A detection rule start-stop control method, electronic equipment and storage medium

Abstract

The application provides a detection rule start-stop control method, electronic equipment and a storage medium. The method comprises the following steps: every preset time length, according to the system resource usage rate of a plurality of hardware resources of a terminal in a target time period, obtaining the predicted maximum resource usage rate of each hardware resource in a future time period to establish a resource prediction list, inputting the resource prediction list into a resource usage rate classification model to obtain the confidence of each resource usage category; according to the resource usage category with the maximum confidence, opening or closing a plurality of detection rules in the driving layer and the application layer of the terminal, so that the detection rules in the application layer that are the same as the opened detection rules in the driving layer are closed, and other detection rules in the application layer of the terminal are opened, so as to realize fast detection of the process while reducing the resource occupation of the detection rules in the process detection.

Description

Technical Field

[0001] This invention relates to the field of process detection, and in particular to a detection rule start / stop control method, electronic device, and storage medium. Background Technology

[0002] The terminal is divided into security and debugging modes. When a process starts on the terminal, it sends a message to the terminal's application layer. The detection rules deployed on the application layer determine whether to intercept the process. After detecting and judging the process, the application layer sends the detection result to the terminal's driver layer, which then performs the specific interception / allowing operation. Since the application layer and the driver layer need to synchronize data, it will affect the terminal's performance. If the process detection rules are deployed on the driver layer, it will improve the process detection speed, but it will consume a lot of system resources, which may lead to the terminal blue screen, freezing, etc. Therefore, how to dynamically adjust the start and stop of the detection rules in the driver layer and application layer to achieve a relative balance between process detection speed and system resource consumption is a technical problem that urgently needs to be solved. Summary of the Invention

[0003] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows: According to one aspect of this application, a detection rule start / stop control method is provided, comprising: Step S100: Every preset time interval, input the system resource utilization rate of each hardware resource of the terminal within the target time period into the preset resource utilization rate prediction model to obtain a resource prediction list. The resource prediction list includes the predicted maximum resource utilization rate for each hardware resource within a future time period. The duration of the target time period is longer than the preset duration, and the end time of the target time period is the current time. The duration of the future time period is the preset duration, and the start time of the future time period is the end time of the target time period; The resource utilization prediction model is obtained by training samples of the system resource utilization rate of each hardware resource within a historical time period; Step S200: Input the resource prediction list into the preset resource utilization classification model to obtain the confidence level of each resource utilization category; Step S300: Based on the resource usage category with the highest confidence level, control the start and stop of detection rules in the driver layer and application layer of the terminal; The resource usage categories include idle, cached, and busy categories; the application layer is configured with detection rules for all processes, while the driver layer is configured with detection rules for some processes, and the start / stop status of the same detection rule is different in the driver layer and the application layer.

[0004] According to another aspect of this application, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored in the storage medium, the at least one instruction or the at least one program being loaded and executed by a processor to implement the aforementioned detection rule start / stop control method.

[0005] According to another aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0006] The present invention has at least the following beneficial effects: The detection rule-based start / stop control method of this invention acquires the system resource utilization rate of several hardware resources of the terminal within a target time period at preset intervals, obtaining a resource utilization rate list corresponding to each hardware resource within the target time period. This resource utilization rate list is then input into a resource utilization rate prediction model to obtain a resource prediction list output by the model. This predicts the maximum resource utilization rate of each hardware resource within a future time period. The resource prediction list is then input into a resource utilization rate classification model to obtain the confidence level of each resource utilization category output by the model, representing the terminal's resource utilization status within the future time period. If the resource utilization category with the highest confidence level is the idle category, it indicates that the terminal's resource utilization within the future time period is idle. The system predicts the system resource utilization rate of each hardware resource of the terminal to determine the terminal's resource utilization status in the future. Based on this future resource utilization status, it dynamically controls the start and stop of several detection rules in the terminal's application layer and driver layer to achieve rapid process detection while reducing the resource consumption of detection rules during process detection. If the resource utilization category with the highest confidence is the cache category, it indicates that the terminal's resource utilization will be in a cached state in the future. In this case, some detection rules in the terminal's driver layer are enabled, detection rules in the terminal's application layer that are the same as those enabled in the driver layer are disabled, and other detection rules in the terminal's application layer are enabled. If the resource utilization category with the highest confidence is the busy category, it indicates that the terminal's resource utilization will be in a busy state in the future. In this case, all detection rules in the terminal's application layer and driver layer are enabled, while the detection rules in the terminal's application layer that are the same as those enabled in the driver layer are disabled, and all detection rules in the terminal's application layer are enabled. Attached Figure Description

