Security detection method, security loading method, device, storage medium, and program product

Abstract

Embodiments of the present application provide a security detection method, a security loading method, a device, a storage medium and a program product. The security detection method is applied to a security module, the security module runs in a kernel, the kernel is provided with a plurality of detection points, and the method comprises: in response to a callback request triggered by any detection point, determining a target policy object hit by the detection point; the target policy object is obtained based on encapsulation of a policy script and a corresponding relationship between the policy script and the detection point; the policy script is provided by a user state process and is obtained by compiling a virtual machine in the kernel; the corresponding relationship is obtained by analyzing the policy script by the virtual machine; the policy script is executed by the virtual machine to detect a corresponding kernel operation of the detection point; and a detection result fed back by the virtual machine is acquired. The technical scheme provided by the embodiments of the present application improves the security detection efficiency.

Images