Method and device for detecting illegal executable files based on Linux system

Abstract

The application discloses a method, device and equipment for detecting illegal executable files based on a Linux system. In the embodiment of the application, an electronic device identifies a target process whose CPU occupancy rate or memory occupancy rate exceeds a threshold value, acquires a process identification PID of the target process, extracts the name of a corresponding illegal executable file based on the IPD, and thus can accurately and effectively determine the illegal executable file.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and apparatus for detecting illegal executable files based on a Linux system. Background Technology

[0002] Interface machines are crucial devices within Safety Instrumented Systems (SIS). They run on Linux operating systems, allowing many open-source software programs to run. Some of these open-source programs are malicious executables, including those with malicious behavior and those not on the whitelist. The former can harm system operation and information security; the latter may be Trojan horses or other suspicious files. For example: a) they may occupy CPU / memory resources for extended periods, causing system lag or even crashes; b) they may create abnormal socket connections, preventing other legitimate programs from using certain ports. Failure to detect these executables in a timely manner can significantly impact production and cause substantial harm. Summary of the Invention

[0003] This application provides a method and apparatus for detecting illegal executable files based on a Linux system, in order to solve existing problems.

[0004] This invention provides a method for detecting illegal executable files based on a Linux system, the method comprising: Identify target processes whose CPU or memory usage exceeds a preset threshold, and obtain the process ID (PID) of the target process. Based on the process identifier (PID), relevant information about the target process is extracted; wherein, the relevant information includes at least the executable file name; The executable file name was identified as the name of the illegal executable file.

[0005] In one possible implementation, extracting relevant information about the target process based on the process identifier (PID) includes: Search the directory where the process identifier (PID) is stored, and extract the relevant information of the target process; wherein, the directory where the process identifier (PID) is stored is: / proc / pid.

[0006] In one possible implementation, extracting the relevant information of the target process includes: Obtain the absolute path to the executable file from the command line (cmdline); Obtain memory information, including swap space and virtual memory usage; Obtain the files and sockets accessed by the process from the file descriptor (fd).

[0007] In one possible implementation, identifying target processes whose CPU or memory usage exceeds a preset threshold includes: Execute the top command or call a performance monitoring tool to collect resource usage data of each process in real time; The collected results are analyzed, and processes with CPU usage exceeding the first preset threshold or memory usage exceeding the second preset threshold are selected as target processes.

[0008] In one possible implementation, the method further includes: The executable file name, CPU usage, memory usage, absolute path, files opened by the process, and other relevant information corresponding to the target process are collected and sent.

[0009] In one possible implementation, before identifying the target process whose CPU or memory usage exceeds a preset threshold, the method further includes: If a detection command is received, the subsequent steps to identify target processes whose CPU or memory usage exceeds a preset threshold will be executed at preset time intervals.

[0010] This application also provides a device for detecting illegal executable files based on a Linux system, the device comprising: The processing module is used to identify target processes whose CPU or memory usage exceeds a preset threshold, obtain the process identifier (PID) of the target process, and extract relevant information of the target process based on the process identifier (PID); wherein, the relevant information includes at least the executable file name; The determination module is used to identify the executable file name as the name of an illegal executable file.

[0011] In one possible implementation, the processing module is specifically used to search the directory where the process identifier (PID) is stored and extract relevant information about the target process; wherein the directory where the process identifier (PID) is stored is: / proc / pid.

[0012] In one possible implementation, the processing module is specifically used to obtain the absolute path of the executable file from cmdline; obtain memory information, including swap space and virtual memory usage; and obtain the files and sockets accessed by the process from fd.

[0013] In one possible implementation, the processing module is specifically used to execute the top command or call a performance monitoring tool to collect resource usage data of each process in real time; analyze the collection results, and filter out processes with CPU usage higher than a first preset threshold or memory usage higher than a second preset threshold as target processes.

[0014] In one possible implementation, the processing module is further configured to collect and send the executable file name, CPU usage, memory usage, absolute path, files opened by the process, and other relevant information corresponding to the target process.

[0015] In one possible implementation, the processing module is further configured to, upon receiving a detection instruction, execute subsequent steps at preset time intervals to identify target processes whose CPU or memory usage exceeds a preset threshold.

[0016] This application also provides an electronic device, including: Memory, used to store computer programs; When a processor executes a computer program stored in the memory, it implements the method steps described in any one of the above statements.

[0017] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0018] This application also provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to perform the steps described in any of the above.