[0007] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 This is a flowchart of the detection rule start / stop control method provided in an embodiment of the present invention. Detailed Implementation

[0009] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0010] This application proposes a detection rule-based start / stop control method, such as... Figure 1 As shown, it includes: Step S100: Every preset time interval, input the system resource utilization rate of each hardware resource of the terminal within the target time period into the preset resource utilization rate prediction model to obtain a resource prediction list. The duration of the target time period is longer than the preset duration, and the end time of the target time period is the current time.

[0011] The hardware resources of the terminal can be computing resources (central processing unit, graphics processing unit, embedded processor, etc.) or storage resources (such as memory, external storage, cache, etc.).

[0012] The system resource utilization rate corresponding to hardware resources is the proportion of system resources used by that hardware resource in the total system resources.

[0013] Specifically, at preset intervals, the system resource utilization rate of each hardware resource of the terminal is obtained within the target time period to obtain a resource utilization rate list G1, G2, ..., G for each hardware resource within the target time period. a ,...,G b ; Where a = 1, 2, ..., b; b is the amount of hardware resources in the terminal; G a This is a list of resource utilization rates for the a-th hardware resource of the terminal within the target time period. G a =(G a1 G a2 ,...,G ac ,...,G ad); c=1,2,...,d; d is the number of data collection moments included in the target time period; the duration between any two adjacent data collection moments within the target time period is equal; G ac This represents the system resource utilization rate of the terminal's a-th hardware resource at the c-th data acquisition time within the target time period.

[0014] Input several resource utilization rate lists into the preset resource utilization rate prediction model to obtain the resource prediction list output by the resource utilization rate prediction model; The resource forecast list includes the predicted maximum resource utilization rate for each hardware resource over a future time period.

[0015] The duration of the future time period is the preset duration, and the start time of the future time period is the end time of the target time period.

[0016] The resource utilization prediction model is obtained by training on samples of system resource utilization rates of several hardware resources over a historical period. Specifically, the resource utilization prediction model is determined according to steps S110-S160: Step S110: Obtain the system resource utilization rate of each hardware resource of the terminal in each first historical time period and each second historical time period to obtain multiple first historical resource utilization rate lists and multiple second historical resource utilization rate lists. Specifically, the system resource utilization rate of each hardware resource of the terminal is obtained within several first historical time periods to obtain several first historical resource utilization rate list sets J1, J2, ..., J e ,...,J f Where e = 1, 2, ..., f; f is the number of the first historical time period; J e This is a list of historical resource utilization rates corresponding to the e-th first historical time period; The end time of each first historical time period is earlier than the start time of the target time period, and the duration of each first historical time period is equal to the duration of the target time period. J e =(J e1 J e2 ,...,J ea ,...,J eb ); J ea This is a list of historical resource utilization rates for the a-th hardware resource of the terminal during the e-th first historical time period. J ea =(J ea1 J ea2 ,...,J eac ,...,J ead ); J eacThe system resource utilization rate of the terminal's a-th hardware resource at the c-th data acquisition time within the e-th first historical time period; Obtain the system resource utilization rate of each hardware resource of the terminal within several second historical time periods to obtain several second historical resource utilization rate list sets K1, K2, ..., K e ,...,K f Among them, K e This is a list of historical resource utilization rates corresponding to the e-th second historical time period; The start time of the eth second historical time period is the end time of the eth first historical time period; the duration of each second historical time period is a preset duration (the preset duration is equal to the preset duration in step S100). K e =(K e1 ,K e2 ,...,K ea ,...,K eb ); K ea This is a list of historical resource utilization rates for the terminal's a-th hardware resource during the e-th second historical time period. K ea =(K ea1 ,K ea2 ,...,K ear ,...,K eas ); r=1,2,...,s; s is the number of data collection moments included in the second historical time period; the duration between any two adjacent data collection moments in the second historical time period is equal; K ear This represents the system resource utilization rate of the terminal's a-th hardware resource at the r-th data acquisition time within the e-th second historical time period.

