A rule application position detection method, an electronic device, and a storage medium

Abstract

The application provides a rule application position determination method, an electronic device and a storage medium, and the method comprises the following steps: determining a function call ratio list according to the calling state of a function function called by each executable application program on a terminal during running; determining an importance degree value corresponding to each detection rule according to the ratio of a plurality of function functions corresponding to the same detection rule in the function call ratio list and the detection type corresponding to each detection rule; sorting the plurality of detection rules according to the descending order of the importance degree values, and determining the application position of the first preset number of detection rules in the sorted plurality of detection rules as the driving layer of the terminal, and determining the application position of the remaining detection rules as the application layer of the terminal, so that the detection rules with high importance degrees are arranged in the driving layer, so that the process can be quickly detected, and the resource occupation of the detection rules during process detection is reduced.

Description

Technical Field

[0001] This invention relates to the field of process detection, and in particular to a method for determining the application location of detection rules, an electronic device, and a storage medium. Background Technology

[0002] The terminal is divided into security and debugging modes. When a process starts on the terminal, it sends a message to the terminal's application layer. The detection rules deployed on the application layer determine whether to intercept the process. After detecting and judging the process, the application layer sends the detection result to the terminal's driver layer, which then performs the specific interception / allowing operation. Since the application layer and the driver layer need to synchronize data, it will affect the terminal's performance. If the process detection rules are deployed on the driver layer, it will improve the process detection speed, but it will consume a lot of system resources, which may lead to the terminal blue screen, freezing, etc. Therefore, how to dynamically adjust the number of detection rules deployed in the driver layer and the application layer to achieve a relative balance between process detection speed and system resource consumption is a technical problem that urgently needs to be solved. Summary of the Invention

[0003] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows: According to one aspect of this application, a method for determining the application location of a detection rule is provided, comprising: Step S100: Determine the call identifier list corresponding to each runnable application based on the function called by each runnable application during runtime; The call identifier list includes the call identifier corresponding to the call status of each function; the function corresponding to the same position in several call identifier lists is the same; Step S200: Perform bitwise summation on several call identifier lists to obtain a target identifier list; Step S300: Establish a function call ratio list based on the ratio of each identifier value in the target identifier list to the number of runnable applications; Step S400: Determine the first detection weight corresponding to each detection rule based on the ratio of several function calls in the function call ratio list corresponding to the same detection rule; Step S500: Determine the second detection weight corresponding to each detection rule based on the detection type corresponding to each detection rule; Step S600: Determine the importance value of each detection rule based on the first detection weight and the second detection weight corresponding to each detection rule. Step S700: Sort several detection rules according to the decreasing order of importance values, and determine the application position of the first preset number of detection rules in the sorted detection rules as the driver layer of the terminal, and the application position of the remaining detection rules as the application layer of the terminal.

[0004] According to another aspect of this application, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored in the storage medium, the at least one instruction or the at least one program being loaded and executed by a processor to implement the aforementioned detection rule application location determination method.

[0005] According to another aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0006] The present invention has at least the following beneficial effects: The detection rule application location determination method of the present invention first determines a call identifier list corresponding to each runnable application based on the call status of the function calls made by each runnable application during runtime. Then, it performs positional summation on several call identifier lists to obtain a target identifier list. Based on the ratio of each identifier value in the target identifier list to the number of runnable applications, a function call ratio list is established. Based on the ratio of several function calls corresponding to the same detection rule in the function call ratio list, a first detection weight corresponding to each detection rule is determined. Then, based on the detection type corresponding to each detection rule, a second detection weight corresponding to each detection rule is determined. Finally, based on each detection rule… The first and second detection weights are used to determine the importance value of each detection rule. The importance value indicates the importance of the corresponding detection rule when detecting a process. Several detection rules are sorted according to the decreasing order of importance value. The application position of the first preset number of detection rules in the sorted list is determined as the terminal driver layer, and the application position of the remaining detection rules is determined as the terminal application layer. By determining the importance value of each detection rule, the deployment and application position of the detection rule is determined, so that the detection rules with high importance are deployed in the driver layer, so as to reduce the resource consumption of the detection rules during process detection while realizing fast process detection. Attached Figure Description

[0007] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 A flowchart of the detection rule application location determination method provided in an embodiment of the present invention. Detailed Implementation

[0009] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0010] This application proposes a method for determining the location of detection rule applications, such as... Figure 1 As shown, it includes: Step S100: Determine the call identifier list corresponding to each runnable application based on the function called by each runnable application during runtime; Runnable applications are those that can be run on the terminal.