[0019] In this embodiment, the electronic device identifies a target process whose CPU or memory usage exceeds a threshold, obtains the process identifier (PID) of the target process, and extracts the name of the corresponding illegal executable file based on the process identifier (PID), thereby accurately and effectively determining the illegal executable file. Attached Figure Description

[0020] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 A flowchart illustrating a method for detecting illegal executable files based on a Linux system, provided as an embodiment of this application; Figure 2A detailed process diagram illustrating the detection of illegal executable files based on a Linux system is provided for embodiments of this application. Figure 3 A schematic diagram of a device for detecting illegal executable files based on a Linux system, provided in this application embodiment; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0022] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this invention is for describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0023] To detect illegal executable files, this application provides a method and apparatus for detecting illegal executable files based on a Linux system.

[0024] The method includes the following steps: the electronic device identifies a target process whose CPU usage or memory usage exceeds a preset threshold, and obtains the process identifier (PID) of the target process; based on the process identifier (PID), extracts relevant information about the target process; wherein the relevant information includes at least the name of an executable file; and the name of the executable file is determined as the name of the illegal executable file.

[0025] Example 1: Figure 1 A flowchart illustrating a method for detecting illegal executable files based on a Linux system, provided in this application embodiment, includes the following steps: S101: Identify the target process whose CPU or memory usage exceeds a preset threshold, and obtain the PID of the target process.

[0026] The method for detecting illegal executable files based on a Linux system provided in this application is applied to an electronic device, which can be a PC or a server, or other intelligent device. This detection method is deployed on an interface machine of the SIS system, which runs a standard Linux operating system. After the system boots up, the method enters a standby state and periodically scans all currently running user-mode and kernel-mode processes in the system.

[0027] In one possible implementation, the electronic device can collect the CPU usage and physical memory occupancy of each process by calling the underlying performance acquisition interface or executing system commands. When the CPU usage of a process exceeds a preset first threshold (e.g., 80% for more than 5 seconds), or the memory occupancy exceeds a second preset threshold (e.g., 70%), the process is marked as a target process.

[0028] The electronic device obtains the process identifier (PID) of the target process, which serves as a unique index for subsequent in-depth analysis.

[0029] S102: Extract relevant information of the target process based on the process identifier (PID); wherein the relevant information includes at least the executable file name.

[0030] After obtaining the process identifier (PID), the electronic device can extract the basic attribute information of the process from the data structure maintained by the operating system kernel based on the process identifier (PID), which includes at least the name of the executable file loaded when it starts.

[0031] S103: The executable file name is determined to be the name of the illegal executable file.

[0032] Electronic devices can record the name of this executable file as the name of a suspected non-compliant executable file. "Non-compliant" means that the program is not on the whitelist, is not a system service component, or exhibits abnormal behavior (such as prolonged high resource consumption). This name can be used for subsequent comparison with the security baseline database, triggering alarms, or notifying operations and maintenance personnel for verification.

[0033] The embodiments of this application realize the initial mapping from resource anomalies to program naming, which is the first step in the entire detection chain. It has the advantages of being lightweight and having a fast response, and is particularly suitable for deployment in resource-sensitive industrial control scenarios.

[0034] In this embodiment, the electronic device identifies a target process whose CPU or memory usage exceeds a threshold, obtains the process identifier (PID) of the target process, and extracts the name of the corresponding illegal executable file based on the process identifier (PID), thereby accurately and effectively determining the illegal executable file.

[0035] Example 2: To obtain relevant information about the target process, based on the above embodiments, in this embodiment, the step of extracting relevant information about the target process according to the process identifier (PID) includes: Search the directory where the process identifier (PID) is stored, and extract the relevant information of the target process; wherein, the directory where the process identifier (PID) is stored is: / proc / pid.

[0036] The Linux operating system creates a subdirectory named after its process ID (PID) under the / proc directory for each running process (i.e., / proc / ). <pid>This contains a wealth of runtime state information about the process. This information is dynamically generated by the kernel and can be accessed without any additional overhead.

[0037] After identifying the target process and its process ID (PID), the electronic device can immediately construct the corresponding directory path / proc / <pid>(For example, if the process ID PID is 1234, the path is / proc / 1234), and the directory is traversed and searched.

[0038] By reading the key file nodes in this directory, the following information can be obtained: comm file: stores the command name of the process, i.e., the short format of the executable file name; exe symbolic link: points to the actual path of the original executable file, which can be used to verify whether it has been renamed or spoofed; status file: contains metadata such as process status, user identifier (ID), and parent process ID (PID); cmdline file: saves the complete startup command line parameters; fd / directory: lists all open file descriptors; maps and statm: reflect details of memory mapping and memory usage.