[0017] Step S120: Perform binning on any second historical resource utilization rate list to obtain multiple data clusters corresponding to the second historical resource utilization rate list; Specifically, for K ea1 ,K ea2 ,...,K ear ,...,K eas Perform binning to obtain K. ea The corresponding data clusters; The binning process can be handled using existing binning methods, such as equal-frequency binning or equal-width binning (i.e., setting a range that can cover the entire value range, such as 0-20%, 21%-40%, 41%-60%, 61%-80%, 81%-100%, and then applying this range to K). ea1 ,K ea2 ,...,K ear,...,K eas Separate boxes and check K. ear Which box to put it into, such as K ear If the percentage is 74%, then it is assigned to the 61%-80% bin. The data in each bin after binning is the data in the corresponding data cluster of that bin.

[0018] Step S130: Among the multiple data clusters corresponding to the second historical resource utilization rate list, the data cluster with the largest data volume is determined as the target data cluster corresponding to the second historical resource utilization rate list; Specifically, K ea Among the corresponding data clusters, the data cluster with the largest data volume is determined to be K. ea The corresponding target data cluster; The data cluster with the largest data volume represents the data cluster with the largest proportion of data volume after binning. From this, we can obtain the distribution of the utilization rate of most system resources of the terminal's a-th hardware resource in the e-th second historical time period.

[0019] Step S140: Sort the multiple data clusters corresponding to the second historical resource utilization rate list according to the increasing order of the maximum value in the data cluster, and determine the data cluster that is next to the target data cluster corresponding to the second historical resource utilization rate list as the key data cluster corresponding to the second historical resource utilization rate list. Specifically, K is sorted in ascending order of the largest value in the data cluster. ea Sort the corresponding data clusters, and then select the data cluster located at K from the sorted data clusters. ea The next data cluster corresponding to the target data cluster is determined to be K. ea The corresponding key data clusters.

[0020] Step S150: Determine the system resource utilization rate with the largest value in the key data cluster corresponding to the second historical resource utilization rate list as the maximum resource utilization rate of the hardware resources corresponding to the second historical resource utilization rate list in the corresponding second historical time period. Specifically, K ea The system resource utilization rate with the largest value in the corresponding key data cluster is determined as the maximum resource utilization rate of the terminal's a-th hardware resource in the e-th second historical time period.

[0021] K eaThe system resource utilization rate with the largest value in the corresponding key data cluster is determined as the maximum resource utilization rate of the terminal's a-th hardware resource in the e-th second historical time period. This allows the obtained maximum resource utilization rate to focus on most of the data within that time period, rather than simply looking at the system resource utilization rate with the largest value. This method of determining the maximum resource utilization rate allows the trained resource utilization rate prediction model to focus on the distribution of the overall system resource utilization rate, considering the maximum value of most resource utilization rates and filtering out discrete values. (For example, if there is only one 90% data point in the 81%-100% data cluster, but thirty values ​​in the 41%-60% data cluster, then the 90% data point can be considered as the 90% data point.) As discrete values, these may represent temporary increases in resource utilization due to special circumstances within a historical period. They do not represent the distribution of resource utilization during that period. The data clusters with the largest amount of data (41%-60%) can represent the stable resource utilization during daily use within that period. Therefore, even if this resource utilization is the highest value within that period, it should be discarded to ensure that the obtained maximum resource utilization is the maximum resource utilization of the hardware resource under normal operation, thereby improving the accuracy of subsequent predictions of the maximum resource utilization of the hardware resource in future periods and making the confidence of each resource utilization category obtained later more accurate.

[0022] Step S160: Take the list of all first historical resource utilization rates corresponding to each hardware resource in any first historical time period as the input sample, and take the maximum resource utilization rate corresponding to each hardware resource in the second historical time period that is adjacent to the first historical time period as the output label. Perform supervised training on the initial convolutional neural network to obtain the resource utilization prediction model. Specifically, based on the maximum resource utilization rate of each hardware resource of the terminal within the e-th second historical time period, a list L of historical maximum resource utilization rates corresponding to the e-th second historical time period is established. e =(L e1 ,L e2 ,...,L ea ,...,L eb ); Among them, L ea The maximum resource utilization rate of the terminal's a-th hardware resource during the e-th second historical time period; J e1 J e2 ,...,J ea ,...,J eb As input samples, L e The initial convolutional neural network is used as the output label for supervised training to obtain a resource utilization prediction model.