[0011] Functions are operating system functions of the terminal that can be called by a running application at runtime, such as functions for business logic implementation, functions for network communication, functions for memory allocation, etc.

[0012] The call identifier list includes the call identifier corresponding to the call status of each function.

[0013] Furthermore, step S100 includes steps S110-S120: Step S110: Obtain the initial identifier list A=(A1,A2,...,A1) i ,...,A m ); where i = 1, 2, ..., m; m is the number of function calls that the application can make at runtime; A i This is the function identifier corresponding to the i-th function that the application can call at runtime; Step S120: Based on the function calls made by each runnable application on the terminal during runtime, traverse the initial identifier list A to obtain several call identifier lists B1, B2, ..., B j ,...,B n ; Where j = 1, 2, ..., n; n is the number of runnable applications on the terminal; B j This is the list of call identifiers corresponding to the j-th runnable application; B j =(B j1 B j2 ,...,B ji,...,B jm ); B ji This is the call identifier corresponding to the call status of the j-th runnable application to the i-th function; When the j-th runnable application calls the i-th function during runtime, B ji =1; When the j-th runnable application does not call the ith function during runtime, B ji It is 0.

[0014] Several call identifier lists have the same function at the same position, namely B. 1i B 2i ,...,B ji ,...,B ni The corresponding function is the same.

[0015] Step S200: Perform bitwise summation on several call identifier lists to obtain the target identifier list C=(C1,C2,...,C...). i ,...,C m ); Among them, C i =∑ n j=1 B ji .

[0016] Step S300: Based on the ratio of each identifier value in the target identifier list to the number of runnable applications, establish a function call ratio list D=(D1,D2,...,D...). i ,...,D m ); Among them, D i =C i / n.

[0017] D i The larger the value, the more times the i-th function is called by the runnable application.

[0018] Step S400: Determine the first detection weight corresponding to each detection rule based on the ratio of several function calls in the function call ratio list corresponding to the same detection rule; Furthermore, step S400 includes steps S410-S430: Step S410: Obtain several function identifiers corresponding to each detection rule to obtain a list of function identifiers E1, E2, ..., E corresponding to several detection rules. p ,...,E q Where p = 1, 2, ..., q; q is the number of detection rules; E pThis is a list of function identifiers corresponding to the p-th detection rule; E p =(E p1 E p2 ,...,E pg ,...,E pt(p) ); g=1,2,...,t(p); t(p) is the number of function functions corresponding to the p-th detection rule; E pg This is the function identifier for the g-th function corresponding to the p-th detection rule; Step S420, according to E p Iterate through the function call ratio list D to obtain the ratio list F corresponding to the p-th detection rule. p =(F p1 ,F p2 ,...,F pg ,...,F pt(p) ); where F pg For E pg The corresponding function's function call ratio is listed in function call ratio list D; Step S430: MAX(F) p The p-th detection rule is determined as the first detection weight. MAX() is a preset function for determining the maximum value.

[0019] Step S500: Determine the second detection weight corresponding to each detection rule based on the detection type corresponding to each detection rule; Specifically, if the detection type corresponding to the p-th detection rule is continuous detection, then the second detection weight corresponding to the p-th detection rule is determined to be h1; If the detection type corresponding to the p-th detection rule is startup detection, then the second detection weight corresponding to the p-th detection rule is determined to be h2; Where h1 > h2 > 1.

[0020] The detection rule corresponds to the continuous detection type, which means that the detection rule is in a real-time detection state or an intermittent detection state (that is, the process is detected at regular intervals).

[0021] The detection rule corresponds to the detection type "startup detection", which means that the detection rule is only performed at startup.

[0022] Step S600: Determine the importance value of each detection rule based on the first detection weight and the second detection weight corresponding to each detection rule. Wherein, the importance value Z corresponding to the p-th detection rule p =H p ×M p Hp M represents the first detection weight corresponding to the p-th detection rule; p This represents the second detection weight corresponding to the p-th detection rule.