[0039] Because in this application embodiment / proc / <pid>Using directories as the core data source enables deep information extraction without relying on external tools. This mechanism does not intrude on the target process, does not affect system stability, and has good compatibility and portability, making it suitable for various mainstream Linux distributions.

[0040] Example 3: In order to extract relevant information about the target process, based on the above embodiments, in this embodiment of the application, the extraction of relevant information about the target process includes: Get the absolute path of the executable file from cmdline; Obtain memory information, including swap space and virtual memory usage; Get the files and sockets accessed by the process from the file descriptor (fd).

[0041] To extract further information from the target process, a more comprehensive behavioral profile can be constructed. This involves obtaining the target process's process ID (PID) and locating / proc / <pid>After accessing the directory, the electronic device can selectively read the following key nodes to reconstruct the process's runtime environment and interactive behavior: Obtain the absolute path of the executable file: by reading / proc / <pid>The file ` / cmdline` is analyzed, and the first parameter (usually the program path) is parsed to obtain the complete absolute path of the executable file actually loaded by the process. If the path is located in an unconventional directory (such as ` / tmp`, ` / dev / shm`) or a directory without a home directory, it is highly suspected to be a temporarily uploaded malicious program.

[0042] Collect memory usage information: from / proc / <pid>Extract fields from ` / status` such as actual physical memory usage, virtual memory size, and swap space usage to assess whether the process has memory leaks or abnormal bloat. For example, if a script interpreter process uses more than 1GB of memory, which is clearly outside the normal range, it should be considered abnormal.

[0043] To obtain files and network sockets accessed by a process: traverse / proc / <pid>Symbolic links in the ` / fd / ` directory identify all resource handles currently opened by the process. Common types include: regular files (file): to determine if sensitive configuration files or logs are being accessed; sockets: to analyze whether Transmission Control Protocol (TCP) connections are being established, especially connections to public Internet Protocol (IP) networks or uncommon ports; pipes or First In, First Out (FIFO): to understand communication patterns with other processes; device files: to check if there are attempts to directly manipulate hardware.

[0044] By comprehensively analyzing the above information, it is possible to determine whether the process exhibits potential malicious behavior characteristics, such as lateral movement, data leakage, or persistent persistence. This significantly enhances the accuracy and context-awareness of detection.

[0045] Example 4: To identify target processes, based on the above embodiments, in this embodiment, identifying target processes whose CPU or memory usage exceeds a preset threshold includes: Execute the top command or call a performance monitoring tool to collect resource usage data of each process in real time; The collected results are analyzed, and processes with CPU usage exceeding the first preset threshold or memory usage exceeding the second preset threshold are selected as target processes.

[0046] To accurately identify target processes with excessive CPU or memory usage, this method employs two complementary approaches to obtain system-level performance metrics: Method 1: Execute the `top` command and parse the output: The electronic device executes the command `top -b -n 1` (single sampling in batch mode) to capture a real-time resource usage ranking table of all processes in the current system. Then, the output text is parsed line by line, extracting fields such as process identifier (PID), process name, CPU%, and runtime from each record. Candidate processes meeting the criteria are filtered by setting a first preset threshold (e.g., CPU > 80%) and a second preset threshold (e.g., memory > 70%). Considering instantaneous peak interference, the system can also introduce a sliding window mechanism, officially marking a process as a target only when it exceeds the threshold for N consecutive samples.

[0047] Method 2: Use professional performance monitoring tools or APIs: For scenarios requiring higher precision, the resource allocation of each process can be calculated. Additionally, resource quotas can be allocated by service category, triggering an alert if a process in a group exceeds its quota.

[0048] Compared to simply relying on a fixed threshold, this embodiment supports flexible configuration of sampling frequency, duration, and threshold strategy (static / dynamic), which improves the robustness and adaptability of detection and avoids false alarms and missed alarms.

[0049] Example 5: Based on the above embodiments, in this embodiment of the application, the method further includes: The executable file name, CPU usage, memory usage, absolute path, files opened by the process, and other relevant information corresponding to the target process are collected and sent.

[0050] Once an electronic device identifies a process as an abnormal target process, it can immediately aggregate information, structure and package the relevant data, and form a complete security incident report. This report may include the following fields: executable file name; complete absolute path; current CPU usage; memory usage; startup command line; list of open critical files; active network connections (local address:port → remote address:port); detection timestamp; and user and session information.

[0051] The report can be sent to administrators' email addresses via an encrypted channel, and can also be sent to the SIS system's management center and security management platform. The transmission protocol can use HTTP(S), MQTT, Syslog, or a proprietary protocol to ensure reliable delivery even in unstable network environments. Upon receiving the message, the management center can automatically match it with the asset inventory, blacklist / whitelist database, or threat intelligence database to further determine whether the program is indeed in violation and decide whether to take measures such as blocking, isolation, or issuing an alert.