[0023] Existing supervised training methods can be used to train convolutional neural networks.

[0024] Step S200: Input the resource prediction list into the preset resource utilization classification model to obtain the confidence level of each resource utilization category output by the resource utilization classification model; Resource usage categories include three types: idle, cached, and busy. The idle category indicates that the terminal's overall system resource utilization is low and the terminal is in an idle state. The cached category indicates that the terminal's overall system resource utilization is moderate and the terminal is in a cached state, between idle and busy. The busy category indicates that the terminal's overall system resource utilization is high and the terminal is in a busy state.

[0025] The resource utilization rate classification model is determined according to steps S210-S220: Step S210: Obtain the resource usage category of the terminal in each second historical time period to obtain a category identifier list N=(N1,N2,...,N...). e ,...,N f ); where N e This is the category identifier for the resource usage category corresponding to the terminal in the e-th second historical time period; The resource usage category of the terminal within the second historical time period can be determined by staff according to preset rules, or three resource usage rate ranges can be set, with each resource usage rate range corresponding to a resource usage category. Then, the resource usage category corresponding to the resource usage rate range within a certain second historical time period is determined as the resource usage category of the terminal within that second historical time period.

[0026] Step S220, L e As input samples, N e The output labels are used to supervise the training of the initial classification model to obtain the resource utilization classification model.

[0027] The method for training the initial classification model adopts the existing supervised training method for classification models.

[0028] Step S300: Based on the resource usage category with the highest confidence level, control the start and stop of detection rules in the driver layer and application layer of the terminal; If the resource usage category with the highest confidence is the idle category, then all detection rules in the terminal's driver layer will be enabled, the detection rules in the terminal's application layer that are the same as the detection rules in the driver layer will be disabled, and the detection rules in the terminal's application layer that are different from the detection rules in the driver layer will be enabled. If the resource usage category with the highest confidence is the cache category, then some detection rules in the terminal's driver layer will be enabled, the same detection rules in the terminal's application layer that are enabled in the driver layer will be disabled, and other detection rules in the terminal's application layer will be enabled. If the resource usage category with the highest confidence is the busy category, then all detection rules in the terminal's driver layer will be turned off, and all detection rules in the terminal's application layer will be turned on. The application layer contains several detection rules for all processes, while the driver layer contains several detection rules for a subset of processes.

[0029] The detection rules for all processes on the terminal are configured in the application layer, while the detection rules for some processes are configured in the driver layer. For example, there are four processes: A, B, C, and D. Each process corresponds to a detection rule, which is a rule preset by the staff to intercept and detect the corresponding process. The detection rules for the four processes A, B, C, and D are all configured in the application layer, while the detection rules for processes A and B are configured in the driver layer (the detection rules configured in the driver layer can be determined by the staff according to the importance of their interception).

[0030] If the resource usage category with the highest confidence is the idle category, it means that the terminal will be idle in the future time period. In order to improve the detection speed of the process, all detection rules in the terminal's driver layer will be enabled. In order to further reduce the increase in system resource utilization caused by enabling detection rules, it is necessary to disable the detection rules in the terminal's application layer that are the same as those in the driver layer, so that the same detection rule is enabled only in one of the application layer and the driver layer.

[0031] If the resource usage category with the highest confidence is the cache category, it means that the terminal will be in a cached state in the future time period. In this case, only some detection rules in the driver layer will be enabled to improve the detection speed of the process without putting a heavy burden on the overall system resources.

[0032] If the resource usage category with the highest confidence is the busy category, it means that the terminal will be in a busy state in the future time period and the overall system resource utilization is high. In this case, all detection rules in the terminal's driver layer will be turned off to improve the terminal's response speed.