[0023] By determining the detection type and function call ratio of the detection rules, the corresponding importance value is determined. This ensures that the importance of the detection rules takes into account both function call and process detection, thus guaranteeing that the detection rules configured in the driver layer are the most important for process detection and further improving the process detection speed.

[0024] Step S700: Sort several detection rules according to the decreasing order of importance values, and determine the application position of the first preset number of detection rules in the sorted detection rules as the driver layer of the terminal, and the application position of the remaining detection rules as the application layer of the terminal. Furthermore, step S700 includes steps S710-S720: Step S710: Sort the q detection rules according to their decreasing importance values ​​to obtain several sorted rules I1, I2, ..., I... p ,...,I q Among them, I p This refers to the p-th detection rule after sorting q detection rules. Step S720, transfer I1 to I w Cache it in the terminal's driver layer, and put I w+1 to I q Cached in the application layer of the terminal; Where w is the preset maximum cache size of the detection rules in the terminal's driver layer.

[0025] The detection rules for several processes are divided into two parts according to their importance. The detection rules with higher importance are configured in the driver layer, and the remaining detection rules are configured in the application layer. This allows the detection rules in the driver layer to detect the corresponding processes more quickly. Since only some detection rules are configured in the driver layer, it will not put a heavy burden on the terminal's response speed while quickly detecting processes.

[0026] In addition, to further reduce the system resource occupancy rate, the present invention also includes steps S8100-S8400, which dynamically start and stop the detection rules deployed in the driver layer and application layer without adjusting the number of detection rules deployed in the driver layer and application layer.

[0027] Step S8100: Every preset time interval, obtain the system resource utilization rate of several hardware resources of the terminal within the target time period, so as to obtain a resource utilization rate list corresponding to each hardware resource within the target time period. The duration of the target time period is longer than the preset duration, and the end time of the target time period is the current time.

[0028] The hardware resources of the terminal can be computing resources (central processing unit, graphics processing unit, embedded processor, etc.) or storage resources (such as memory, external storage, cache, etc.).

[0029] The system resource utilization rate corresponding to hardware resources is the proportion of system resources used by that hardware resource in the total system resources.

[0030] Specifically, at preset intervals, the system resource utilization rate of each hardware resource of the terminal within the target time period is obtained to obtain several resource utilization rate lists G1, G2, ..., G a ,...,G b Where a = 1, 2, ..., b; b is the amount of hardware resources in the terminal; G a This is a list of resource utilization rates for the a-th hardware resource of the terminal within the target time period. G a =(G a1 G a2 ,...,G ac ,...,G ad ); c=1,2,...,d; d is the number of data collection moments included in the target time period; the duration between any two adjacent data collection moments within the target time period is equal; G ac This represents the system resource utilization rate of the terminal's a-th hardware resource at the c-th data acquisition time within the target time period.

[0031] Step S8200: Input several resource utilization rate lists into the preset resource utilization rate prediction model to obtain the resource prediction list output by the resource utilization rate prediction model; The resource forecast list includes the predicted maximum resource utilization rate for each hardware resource over a future time period.

[0032] The duration of the future time period is the preset duration, and the start time of the future time period is the end time of the target time period.