[0052] The embodiments of this application realize closed-loop management from local detection to remote collaborative response, thereby improving the linkage capability of the overall security system.

[0053] Example 6: Based on the above embodiments, in this embodiment of the application, before identifying the target process whose CPU usage or memory usage exceeds a preset threshold, the method further includes: If a detection command is received, the subsequent steps to identify target processes whose CPU or memory usage exceeds a preset threshold will be executed at preset time intervals.

[0054] To avoid the burden of high-frequency scanning around the clock, this application adopts an "on-demand triggering" working mode. That is, in the initial state, the detection program is in a sleep or low-power listening state, occupying only minimal resources.

[0055] Upon receiving a detection command from the SIS main control center, remote operation and maintenance terminal, or timer, the detection process is immediately activated. Once a valid command is detected, a timed task is started, which repeats the following steps at preset time intervals (e.g., every 30 seconds, every minute): calls the performance acquisition module to obtain the latest process resource usage data; determines whether there is a target process whose CPU or memory usage exceeds the threshold; if so, proceeds to the information extraction and reporting process; if not, continues to wait for the next round of sampling.

[0056] This mechanism supports flexible configuration of detection frequency and duration (such as automatic stop after 10 minutes of continuous detection), which can meet the needs of sudden investigation while also ensuring system stability.

[0057] This application provides a lightweight, automated, and scalable method for detecting illegal executable files on the Linux platform. By combining resource monitoring, process information extraction, context analysis, and remote reporting mechanisms, it can effectively identify potential malicious programs or abnormally behaving processes without relying on third-party antivirus software. It is particularly suitable for scenarios with high security requirements but limited resources, such as SIS interface machines in industrial control systems.

[0058] This application proposes a method for detecting malicious executable files using the operating system's built-in `top` command and ` / proc` directory scanning. The method first develops a background detection program that periodically scans the command line output of the `top` command to find the process IDs (PIDs) of processes consuming excessive CPU / memory. Then, by scanning the information in the ` / proc / PID` directory, the path of the process and the resources it accesses are located, thus achieving the purpose of detecting malicious executable files. Finally, the detection results are communicated to the system administrator via email or other means so that measures can be taken to ensure the normal operation of the SIS system interface machine. This method can effectively and accurately detect malicious executable files, promptly report them to the system administrator, thereby eliminating potential system malfunctions and ensuring the normal and reliable operation of the interface machine.

[0059] Figure 2 This is a detailed process diagram provided for an embodiment of this application.

[0060] The steps of the entire method are shown in the diagram above: Step 1: Start the detection program.

[0061] Step 2: Read the configuration file to obtain the detection polling time interval, administrator email address, etc.

[0062] Step 3: The detection program executes the top command to analyze the processes that are using too much CPU / memory and finds the process ID (PID).

[0063] Step 4: Based on the process ID (PID), search the / proc / pid directory to obtain the following information: Get the absolute path of the executable file from cmdline; Obtain memory information, including swap space and virtual memory usage; Obtain the files, sockets, etc. accessed by the process from the file descriptor (fd); Step 5: Compile the information such as the executable file name, CPU usage, memory usage, absolute path, and files opened by the process, and send it to the specified email address. Repeat steps 2-5 above to perform the detection loop; then stop the detection service and exit the detection program.

[0064] Based on the methods provided in the above embodiments, this application also provides a device for detecting illegal executable files based on a Linux system. Figure 3 A schematic diagram of a device for detecting illegal executable files based on a Linux system, provided in this application embodiment, is shown. The device includes: The processing module 301 is used to identify a target process whose CPU usage or memory usage exceeds a preset threshold, obtain the process identifier (PID) of the target process, and extract relevant information of the target process based on the process identifier (PID); wherein the relevant information includes at least the executable file name; The determination module 302 is used to determine the executable file name as the name of an illegal executable file.

[0065] In one possible implementation, the processing module 301 is specifically used to search the directory where the process identifier (PID) is stored and extract relevant information about the target process; wherein, the directory where the process identifier (PID) is stored is: / proc / pid.

[0066] In one possible implementation, the processing module 301 is specifically used to obtain the absolute path of the executable file from cmdline; obtain memory information, including swap space and virtual memory usage; and obtain the files and sockets accessed by the process from fd.

[0067] In one possible implementation, the processing module 301 is specifically used to execute the top command or call a performance monitoring tool to collect resource usage data of each process in real time; analyze the collection results, and filter out processes with CPU usage higher than a first preset threshold or memory usage higher than a second preset threshold as target processes.