[0033] Furthermore, step S300 includes steps S310-S350: Step S310: Obtain the identifiers of the detection rules configured in the terminal's driver layer to obtain the first rule identifier list Q1=(Q 11 Q 12 ,...,Q 1u ,...,Q 1v); where u=1,2,...,v; v is the number of detection rules configured in the terminal's driver layer; Q 1u The identifier of the u-th detection rule configured in the terminal's driver layer; Step S320: Obtain the identifiers of the detection rules configured in the application layer of the terminal to obtain the second rule identifier list Q2=(Q 21 Q 22 ,...,Q 2x ,...,Q 2y ); where x=1,2,...,y; y is the number of detection rules configured in the application layer of the terminal; Q 2x The identifier of the x-th detection rule configured in the application layer of the terminal; Q1⊆Q2; Step S330: If the resource usage category with the highest confidence is the idle category, then enable all detection rules corresponding to the first rule identifier list Q1, enable the detection rules corresponding to the identifiers in the second rule identifier list Q2 that belong to Q2 but not to Q1, and disable the detection rules corresponding to the identifiers in the second rule identifier list Q2 that belong to Q1. Step S340: If the resource usage category with the highest confidence is the cache category, then determine the target detection rule according to the importance value corresponding to several detection rules configured in the terminal's driver layer, and enable the target detection rule in the terminal's driver layer, disable the target detection rule in the terminal's application layer, and enable other detection rules in the terminal's application layer. Step S340 includes steps S341-S344: Step S341: If the resource usage category with the highest confidence is the cache category, then obtain the importance value corresponding to each detection rule configured in the terminal's driver layer; Step S342: Sort the detection rules configured in the driver layer according to the decreasing order of importance values, and determine the first preset number of detection rules among the sorted detection rules as target detection rules. Step S343: Enable the target detection rule in the terminal's driver layer and disable other detection rules in the terminal's driver layer; Step S344: Turn off the target detection rules in the application layer of the terminal, and turn on other detection rules in the application layer of the terminal.

[0034] Step S350: If the resource usage category with the highest confidence is the busy category, then all detection rules corresponding to the first rule identifier list Q1 are turned off, and all detection rules corresponding to the second rule identifier list Q2 are turned on.

[0035] As a feasible embodiment, the importance value corresponding to each detection rule configured in the driver layer is determined according to steps S3411-S3413: Step S3411: Obtain the number of times each detection rule configured in the driver layer is invoked within the target time period; The number of times a detection rule is invoked is the number of times the detection rule is used or the number of times the process performs a detection.

[0036] Step S3412: Obtain the duration for which each detection rule configured in the driver layer is invoked within the target time period; The duration of the call is the process detection duration of the corresponding detection rule.

[0037] Step S3413: The product of the number of times any detection rule configured in the driver layer is called within the target time period and the duration of the call is determined as the importance value of the detection rule within the target time period.

[0038] The higher the number of times a detection rule is invoked within a target time period and the longer the invocation duration, the more frequently the detection rule is used, indicating that it is more important to the corresponding process, and thus its importance value is greater.

[0039] As another feasible embodiment, the importance value corresponding to each detection rule in the terminal can also be determined according to steps S500-S900: Step S500: Determine the call identifier list corresponding to each runnable application based on the function called by each runnable application during runtime; Runnable applications are those that can be run on the terminal.

[0040] Functions are operating system functions of the terminal that can be called by a running application at runtime, such as functions for business logic implementation, functions for network communication, functions for memory allocation, etc.

[0041] The call identifier list includes the call identifier corresponding to the call status of each function.

[0042] Furthermore, step S500 includes steps S510-S520: Step S510: Obtain the initial identifier list A=(A1,A2,...,A1) i ,...,A m ); where i = 1, 2, ..., m; m is the number of function calls that the application can make at runtime; A i This is the function identifier corresponding to the i-th function that the application can call at runtime; Step S520: Based on the function calls made by each runnable application on the terminal during runtime, traverse the initial identifier list A to obtain several call identifier lists B1, B2, ..., B... j ,...,B n ; Where j = 1, 2, ..., n; n is the number of runnable applications on the terminal; B j This is the list of call identifiers corresponding to the j-th runnable application; B j =(B j1 B j2 ,...,B ji ,...,B jm ); B ji This is the call identifier corresponding to the call status of the j-th runnable application to the i-th function; When the j-th runnable application calls the i-th function during runtime, B ji =1; When the j-th runnable application does not call the ith function during runtime, B ji It is 0.

[0043] Several call identifier lists have the same function at the same position, namely B. 1i B 2i ,...,B ji ,...,B ni The corresponding function is the same.