[0033] The resource utilization prediction model is obtained by training on samples of system resource utilization rates of several hardware resources over a historical period. Specifically, the resource utilization prediction model is determined according to steps S8210-S8280: Step S8210: Obtain the system resource utilization rate of each hardware resource of the terminal within several first historical time periods to obtain several first historical resource utilization rate list sets J1, J2, ..., J e ,...,J f Where e = 1, 2, ..., f; f is the number of the first historical time period; J e This is a list of historical resource utilization rates corresponding to the e-th first historical time period; The end time of each first historical time period is earlier than the start time of the target time period, and the duration of each first historical time period is equal to the duration of the target time period. J e =(J e1 J e2 ,...,J ea ,...,J eb ); J ea This is a list of historical resource utilization rates for the a-th hardware resource of the terminal during the e-th first historical time period. J ea =(J ea1 J ea2 ,...,J eac ,...,J ead ); J eac The system resource utilization rate of the terminal's a-th hardware resource at the c-th data acquisition time within the e-th first historical time period; Step S8220: Obtain the system resource utilization rate of each hardware resource of the terminal within several second historical time periods to obtain a list set of several second historical resource utilization rates K1, K2, ..., K e ,...,K f Among them, K e This is a list of historical resource utilization rates corresponding to the e-th second historical time period; The start time of the e-th second historical time period is the end time of the e-th first historical time period; the duration of each second historical time period is a preset duration; K e =(K e1 ,K e2 ,...,K ea ,...,K eb ); K ea This is a list of historical resource utilization rates for the terminal's a-th hardware resource during the e-th second historical time period. K ea =(K ea1 ,K ea2 ,...,K ear ,...,K eas); r=1,2,...,s; s is the number of data collection moments included in the second historical time period; the duration between any two adjacent data collection moments in the second historical time period is equal; K ear The system resource utilization rate of the terminal's a-th hardware resource at the r-th data acquisition time within the e-th second historical time period; Step S8230, for K ea1 ,K ea2 ,...,K ear ,...,K eas Perform binning to obtain K. ea The corresponding data clusters; The binning process can be handled using existing binning methods, such as equal-frequency binning or equal-width binning (i.e., setting a range that can cover the entire value range, such as 0-20%, 21%-40%, 41%-60%, 61%-80%, 81%-100%, and then applying this range to K). ea1 ,K ea2 ,...,K ear ,...,K eas Separate boxes and check K. ear Which box to put it into, such as K ear If the percentage is 74%, then it is assigned to the 61%-80% bin. The data in each bin after binning is the data in the corresponding data cluster of that bin.

[0034] Step S8240, K ea Among the corresponding data clusters, the data cluster with the largest data volume is determined to be K. ea The corresponding target data cluster; The data cluster with the largest data volume represents the data cluster with the largest proportion of data volume after binning. From this, we can obtain the distribution of the utilization rate of most system resources of the terminal's a-th hardware resource in the e-th second historical time period.

[0035] Step S8250: Following the ascending order of the largest value in the data cluster, process K... ea Sort the corresponding data clusters, and then select the data cluster located at K from the sorted data clusters. ea The next data cluster corresponding to the target data cluster is determined to be K. ea The corresponding key data clusters; Step S8260, K ea The system resource utilization rate with the largest value in the corresponding key data cluster is determined as the maximum resource utilization rate of the terminal's a-th hardware resource in the e-th second historical time period. K eaThe system resource utilization rate with the largest value in the corresponding key data cluster is determined as the maximum resource utilization rate of the terminal's a-th hardware resource in the e-th second historical time period. This allows the obtained maximum resource utilization rate to focus on most of the data within that time period, rather than simply looking at the system resource utilization rate with the largest value. This method of determining the maximum resource utilization rate allows the trained resource utilization rate prediction model to focus on the distribution of the overall system resource utilization rate, considering the maximum value of most resource utilization rates and filtering out discrete values. (For example, if there is only one 90% data point in the 81%-100% data cluster, but thirty values ​​in the 41%-60% data cluster, then the 90% data point can be considered as the 90% data point.) As discrete values, these may represent temporary increases in resource utilization due to special circumstances within a historical period. They do not represent the distribution of resource utilization during that period. The data clusters with the largest amount of data (41%-60%) can represent the stable resource utilization during daily use within that period. Therefore, even if this resource utilization is the highest value within that period, it should be discarded to ensure that the obtained maximum resource utilization is the maximum resource utilization of the hardware resource under normal operation, thereby improving the accuracy of subsequent predictions of the maximum resource utilization of the hardware resource in future periods and making the confidence of each resource utilization category obtained later more accurate.

[0036] Step S8270: Based on the maximum resource utilization rate of each hardware resource of the terminal within the e-th second historical time period, establish a list L of the historical maximum resource utilization rates corresponding to the e-th second historical time period. e =(L e1 ,L e2 ,...,L ea ,...,L eb ); where L ea The maximum resource utilization rate of the terminal's a-th hardware resource during the e-th second historical time period; Step S8280, J e1 J e2 ,...,J ea ,...,J eb As input samples, L e The initial convolutional neural network is used as the output label for supervised training to obtain a resource utilization prediction model.

[0037] Existing supervised training methods can be used to train convolutional neural networks.