[0068] In one possible implementation, the processing module 301 is further configured to summarize and send the executable file name, CPU usage, memory usage, absolute path, files opened by the process, and other relevant information corresponding to the target process.

[0069] In one possible implementation, the processing module 301 is further configured to, if a detection instruction is received, execute subsequent steps at preset time intervals to identify target processes whose CPU usage or memory usage exceeds a preset threshold.

[0070] Based on the same inventive concept, this application also provides an electronic device that can implement the aforementioned method for detecting illegal executable files based on a Linux system. (See reference...) Figure 4 The electronic device includes: The system includes at least one processor 401, a memory 403 connected to the at least one processor 401, and a communication interface 402. In this embodiment, the specific connection medium between the processor 401 and the memory 403 is not limited. Figure 4 The example shown is the connection between processor 401 and memory 403 via bus 404. Bus 404 is... Figure 4 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 404 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 4 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, processor 401 can also be called a controller; there is no restriction on the name.

[0071] In this embodiment, the memory 403 stores instructions executable by at least one processor 401. By executing the instructions stored in the memory 403, the at least one processor 401 can perform the IoT device upgrade method described above. The processor 401 can implement... Figure 4 The system shown illustrates the functions of each module.

[0072] The processor 401 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 403 and calling data stored in memory 403, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0073] In one possible design, processor 401 may include one or more processing units. Processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 401. In some embodiments, processor 401 and memory 403 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0074] Processor 401 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the IoT device upgrade method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0075] Memory 403, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 403 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 403 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 403 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0076] By designing and programming the processor 401, the code corresponding to the IoT device upgrade method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the code during operation. Figure 1 The steps of the IoT device upgrade method shown in the embodiment are described. How to design and program the processor 401 is a technique well-known to those skilled in the art and will not be elaborated here.

[0077] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the previously described method for detecting illegal executable files based on a Linux system.

[0078] In some possible implementations, various aspects of the Linux system-based method for detecting illegal executable files provided in this application can also be implemented as a program product comprising program code that, when the program product is run on a device, causes the control device to perform the steps in the IoT device upgrade method according to the various exemplary embodiments of this application described above.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit them. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of this application. Any modifications or equivalent substitutions that do not depart from the spirit and scope of this application should be covered within the protection scope of the claims of this application.< / pid> < / pid> < / pid> < / pid> < / pid> < / pid> < / pid>

Claims

1. A method for detecting illegal executable files based on a Linux system, characterized in that, The method runs on an interface machine, which is equipped with a Linux operating system, and the method includes: Identify target processes whose CPU or memory usage exceeds a preset threshold, and obtain the process identifier (PID) of the target process. Based on the process identifier (PID), relevant information about the target process is extracted; wherein, the relevant information includes at least the executable file name; The executable file name was identified as the name of the illegal executable file.

2. The method according to claim 1, characterized in that, The step of extracting relevant information of the target process based on the process identifier (PID) includes: Search the directory where the process identifier (PID) is stored, and extract the relevant information of the target process; wherein, the directory where the process identifier (PID) is stored is: / proc / pid.

3. The method according to claim 1 or 2, characterized in that, The extraction of relevant information about the target process includes: Obtain the absolute path of the executable file from the command line (cmdline); Obtain memory information, including swap space and virtual memory usage; Obtain the file and socket accessed by the process from the file descriptor fd.

4. The method according to claim 1, characterized in that, The identification of target processes whose CPU or memory usage exceeds a preset threshold includes: Execute the top command or call a performance monitoring tool to collect resource usage data of each process in real time; The collected results are analyzed, and processes with CPU usage exceeding the first preset threshold or memory usage exceeding the second preset threshold are selected as target processes.

5. The method according to claim 1, characterized in that, The method further includes: The executable file name, CPU usage, memory usage, absolute path, files opened by the process, and other relevant information corresponding to the target process are collected and sent.

6. The method according to claim 1, characterized in that, Before identifying a target process whose CPU or memory usage exceeds a preset threshold, the method further includes: If a detection command is received, the subsequent steps to identify target processes whose CPU or memory usage exceeds a preset threshold will be executed at preset time intervals.

7. A device for detecting illegal executable files based on a Linux system, characterized in that, The device includes: The processing module is used to identify target processes whose CPU or memory usage exceeds a preset threshold, obtain the process identifier (PID) of the target process, and extract relevant information of the target process based on the process identifier (PID); wherein, the relevant information includes at least the executable file name; The determination module is used to identify the executable file name as the name of an illegal executable file.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method steps of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Its computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the steps as described in any one of claims 1-6.

Images