[0044] Step S600: Perform bitwise summation on several call identifier lists to obtain the target identifier list C=(C1,C2,...,C...). i ,...,C m ); Among them, C i =∑ n j=1 B ji .

[0045] Step S700: Based on the ratio of each identifier value in the target identifier list to the number of runnable applications, establish a function call ratio list D=(D1,D2,...,D...). i ,...,D m ); Among them, D i =C i / n.

[0046] D i The larger the value, the more times the i-th function is called by the runnable application.

[0047] Step S800: Determine the first detection weight corresponding to each detection rule based on the ratio of several function calls in the function call ratio list corresponding to the same detection rule; Furthermore, step S800 includes steps S810-S830: Step S810: Obtain several function identifiers corresponding to each detection rule to obtain a list of function identifiers E1, E2, ..., E corresponding to several detection rules. p ,...,E y Where p = 1, 2, ..., y; y is the number of detection rules; E p This is a list of function identifiers corresponding to the p-th detection rule; E p =(E p1 E p2 ,...,E pg ,...,E pt(p) ); g=1,2,...,t(p); t(p) is the number of function functions corresponding to the p-th detection rule; E pg This is the function identifier for the g-th function corresponding to the p-th detection rule; Step S820, according to E p Iterate through the function call ratio list D to obtain the ratio list F corresponding to the p-th detection rule. p =(F p1 ,F p2 ,...,F pg ,...,F pt(p) ); where F pg For E pg The corresponding function's function call ratio is listed in function call ratio list D; Step S830: MAX(F) p The p-th detection rule is determined as the first detection weight. MAX() is a preset function for determining the maximum value.

[0048] Step S900: Determine the second detection weight corresponding to each detection rule based on the detection type corresponding to each detection rule; Specifically, if the detection type corresponding to the p-th detection rule is continuous detection, then the second detection weight corresponding to the p-th detection rule is determined to be h1; If the detection type corresponding to the p-th detection rule is startup detection, then the second detection weight corresponding to the p-th detection rule is determined to be h2; Where h1 > h2 > 1.

[0049] The detection rule corresponds to the continuous detection type, which means that the detection rule is in a real-time detection state or an intermittent detection state (that is, the process is detected at regular intervals).

[0050] The detection rule corresponds to the detection type "startup detection", which means that the detection rule is only performed at startup.

[0051] Therefore, the importance value Z corresponding to the p-th detection rule p =H p ×M p H p M represents the first detection weight corresponding to the p-th detection rule; p This represents the second detection weight corresponding to the p-th detection rule.

[0052] By determining the detection type and function call ratio of the detection rules, the corresponding importance value is determined. This ensures that the importance of the detection rules takes into account both function call and process detection, so that when the terminal is in a cached state, the detection rules enabled in the driver layer are the most important detection rules for process detection, thereby further improving the process detection speed.

[0053] The detection rule-based start / stop control method of this invention acquires the system resource utilization rate of several hardware resources of the terminal within a target time period at preset intervals, obtaining a resource utilization rate list corresponding to each hardware resource within the target time period. This resource utilization rate list is then input into a resource utilization rate prediction model to obtain a resource prediction list output by the model. This predicts the maximum resource utilization rate of each hardware resource within a future time period. The resource prediction list is then input into a resource utilization rate classification model to obtain the confidence level of each resource utilization category output by the model, representing the terminal's resource utilization status within the future time period. If the resource utilization category with the highest confidence level is the idle category, it indicates that the terminal's resource utilization within the future time period is idle. The system predicts the system resource utilization rate of each hardware resource of the terminal to determine the terminal's resource utilization status in the future. Based on this future resource utilization status, it dynamically controls the start and stop of several detection rules in the terminal's application layer and driver layer to achieve rapid process detection while reducing the resource consumption of detection rules during process detection. If the resource utilization category with the highest confidence is the cache category, it indicates that the terminal's resource utilization will be in a cached state in the future. In this case, some detection rules in the terminal's driver layer are enabled, detection rules in the terminal's application layer that are the same as those enabled in the driver layer are disabled, and other detection rules in the terminal's application layer are enabled. If the resource utilization category with the highest confidence is the busy category, it indicates that the terminal's resource utilization will be in a busy state in the future. In this case, all detection rules in the terminal's application layer and driver layer are enabled, while the detection rules in the terminal's application layer that are the same as those enabled in the driver layer are disabled, and all detection rules in the terminal's application layer are enabled.