[0038] Step S8300: Input the resource prediction list into the preset resource utilization classification model to obtain the confidence level of each resource utilization category output by the resource utilization classification model; Resource usage categories include three types: idle, cached, and busy. The idle category indicates that the terminal's overall system resource utilization is low and the terminal is in an idle state. The cached category indicates that the terminal's overall system resource utilization is moderate and the terminal is in a cached state, between idle and busy. The busy category indicates that the terminal's overall system resource utilization is high and the terminal is in a busy state.

[0039] The resource utilization rate classification model is determined according to steps S8310-S8320: Step S8310: Obtain the resource usage category of the terminal in each second historical time period to obtain a category identifier list N=(N1,N2,...,N...). e ,...,N f ); where N e This is the category identifier for the resource usage category corresponding to the terminal in the e-th second historical time period; The resource usage category of the terminal within the second historical time period can be determined by staff according to preset rules, or three resource usage rate ranges can be set, with each resource usage rate range corresponding to a resource usage category. Then, the resource usage category corresponding to the resource usage rate range within a certain second historical time period is determined as the resource usage category of the terminal within that second historical time period.

[0040] Step S8320, L e As input samples, N e The initial classification model is trained in a supervised manner using the output labels to obtain a resource utilization classification model.

[0041] The method for training the initial classification model adopts the existing supervised training method for classification models.

[0042] Step S8400: If the resource usage category with the highest confidence is the idle category, then enable all detection rules in the terminal's driver layer, disable the detection rules in the terminal's application layer that are of the same type as the detection rules in the driver layer, and enable the detection rules in the terminal's application layer that are of a different type than the detection rules in the driver layer. If the resource usage category with the highest confidence is the cache category, then some detection rules in the terminal's driver layer will be enabled, detection rules in the terminal's application layer of the same type as the detection rules enabled in the driver layer will be disabled, and other detection rules in the terminal's application layer will be enabled. If the resource usage category with the highest confidence is the busy category, then all detection rules in the terminal's driver layer will be turned off, and all detection rules in the terminal's application layer will be turned on. Detection rules in the application layer that are of the same type as those in the driver layer can be detection rules that detect the same type of processes. For example, there is detection rule one in the driver layer and detection rule two in the application layer. Detection rule one and detection rule two are used to detect the same type of processes. In order to ensure that all processes can still be detected even when all detection rules in the driver layer are turned off, so that no processes are missed, the application layer is configured with detection rules of the same type as each detection rule in the driver layer.

[0043] If the resource usage category with the highest confidence is the idle category, it means that the terminal will be idle in the future time period. In order to improve the detection speed of the process, all detection rules in the terminal's driver layer will be enabled. In order to further reduce the increase in system resource utilization caused by enabling detection rules, it is necessary to disable the detection rules of the same type in the terminal's application layer and the driver layer, so that the same type of detection rule is enabled only in one of the application layer and the driver layer.

[0044] If the resource usage category with the highest confidence is the cache category, it means that the terminal will be in a cached state in the future time period. In this case, only some detection rules in the driver layer will be enabled to improve the detection speed of the process without putting a large burden on the overall system resource consumption.

[0045] If the resource usage category with the highest confidence is the busy category, it means that the terminal will be in a busy state in the future time period and the overall system resource utilization is high. In this case, all detection rules in the terminal's driver layer will be turned off to improve the terminal's response speed.

