method according to any one of claims 1 to 10, characterized in that, ​ ​ 13. The method according to any one of claims 1 to 12, characterized in that, The method further comprises: terminating the process after determining that the process is a malicious process.

14. The method of claim 13, wherein, The method further comprises, after determining that the process is a malicious process: deleting or isolating the shortcut and / or the process file corresponding to the process.

15. The method according to claim 13 or 14, characterized in that, The method further comprises: restoring the registry to a state before the process is modified, if the process has a behavior of modifying the registry during running before the process is terminated; and / or, prohibiting the network behavior of the computer device, if the process causes the computer device to communicate with other devices during running before the process is terminated.

16. The method of any one of claims 1 to 15, wherein, The method further comprises: outputting an alarm prompt after determining that the process is a malicious process, the alarm prompt being used to indicate that the computer device is attacked by the malicious process.

17. The method of claim 16, wherein, The alarm prompt comprises one or more of a process identifier of the malicious process, a shortcut triggering the malicious process, a target pointed by the shortcut triggering the malicious process, a triggering time of the malicious process, or a triggering user of the malicious process.

18. A computer device, comprising: comprise: a memory, a network interface, and at least one processor, the memory being used to store program instructions, the at least one processor reading the program instructions stored in the memory, so that the computer device executes the method according to any one of claims 1 to 17.

19. A computer-readable storage medium, characterized in that, The computer readable storage medium stores instructions, when the instructions are executed by the processor, the method according to any one of claims 1 to 17 is implemented.

20. A computer program product, characterised in that, The computer program is executed by the processor, the method according to any one of claims 1 to 17 is implemented.

Images