[0054] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above according to various exemplary embodiments of the present invention.

[0055] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0056] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0057] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0058] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0059] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0060] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0061] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0062] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0063] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0064] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0065] Electronic devices can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable users to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed through input / output (I / O) interfaces. Furthermore, electronic devices can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapters.

[0066] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0067] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0068] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0069] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0070] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0071] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0072] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0073] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A detection rule-based start / stop control method, characterized in that, include: Step S100: Every preset time interval, input the system resource utilization rate of each hardware resource of the terminal within the target time period into the preset resource utilization rate prediction model to obtain a resource prediction list. The resource prediction list includes the predicted maximum resource utilization rate for each of the aforementioned hardware resources within a future time period. The duration of the target time period is greater than the preset duration, and the end time of the target time period is the current time; The duration of the future time period is the preset duration, and the start time of the future time period is the end time of the target time period; The resource utilization prediction model is obtained by training samples of the system resource utilization rate of each hardware resource within a historical time period. Step S200: Input the resource prediction list into the preset resource utilization classification model to obtain the confidence level of each resource utilization category; Step S300: Based on the resource usage category with the highest confidence level, control the start and stop of the detection rules in the driver layer and application layer of the terminal; The resource usage categories include idle, cached, and busy categories; the application layer is configured with detection rules for all processes, and the driver layer is configured with detection rules for some processes, and the start / stop status of the same detection rule is different in the driver layer and the application layer. If the resource usage category with the highest confidence is the idle category, then all detection rules in the terminal's driver layer will be enabled, the detection rules in the terminal's application layer that are the same as the detection rules in the driver layer will be disabled, and the detection rules in the terminal's application layer that are different from the detection rules in the driver layer will be enabled. If the resource usage category with the highest confidence is the cache category, then some detection rules in the terminal's driver layer will be enabled, the same detection rules in the terminal's application layer that are enabled in the driver layer will be disabled, and other detection rules in the terminal's application layer will be enabled. If the resource usage category with the highest confidence is the busy category, then all detection rules in the terminal's driver layer will be turned off, and all detection rules in the terminal's application layer will be turned on.

2. The method according to claim 1, characterized in that, Step S100 includes: Step S101: At preset intervals, obtain the system resource utilization rate of each hardware resource of the terminal within the target time period to obtain multiple resource utilization rate lists G1, G2, ..., G a ,...,G b Where a = 1, 2, ..., b; b is the quantity of hardware resources of the terminal; G a This is a list of resource utilization rates for the a-th hardware resource of the terminal within the target time period. G a =(G a1 G a2 ,...,G ac ,...,G ad ); c=1,2,...,d; d is the number of data acquisition moments included in the target time period; the duration between any two adjacent data acquisition moments in the target time period is equal; G ac The system resource utilization rate of the a-th hardware resource of the terminal at the c-th data acquisition time within the target time period.

3. The method according to claim 2, characterized in that, The resource utilization prediction model is determined according to the following steps: Step S110: Obtain the system resource utilization rate of each hardware resource of the terminal in each first historical time period and each second historical time period to obtain multiple first historical resource utilization rate lists and multiple second historical resource utilization rate lists. Wherein, the end time of each first historical time period is earlier than the start time of the target time period, and the duration of each first historical time period is equal to the duration of the target time period; the start time of each second historical time period is the end time of any first historical time period; the duration of each second historical time period is the preset duration; and the duration between any two adjacent data collection times within the second historical time period is equal. Step S120: Perform binning on any second historical resource utilization rate list to obtain multiple data clusters corresponding to the second historical resource utilization rate list; Step S130: Among the multiple data clusters corresponding to the second historical resource utilization rate list, the data cluster with the largest data volume is determined as the target data cluster corresponding to the second historical resource utilization rate list; Step S140: Sort the multiple data clusters corresponding to the second historical resource utilization rate list according to the increasing order of the maximum value in the data cluster, and determine the data cluster that is next to the target data cluster corresponding to the second historical resource utilization rate list as the key data cluster corresponding to the second historical resource utilization rate list. Step S150: Determine the system resource utilization rate with the largest value in the key data cluster corresponding to the second historical resource utilization rate list as the maximum resource utilization rate of the hardware resources corresponding to the second historical resource utilization rate list in the corresponding second historical time period. Step S160: Take the list of all first historical resource utilization rates corresponding to each hardware resource in any first historical time period as input sample, and take the maximum resource utilization rate corresponding to each hardware resource in the second historical time period that is adjacent to the first historical time period as output label, and perform supervised training on the initial convolutional neural network to obtain the resource utilization prediction model.