[0046] Furthermore, step S8400 includes steps S8410-S8450: Step S8410: Obtain the type identifier of the detection rule configured in the terminal's driver layer to obtain the first rule type identifier list Q1=(Q 11 Q 12 ,...,Q 1u ,...,Q 1w ); where u=1,2,...,w; w is the number of detection rules configured in the terminal's driver layer; Q 1u The type identifier for the u-th detection rule configured in the terminal's driver layer; Step S8420: Obtain the type identifier of the detection rule configured in the application layer of the terminal to obtain the second rule type identifier list Q2=(Q 21 Q 22 ,...,Q 2x ,...,Q 2y ); where x=1,2,...,y; y is the number of detection rules configured in the application layer of the terminal; Q 2xThe type identifier for the x-th detection rule configured in the application layer of the terminal; y=qw; Step S8430: If the resource usage category with the highest confidence is the idle category, then enable all detection rules corresponding to the first rule identifier list Q1, enable the detection rules corresponding to the type identifiers in the second rule identifier list Q2 that belong to Q2 but not to Q1, and disable the detection rules corresponding to the type identifiers in the second rule identifier list Q2 that belong to Q1. Step S8440: If the resource usage category with the highest confidence is the cache category, then determine the target detection rule according to the importance value corresponding to several detection rules configured in the terminal's driver layer, and enable the target detection rule in the terminal's driver layer, disable the target detection rule in the terminal's application layer, and enable other detection rules in the terminal's application layer. Step S8440 includes steps S8441-S8444: Step S8441: If the resource usage category with the highest confidence is the cache category, then obtain the importance value corresponding to each detection rule configured in the terminal's driver layer; Step S8442: Sort the detection rules configured in the driver layer according to the decreasing order of importance values, and determine the first preset number of detection rules among the sorted detection rules as target detection rules. Step S8443: Enable the target detection rule in the terminal's driver layer and disable other detection rules in the terminal's driver layer; Step S8444: Turn off the detection rules of the same type as the target detection rules in the application layer of the terminal, and turn on other detection rules in the application layer of the terminal.

[0047] The importance value of the detection rule can be determined according to the method in step S600 above, or according to steps S84411-S84413 below: Step S84411: Obtain the number of times each detection rule configured in the driver layer is invoked within the target time period; The number of times a detection rule is invoked is the number of times the detection rule is used or the number of times the process performs a detection.

[0048] Step S84412: Obtain the duration for which each detection rule configured in the driver layer is invoked within the target time period; The duration of the call is the process detection duration of the corresponding detection rule.

[0049] Step S84413: The product of the number of times any detection rule configured in the driver layer is called within the target time period and the duration of the call is determined as the importance value of the detection rule within the target time period.

[0050] The higher the number of times a detection rule is invoked within a target time period and the longer the invocation duration, the more frequently the detection rule is used, indicating that it is more important to the corresponding process, and thus its importance value is greater.

[0051] Step S8450: If the resource usage category with the highest confidence is the busy category, then all detection rules corresponding to the first rule identifier list Q1 are turned off, and all detection rules corresponding to the second rule identifier list Q2 are turned on.

[0052] By predicting the system resource utilization rate of each hardware resource of the terminal, the resource usage status of the terminal in the future time period can be determined. Based on the resource usage status in the future time period, dynamic start and stop control is performed on several detection rules in the application layer and driver layer of the terminal to achieve rapid process detection while reducing the resource consumption of detection rules during process detection.

[0053] The detection rule application location determination method of the present invention first determines a call identifier list corresponding to each runnable application based on the call status of the function calls made by each runnable application during runtime. Then, it performs positional summation on several call identifier lists to obtain a target identifier list. Based on the ratio of each identifier value in the target identifier list to the number of runnable applications, a function call ratio list is established. Based on the ratio of several function calls corresponding to the same detection rule in the function call ratio list, a first detection weight corresponding to each detection rule is determined. Then, based on the detection type corresponding to each detection rule, a second detection weight corresponding to each detection rule is determined. Finally, based on each detection rule… The first and second detection weights are used to determine the importance value of each detection rule. The importance value indicates the importance of the corresponding detection rule when detecting a process. Several detection rules are sorted according to the decreasing order of importance value. The application position of the first preset number of detection rules in the sorted list is determined as the terminal driver layer, and the application position of the remaining detection rules is determined as the terminal application layer. By determining the importance value of each detection rule, the deployment and application position of the detection rule is determined, so that the detection rules with high importance are deployed in the driver layer, so as to reduce the resource consumption of the detection rules during process detection while realizing fast process detection.

[0054] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0055] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0056] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0057] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0058] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0059] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0060] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0061] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0062] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0063] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0064] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0065] Electronic devices can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable users to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed through input / output (I / O) interfaces. Furthermore, electronic devices can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapters.