4. The method according to claim 3, characterized in that, The resource utilization rate classification model is determined according to the following steps: Step S210: Obtain the resource usage category of the terminal in each of the second historical time periods to obtain a category identifier list N=(N1,N2,...,N...). e ,...,N f ); where e = 1, 2, ..., f; f is the number of the second historical time periods; N e The category identifier for the resource usage category corresponding to the terminal in the e-th second historical time period; Step S220, L e As input samples, N e The initial classification model is trained in a supervised manner using the output labels to obtain the resource utilization classification model. Among them, L e To establish a list of historical maximum resource utilization rates for the e-th second historical time period based on the maximum resource utilization rate of each hardware resource of the terminal in the e-th second historical time period; L e =(L e1 ,L e2 ,...,L ea ,...,L eb );L ea This represents the maximum resource utilization rate of the terminal's a-th hardware resource during the e-th second historical time period.

5. The method according to claim 4, characterized in that, Step S300 includes: Step S310: Obtain the identifiers of the detection rules configured in the driver layer of the terminal to obtain a first rule identifier list Q1=(Q 11 Q 12 ,...,Q 1u ,...,Q 1v ); where u=1,2,...,v; v is the number of detection rules configured in the driver layer of the terminal; Q 1u The identifier of the u-th detection rule configured in the driver layer of the terminal; Step S320: Obtain the identifiers of the detection rules configured in the application layer of the terminal to obtain a second rule identifier list Q2=(Q 21 Q 22 ,...,Q 2x ,...,Q 2y ); where x=1,2,...,y; y is the number of detection rules configured in the application layer of the terminal; Q 2x The identifier of the x-th detection rule configured in the application layer of the terminal; Q1⊆Q2; Step S330: If the resource usage category with the highest confidence is the idle category, then enable all detection rules corresponding to the first rule identifier list Q1, enable the detection rules corresponding to the identifiers in the second rule identifier list Q2 that belong to Q2 but not to Q1, and disable the detection rules corresponding to the identifiers in the second rule identifier list Q2 that belong to Q1. Step S340: If the resource usage category with the highest confidence is the cache category, then determine the target detection rule according to the importance value corresponding to the detection rule configured in the driver layer of the terminal, and enable the target detection rule in the driver layer of the terminal, disable the target detection rule in the application layer of the terminal, and enable other detection rules in the application layer of the terminal. Step S350: If the resource usage category with the highest confidence is the busy category, then all detection rules corresponding to the first rule identifier list Q1 are turned off, and all detection rules corresponding to the second rule identifier list Q2 are turned on.

6. The method according to claim 5, characterized in that, Step S340 includes: Step S341: If the resource usage category with the highest confidence is the cache category, then obtain the importance value corresponding to each detection rule configured in the driver layer of the terminal; Step S342: Sort the detection rules configured in the driving layer according to the decreasing order of importance value, and determine the first preset number of detection rules in the sorted detection rules as target detection rules; Step S343: Enable the target detection rule in the driver layer of the terminal and disable the other detection rules in the driver layer of the terminal; Step S344: Turn off the target detection rules in the application layer of the terminal and turn on other detection rules in the application layer of the terminal.

7. The method according to claim 6, characterized in that, The importance value corresponding to each detection rule configured in the driver layer is determined according to the following steps: Step S3411: Obtain the number of times each detection rule configured in the driver layer is invoked within the target time period; Step S3412: Obtain the duration for which each detection rule configured in the driver layer is invoked within the target time period; Step S3413: The product of the number of times any detection rule configured in the driver layer is called within the target time period and the duration of the call is determined as the importance value of the detection rule within the target time period.

8. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method as described in any one of claims 1-7.

9. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 8.

Images