[0066] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0067] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0068] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0069] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0070] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0071] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0072] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0073] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for determining the location of a detection rule application, characterized in that, include: Step S100: Determine the call identifier list corresponding to each of the runnable applications based on the function called by each runnable application during runtime; The call identifier list includes the call identifier corresponding to the call status of each of the aforementioned functions; The same function corresponds to the same position in several of the aforementioned call identifier lists; Step S200: Perform bitwise summation on several of the aforementioned call identifier lists to obtain a target identifier list; Step S300: Establish a function call ratio list based on the ratio of each identifier value in the target identifier list to the number of runnable applications; Step S400: Determine the first detection weight corresponding to each detection rule based on the ratio of several function calls in the function call ratio list corresponding to the same detection rule; Step S500: Determine the second detection weight corresponding to each detection rule according to the detection type corresponding to each detection rule; Step S600: Determine the importance value corresponding to each detection rule based on the first detection weight and the second detection weight corresponding to each detection rule; Step S700: Sort the detection rules according to the decreasing order of importance values, and determine the application position of the first preset number of detection rules in the sorted detection rules as the driver layer of the terminal, and the application position of the remaining detection rules as the application layer of the terminal.

2. The method according to claim 1, characterized in that, Step S100 includes: Step S110: Obtain the initial identifier list A=(A1,A2,...,A1) i ,...,A m ); where i = 1, 2, ..., m; m is the number of function calls that the application can make at runtime; A i This is the function identifier corresponding to the i-th function that the application can call at runtime; Step S120: Based on the function called by each runnable application on the terminal during runtime, traverse the initial identifier list A to obtain several call identifier lists B1, B2, ..., B... j ,...,B n ; Where j = 1, 2, ..., n; n is the number of runnable applications on the terminal; B j This is the list of call identifiers corresponding to the j-th executable application; B j =(B j1 B j2 ,...,B ji ,...,B jm ); B ji The call identifier is the call status corresponding to the i-th function call status of the j-th runnable application. When the j-th executable application calls the i-th function during runtime, B ji =1; When the j-th executable application does not call the ith function during runtime, B ji It is 0.

3. The method according to claim 2, characterized in that, The target identifier list C=(C1,C2,...,C i ,...,C m ); where C i =∑ n j=1 B ji .

4. The method according to claim 3, characterized in that, The function call ratio list D=(D1,D2,...,D i ,...,D m ); where D i =C i / n.

5. The method according to claim 4, characterized in that, Step S400 includes: Step S410: Obtain several function identifiers corresponding to each detection rule to obtain a list of function identifiers E1, E2, ..., E corresponding to several detection rules. p ,...,E q Where p = 1, 2, ..., q; q is the number of detection rules; E p This is a list of function identifiers corresponding to the p-th detection rule; E p =(E p1 E p2 ,...,E pg ,...,E pt(p) ); g = 1, 2, ..., t(p); t(p) is the number of function functions corresponding to the p-th detection rule; E pg This is the function identifier for the g-th function corresponding to the p-th detection rule; Step S420, according to E p Iterate through the function call ratio list D to obtain the ratio list F corresponding to the p-th detection rule. p =(F p1 ,F p2 ,...,F pg ,...,F pt(p) ); where F pg For E pg The corresponding function has the corresponding function call ratio in the function call ratio list D; Step S430: MAX(F) p The p-th detection rule is determined as the first detection weight. MAX() is a preset function for determining the maximum value.

6. The method according to claim 5, characterized in that, Step S500 includes: Step S510: If the detection type corresponding to the p-th detection rule is continuous detection, then determine the second detection weight corresponding to the p-th detection rule as h1; If the detection type corresponding to the p-th detection rule is "start detection", then the second detection weight corresponding to the p-th detection rule is determined to be h2; Where h1 > h2 > 1.

7. The method according to claim 6, characterized in that, The importance value Z corresponding to the p-th detection rule p =H p ×M p ; Among them, H p M represents the first detection weight corresponding to the p-th detection rule; p This represents the second detection weight corresponding to the p-th detection rule.

8. The method according to claim 7, characterized in that, Step S700 includes: Step S710: Sort the q detection rules according to their decreasing importance values ​​to obtain several sorted rules I1, I2, ..., I... p ,...,I q Among them, I p This refers to the p-th detection rule after sorting the q detection rules. Step S720, transfer I1 to I w Cache I in the driver layer of the terminal. w+1 to I q Cached in the application layer of the terminal; Where w is the preset maximum cache size of the detection rules in the driver layer of the terminal.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method as described in any one of claims 1-8.

10. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 9.

Images